A defense contractor's newly hired consultant holds an active CCP with a favorable Tier 3 determination. The C3PAO wants to place the consultant on an upcoming CMMC Level 2 assessment team. Which role can the consultant lawfully perform on that engagement?
Explanation
CCPs holding a favorable Tier 3 determination can participate on a CMMC Level 2 Assessment, only to verify Level 1 practices. CCPs cannot make final
An organization that stores Controlled Unclassified Information (CUI) needs to determine which CMMC level applies and what standard governs it. Based on the framework's level structure, which level and control basis are appropriate for protecting CUI with mature, reliable security practices?
Explanation
CMMC Level 2 (Advanced) — Requires implementation of the full NIST SP 800-171 controls to protect Controlled Unclassified Information (CUI)