Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.0

Practice flashcards covering the key terms, levels, and domains of the Cybersecurity Maturity Model Certification (CMMC) Version 2.0 based on the official model overview transcript.

Federal Contract Information (FCI)

Information provided by or generated for the Government under contract not intended for public release.

Controlled Unclassified Information (CUI)

Information that requires safeguarding or dissemination controls pursuant to and consistent with laws, regulations, and government-wide policies, excluding classified information.

Defense Industrial Base (DIB)

A sector of more than 300,000 companies supporting the warfighter through research, engineering, development, acquisition, production, delivery, sustainment, and operations of DoD systems.

CMMC Level 1

A model level focusing on the basic safeguarding of FCI; it includes 17 practices corresponding to the requirements specified in 48 CFR 52.204-21.

CMMC Level 2

A model level focusing on the protection of CUI; it encompasses the 110 security requirements specified in NIST SP 800-171 Rev 2.

CMMC Level 3

A model level based on a subset of NIST SP 800-172 requirements intended to reduce risk from Advanced Persistent Threats (APTs).

CMMC Domains

The 14 groups of security requirements in the CMMC model that align with the families specified in NIST SP 800-171, such as Access Control (AC) and Incident Response (IR).

Least Privilege

The principle of employing minimum necessary access, including for specific security functions and privileged accounts (Practice AC.L2-3.1.5).

Split Tunneling

A practice that prevents remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via other external network resources (Practice SC.L2-3.13.7).

FIPS-validated cryptography

The specific type of cryptography required to protect the confidentiality of CUI according to CMMC practice SC.L2-3.13.11.

Least Functionality

The practice of configuring organizational systems to provide only essential capabilities, restricting or disabling nonessential programs and services (Practice CM.L2-3.4.6).

System Security Plan (SSP)

A document that describes system boundaries, operation environments, implementation of security requirements, and connections to other systems (Practice CA.L2-3.12.4).

Insider Threat Awareness

Security awareness training focused on recognizing and reporting potential indicators of internal risks (Practice AT.L2-3.2.3).

Multifactor Authentication (MFA)

Identification and authentication requirements for local and network access to privileged accounts and network access to non-privileged accounts (Practice IA.L2-3.5.3).

Advanced Persistent Threat (APT)

A specific category of cyber threat that CMMC Level 3 is designed to mitigate.