Domain 1: Data Sources and Governance
-Summarize background information on the protection of FCI and CUI in non-federal unclassified networks and information systems.
-Define, contrast, identify, and determine roles/responsibilities/authority for FCI and CUI.
-Determine and identify the contents of the provided documents by checking markings, diagrams, drawings, and labels.
-Manage and classify data sources by type (logical/physical) to determine their markings for proper storage.
-Protect and secure the transmission of data egress and ingress of the network to keep and view records with authorized personnel.
-Search and identify the provided unclassified documents by discerning the location of the labels to ensure it meets the necessarily required markings.
-Apply security settings to folders, files, and directories by giving proper roles to prevent unauthorized individuals.
-Isolate and segment the network by data classifications with similar information systems using role-based access to force grant access to those who need it.
-Control and handle documents, personnel files, and forms digitally/physically to lock server/metal cabinets with proper access authorization.
-Protect the reports, forms, and documents by encryption at rests/in transits for authorized employees.
-Limit any forms and/or documents with proper security roles using technical/non-technical mechanisms to ensure information flowing within the network are controlled and monitored.
-Follow the lifecycle of records administration in accordance with policies and procedures to ensure the papers and/or documents in digital/physical forms are disposed of properly.
-Follow and review the procedures of CUI destruction of records.
Domain 2: CMMC Ecosystem
-Identify, describe, and compare roles, responsibilities, and requirements of authorities across the CMMC Ecosystem.
-Identify, describe, and compare roles, responsibilities, and requirements of organizations across the CMMC Ecosystem.
-Identify, describe, and compare roles, responsibilities, and requirements of individuals across the CMMC Ecosystem.
Domain 3: Ethics
-Identify and mitigate ethical concerns based on the Guiding Principles and Practices of the CMMC-AB Code of Professional Conduct (CoPC) and ISO/IEC and DoD requirements.
Domain 4: CMMC Reference Documents
-Identify the primary reference documentation.
-Reference Federal Acquisition Regulations to affirm the legal authority for CUI / FCI safeguarding and CMMC requirements, and procedures.
-Reference NIST documentation to refine CMMC assessment methodology, security practices, assessment objectives, and objective evidence characteristics.
-Reference CUI documentation to identify CUI / FCI, which enables scoping of the CMMC assessment boundaries.
-Reference CERT Documentation to inform their understanding of CMMC Maturity Level security practices, assessment objectives, and objective evidence characteristics.
Domain 5: CMMC Source Documents
-Navigate and reference the CMMC Source Documents.
-Navigate and reference the CMMC supplementary documents.
Domain 6: CMMC Model Construct and Implementation Guidance
-Given a scenario, apply CMMC Source Documents as an aid to implement or review practices and processes.
Domain 7: CMMC Assessment
-Understand the CCP Implementer role when supporting the CMMC Assessment Process during Phase 1 – Plan and Prepare assessment.
-Understand the CCP role when supporting OSC’s CMMC Assessment (Phase 2 – Conduct Assessment).
-Understand the CCP implementation role in supporting the preparation of report recommendations (Phase 3 – Report Recommended Assessment Results).
-Understand the CCP implementation role in the remediation process of outstanding assessment issues (Phase 4 – Remediation of Outstanding Assessment Issues).
-Utilize the CMMC Assessment Guides In preparation for conducting a CMMC assessment.
-Prepare the assessment artifact baseline for the prescribed CMMC Maturity Level.
Domain 8: Scoping
-CMMC High-Level Scoping.
