CMMC training: NIST SP 800-171, from scoping CUI to your SPRS score

Opens with a self-check on your CMMC knowledge, whether your company handles US defence contract information, and whether you know what supports your self-assessment score. Then two cases. MORSECORP, a Massachusetts contractor, agreed in March 2025 to pay $4.6 million after submitting a score of 104 with no system security plan and an unchecked e-mail host. Georgia Tech Research Corporation agreed in September 2025 to pay $875,000 over allegations about missing anti-malware and a score for a campus-wide system that did not exist. Explains how CMMC lets the defence department verify that FCI and CUI are protected. Introduces PQR Precision Machining Inc. in Los Angeles, with about 85 staff, and outlines the thirteen modules. Tackles four myths, from 'only for big primes' to 'our cloud provider makes us compliant', and closes with a recap.

What you will be able to do

• Explain what CMMC verifies and why the defence department needs it
• Recognise why a reported score must match systems and evidence
• Challenge four common myths about CMMC and subcontractors

Why it matters

Your score is only as good as your evidence; these cases show what a gap between the two can cost.

Practice: Practice: Welcome, and why CMMC matters · 3 questions

Starts with a new drawing package arriving at PQR: saved everywhere without checking markings in one version, logged as CUI and kept in a protected folder in the other. Reads the Federal Acquisition Regulation definition of federal contract information, then controlled unclassified information and why it needs stronger protection. Sorts PQR's own information: a purchase order with quantities and dates as FCI, files made from a controlled drawing, and bank details as simple transactional information. Explains four rules: the basic safeguarding clause, the defence safeguarding clause, the CMMC clause and the CMMC rule that verifies them. Uses four questions built on the definitions, with an engineering design firm in Boston and a cable-assembly maker in New York. Shows PQR's information list, with where each item comes from and goes, and closes with a recap.

What you will be able to do

• Tell federal contract information from CUI using the definitions
• Identify the four rules that protect FCI and CUI
• Build an information list showing where each item comes from and goes

Why it matters

Knowing what kind of information you hold before deciding where it goes keeps CUI on a small set of protectable systems.

Practice: Practice: FCI, CUI and the rules behind CMMC · 3 questions

Opens with PQR's order book: a brackets subcontract with only FCI naming Level 1, and a housings subcontract with a CUI drawing naming Level 2 with a self-assessment. Reads what the rule says about who selects the CMMC status for each procurement, and the factors behind it. Covers the three levels: fifteen basic requirements for Level 1, 110 for Level 2 and 24 more for Level 3, and the assessment types. Explains Conditional and Final status, how long a Final status stays current, and the yearly affirmation in the Supplier Performance Risk System. Shows PQR's contract register, subcontractor levels with a heat-treatment company in Chicago, and an electronics maker in Boston on a critical contract. Ends with the roll-out, with Phase 1 in force and the next phase paused in July 2026 for review, and a recap.

What you will be able to do

• Read which CMMC level and assessment type a contract names
• Explain Conditional and Final status and how each stays current
• Keep a contract register with each level, status, scope and next date

Why it matters

The contract sets the level, not you; reading it early lets you have the right status before the award.

Practice: Practice: The three levels, assessments and roll-out · 3 questions

Begins with two versions of PQR's scope in a built example: sixty devices in scope just in case, or fourteen devices found by tracing where each drawing goes. Reads section 170.19: the assessment scope is specified before the assessment and built from asset categories. Explains the test of whether an asset processes, stores or transmits CUI, and traces PQR's data flow. Puts PQR's assets into the five categories: CUI assets, security protection assets, contractor risk managed assets, specialised assets and out of scope, with an older machine controller recorded as an enduring exception on an isolated network. Covers a software company in Toronto, tests three more PQR assets together, and shows the three documents that must agree: the asset inventory, the system security plan and the network diagram. Closes with a recap: follow the information, and the scope draws itself.

What you will be able to do

• Trace a CUI data flow from arrival to departure
• Place each asset in one of the five CMMC asset categories
• Check that the inventory, SSP and network diagram agree

Why it matters

Scoping decides how much work everything else will be; a well-drawn scope makes the project smaller and the evidence stronger.

Practice: Practice: Scoping: data flows and asset categories · 3 questions

Opens with PQR's managed service provider in Chicago, which manages its firewall, anti-malware console and security logs: missing from the plan in one version, listed with a responsibility matrix in the other. Reads the rule's definition of an external service provider and security protection data. Walks through three lines of a cloud provider's matrix and five questions to ask a provider before signing. Shows PQR moving CUI off e-mail to the prime contractor's portal, using a cloud file service authorised at fed-ramp Moderate and checking the fed-ramp Marketplace. Covers enclaves and flowing requirements down to subcontractors, with a plating company in New York needing Level 1 and an inspection company in Toronto needing Level 2, checked before award. Ends with a backup service check and a recap: a provider can do the work, but the responsibility stays with you.

What you will be able to do

• Decide whether a provider is in scope as an external service provider
• Write a responsibility matrix that gives every requirement an owner
• Flow CMMC requirements down to subcontractors at the right level

Why it matters

Your score and your affirmation depend on your providers' work; a clear matrix shows who does what and where the evidence is.

Practice: Practice: Enclaves, cloud, providers and subcontractors · 3 questions

Starts with a CNC programmer leaving PQR for a competitor: his account left active for weeks in one version, disabled the same afternoon with logs kept in the other, after a colleague reported him copying files. Covers the access control family of 22 requirements: authorised users and transactions, CUI flow, separation of duties, least privilege, separate admin accounts and control of remote, wireless, mobile, external and public access. Shows PQR's access matrix for the CUI folder, blocked personal cloud drives and checks before website posting. Covers awareness and role-based training, with PQR's yearly refresher of about thirty minutes using its own examples, and insider threat signs. Then audit logs created, traced to each user, reviewed and protected, split between PQR and its provider. Shows how one requirement is assessed, including three programmers sharing one login, and closes with a recap.

What you will be able to do

• Build an access matrix based on least privilege for a CUI folder
• Plan role-based security awareness training for shop-floor staff
• Check that audit logs are traced to users, reviewed and protected

Why it matters

Access control, awareness and logging work together; a leaver's account disabled on day one closes a common gap.

Practice: Practice: Access, awareness and audit · 3 questions

Opens with a planner at PQR typing her password into a fake sign-in page: an attacker reads the CUI folder in one version, and a second factor and monitoring stop it in the other. Covers the nine configuration management requirements: baselines and inventories, secure settings, change control with security impact analysis and least functionality. Shows PQR's three baselines, how a change works, and its allow-list approach under requirement 3.4.8. Explains identification and authentication, with every user identified, multi-factor sign-in through an authenticator app and protected passwords. Then incident response: a capability, records, reporting within 72 hours, and tests. Shows PQR's one-page incident plan with names and times, including its own 24-hour decision point, and closes with a recap: set it safely, sign in strongly, and practise the bad day.

What you will be able to do

• Explain baseline configurations, change control and least functionality
• Apply multi-factor authentication to remote and privileged access
• Write a one-page incident response plan with names and times

Why it matters

A stolen password is an everyday event; a second factor and a practised plan stop it from becoming a breach.

Practice: Practice: Configuration, identity and incidents · 3 questions

Begins with a machine vendor's technician at PQR: alone on the floor with his own USB stick in one version, escorted, scanned, logged and leaving with a wiped drive in the other. Covers the six maintenance requirements, then PQR's steps for remote vendor sessions, asked for, approved, logged and watched, with no standing remote access. Explains media protection: paper counts, so printed drawings go into a locked shredding bin, and PQR uses company-issued encrypted USB sticks with a signed hand-over. Follows one printed drawing across the shop floor and encrypted backups to the cloud service chosen in Module 5. Then personnel security, screening by role and protecting at exit, and physical protection with building zones, escorted visitors and logs, plus home working at an engineering design firm in Boston. Closes with a recap.

What you will be able to do

• Control vendor maintenance, including supervised remote sessions
• Protect, mark, transport and destroy CUI on paper and removable media
• Apply screening, exit steps and physical zones to protect CUI

Why it matters

In a machine shop CUI sits on paper, USB sticks and machine memory too; these controls cover the physical side.

Practice: Practice: Maintenance, media, people and premises · 3 questions

Returns to the Georgia Tech Research Corporation allegations of a research group with no anti-malware tools until December 2021, and asks who would notice a missing basic protection. Covers the three risk assessment requirements, with vulnerability scanning worth five points, and PQR's monthly scans by its provider. Shows PQR's small risk register, using its own scale, and how PQR checks its own controls so the annual affirmation rests on something real. Explains system and communications protection: guarded boundaries, deny by default and validated cryptography, with PQR's four network segments. Then system and information integrity: timely patches, anti-malware and monitoring split between PQR and the Chicago provider. Tests it with a new server found without an anti-malware agent, and closes with a recap: look for your own weaknesses, and act on what you find.

What you will be able to do

• Run a periodic risk assessment and keep a small risk register
• Plan vulnerability scanning and remediation by risk
• Explain boundary protection, validated encryption and monitoring duties

Why it matters

Finding your own weaknesses before someone else does gives your yearly affirmation a real basis.

Practice: Practice: Risk, assessment, protection, integrity · 3 questions

Opens with two system security plans: a two-hundred-page template describing controls PQR does not have, and a forty-page plan describing PQR's real systems and practices. Reads requirement 3.12.4 on system boundaries, environment, implementation and connections, and what the CMMC rule adds. Shows how PQR structures its plan, with section four covering all 110 requirements, such as requirement 3.1.8 with its lock after five failed attempts for thirty minutes. Explains short policies written from practice. Then PQR's plan of action after its first self-assessment, the rule's conditions for a conditional status, and one-point items only with the encryption exception, closed within 180 days. Shows what a cable-assembly maker in New York keeps for Level 1, the evidence an assessor asks for, and closes with a recap: write what you do, do what you wrote, and show it.

What you will be able to do

• Write a system security plan that describes your real systems
• Write policies and procedures that match what you actually do
• Use a plan of action and milestones within the CMMC rule's limits

Why it matters

An assessor believes the shop floor over the plan; a true, current plan keeps every other page credible.

Practice: Practice: The SSP, policies and the POA&M · 3 questions

Returns to the two cases from Module 1: MORSECORP's score of 104 against an actual minus 142, and the university's score of 98 for a system that did not exist. Reads what the rule requires: a self-assessment in line with NIST SP 800-171A across the set scope, scored with the CMMC methodology, entered in the Supplier Performance Risk System and affirmed. Shows PQR's assessment team, a dry run, and the method of examine, interview and test with evidence recorded for every objective. Explains the score: start at 110 and subtract five, three or one for each requirement not met. Shows PQR reaching Conditional Level 2 (Self), what it enters, CAGE code changes, and its president reading the results before she affirms. Covers how Level 1 differs, where the Chicago provider draws the line, common findings, and a recap.

What you will be able to do

• Run a self-assessment using examine, interview and test
• Calculate a CMMC score by subtracting points from 110
• Explain what a senior affirming official confirms and when

Why it matters

A score is a statement the government relies on; an honest assessment protects the person who signs it.

Practice: Practice: Self-assessment, scoring, SPRS and affirmations · 3 questions

Starts with PQR's IT lead reading that NIST has published Revision 3: rewriting the plan overnight in one version, mapping the changes while still meeting Revision 2 in the other. Explains why the CMMC rule still names Revision 2. Covers Level 3: 24 requirements selected from NIST SP 800-172, published in February 2021, for the advanced persistent threat, with values set by the department and assessed by the government. Then Revision 3, with 17 families, 97 requirements and the three new families, and organisation-defined parameters, linked to the values PQR wrote in Module 10. Shows how PQR plans the move: map, list the gaps, draft the values and budget. Tests it with a supplier survey asking whether PQR complies with Revision 3, revisits the Boston electronics maker, and closes with a recap.

What you will be able to do

• Explain what CMMC Level 3 adds on top of Level 2
• Describe the main changes in NIST SP 800-171 Revision 3
• Plan the move to Revision 3 while assessing to Revision 2

Why it matters

Switching early puts your plan and assessment out of line; this shows how to comply now and be ready for the change.

Practice: Practice: Level 3 and Revision 3 · 3 questions

Answers what to do first on Monday with a road map in two parts. The first five steps cover knowing what to protect: read contracts and bids, list the information, trace the data flow, set the scope and bring in providers and subcontractors. The later steps cover a gap assessment of all 110 requirements, fixing gaps in Sterling's recommended order, documenting, assessing and keeping it current. Follows PQR as one built case, from an honest starting score of 48 to a real self-assessment of 104 in month nine, affirmed by its president. Covers working with a managed service provider, quarterly internal checks, the Toronto software company, and a new five-axis machine whose remote support must follow PQR's vendor rule. Ends with the final exam of scenario-based questions and a recap of the course.

What you will be able to do

• Follow a CMMC road map from contracts to a Final status
• Prioritise remediation of gaps in a recommended order
• Keep compliance current after changes such as new equipment

Why it matters

If the scope is wrong, everything built on it is wrong; a road map puts the steps in the right order from day one.

Practice: Practice: Your road map, the case and the exam · 3 questions