Background on Legacy Markings and CUI
Legacy markings refer to classification labels used before the implementation of the Controlled Unclassified Information (CUI) Program under DoD Instruction 5200.48.
Documents with legacy markings (such as "For Official Use Only" (FOUO) or "Sensitive But Unclassified" (SBU)) must be reviewed for re-marking or redaction to align with CUI requirements.
When Must Legacy Markings Be Updated?
If the document is retained internally (Answer A - Incorrect): Documents under DoD control do not require immediate re-marking unless they are being shared externally.
If the document is classified as Secret (Answer B - Incorrect): This question is about CUI, not classified information. Secret-level documents follow different marking rules under DoD Manual 5200.01.
If a document is being shared externally (Answer C - Correct):
According to DoD Instruction 5200.48, Section 3.6(a), organizations must review legacy markings before sharing documents outside the organization.
The document must be re-marked in compliance with the CUI Program before dissemination.
If the original document does not contain CUI (Answer D - Incorrect): The original source document's status does not affect the requirement to re-mark a derivative document if it contains CUI.
Conclusion
The correct answer is C: Documents with legacy markings must be re-marked or redacted when being shared outside the organization to comply with DoD CUI guidelines.
References:
DoD Instruction 5200.48 (Controlled Unclassified Information)
CUI Marking Handbook by NARA (National Archives and Records Administration) CMMC 2.0 Scoping Guide for CUI Environments

Step 1: Understanding CMMC Domains
TheCMMC Model consists of 14 domains, which are based on theNIST SP 800-171 control familieswith additional cybersecurity practices.
Eachdomaincontainspractices and processesthat define cybersecurity requirements for organizations seeking CMMC certification.
Reference:
CMMC 2.0 Model Documentation
NIST SP 800-171 Framework
Step 2: List of 14 CMMC Domains
Access Control (AC)
Asset Management (AM)(Introduced in CMMC 2.0 for scoping guidance)
Audit and Accountability (AU)
Awareness and Training (AT)
Configuration Management (CM)
Identification and Authentication (IA)
Incident Response (IR)
Maintenance (MA)
Media Protection (MP)
Personnel Security (PS)
Physical Protection (PE)
Risk Management (RM)
Security Assessment (CA)
System and Communications Protection (SC)
Step 3: Why Other Answer Choices Are Incorrect
B). 43 domains (Incorrect):
The CMMC model does not have43 domains; this number is incorrect.
C). 72 domains (Incorrect):
There are72 practices in CMMC Level 2, but not72 domains.
D). 110 domains (Incorrect):
110 refers to the number of security controls in NIST SP 800-171, which aligns withCMMC Level 2, but these are controls, not domains.
Final Confirmation of Correct Answer:
The CMMC Model consists of 14 domains based on NIST SP 800-171 control families.
Thus, the correct answer is:A. 14 domains

Step 1: Understanding Who Specifies CMMC Levels
TheU.S. Department of Defense (DoD)determines the requiredCMMC Levelbased on thesensitivity of the information involved in a contract.
The required CMMC Level isspecified in Requests for Information (RFIs) and Requests for Proposals (RFPs).
Reference:
DFARS 252.204-7021 (CMMC Requirements)
CMMC 2.0 Program Documentation
Step 2: Why Other Answer Choices Are Incorrect
B). NARA (Incorrect):
TheNational Archives and Records Administration (NARA)overseesCUI program policiesbut does not assign CMMC levels.
C). NIST (Incorrect):
TheNational Institute of Standards and Technology (NIST)develops cybersecurity frameworks (e.g.,NIST SP
800-171), but it does not specify CMMC Levels in contracts.
D). Department of Homeland Security (Incorrect):
TheDepartment of Homeland Security (DHS)is responsible for cybersecurity at the national level, butCMMC applies specifically to DoD contractors.
Final Confirmation of Correct answer:
The DoD determines and specifies the required CMMC Level in RFIs and RFPs.

When a company usesthird-party IT providersto manage their infrastructure, these organizations are classified asExternal Service Providers (ESPs)underCMMC scoping guidelines.
Step-by-Step Breakdown:
#1. What is an ESP?
External Service Providers (ESPs)arethird-party organizationsthat:
ProvideIT services, cloud hosting, and managed security solutions.
Process, store, or transmit FCI or CUIon behalf of a contractor.
Mustmeet the same security requirementsas the OSC if they handle FCI or CUI.
If a company relies ona hosting provider to manage IT infrastructure, that provider is anESPunderCMMC scoping guidelines.
#2. Why the Other Answer Choices Are Incorrect:
(B) People#
Incorrect:ESPs areorganizations, not individual people.
(C) Facilities#
Incorrect:Facilities refer tophysical locationslike office buildings or data centers, not third-partyservice providers.
(D) Technology#
Incorrect:While ESPs provide technology services, the correct term forthird-party IT providersunder CMMC isESPs, not just "Technology." Final Validation from CMMC Documentation:
TheCMMC Level 1 Scoping GuidedefinesExternal Service Providers (ESPs)asthird-party organizations that manage IT infrastructure and security services.
Thus, the correct answer is:
#A. ESPs (External Service Providers).

Understanding DFARS Clause 252.204-7012
TheDefense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012is a mandatory cybersecurity clause required inall DoD contracts and solicitationsthat involveControlled Unclassified Information (CUI).
Key Requirements of DFARS 252.204-7012
#Implements NIST SP 800-171security controls for contractors handlingCUI.
#Requirescyber incident reportingto theDoD Cyber Crime Center (DC3)within72 hours.
#Mandatesadequate security measuresto protectDoD information systems.
#Applies toall DoD contracts, except for those exclusively acquiring COTS items.
Why "All DoD Solicitations and Contracts" is Correct?
Option A (Correct):DFARS 252.204-7012must be included in all DoD contracts and solicitationswhen CUI is involved.
Option B (Incorrect):FAR Part 12 procedures apply tocommercial item acquisitions, but DFARS 7012 appliesregardless of procurement procedures.
Option C (Incorrect):Contractssolely for COTS (Commercial Off-the-Shelf) productsare exemptfrom DFARS
7012.
Option D (Incorrect):COTS itemssold without modificationsarenot requiredto include DFARS 7012.
Official References from DoD and DFARS Documentation
DFARS Clause 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) NIST SP 800-171- The required cybersecurity standard for contractors under DFARS 7012.
Final Verification and Conclusion