Understanding Training Requirements in CMMC
The requirement for ensuring thatpersonnel are trained to carry out their assigned information security-related duties and responsibilitiesfirst appears inCMMC Level 2as part ofNIST SP 800-171 control AT.L2-3.2.1.
Key Details on the Training Requirement:
#AT.L2-3.2.1: "Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities."
#This control is derived fromNIST SP 800-171and applies toCMMC Level 2 (Advanced).
#It ensures that employees handlingControlled Unclassified Information (CUI)understand theircybersecurity responsibilities.
Why is the Correct Answer "B. Level 2"?
A). Level 1 # Incorrect
CMMC Level 1 does not include this training requirement.Level 1 focuses on basic safeguarding ofFederal Contract Information (FCI)but doesnot require formal cybersecurity training.
B). Level 2 # Correct
The training requirement (AT.L2-3.2.1) first appears in CMMC Level 2, which aligns withNIST SP 800-171.
C). Level 3 # Incorrect
The training requirementalready exists in Level 2. Level 3 builds on Level 2 with additionalrisk management and advanced cybersecurity controls, but training is introduced at Level 2.
D). All levels # Incorrect
CMMC Level 1 does not include this requirement-it is first introduced in Level 2.
CMMC 2.0 References Supporting This Answer:
NIST SP 800-171 (Requirement 3.2.1)
Defines themandatory training requirementfor personnel handling CUI.
CMMC Assessment Guide for Level 2
ListsAT.L2-3.2.1as a required practice under Level 2.
CMMC 2.0 Model Overview
Confirms thatCMMC Level 2 aligns with NIST SP 800-171, which includes security training requirements.

The correct answer is A because the first ethical response to observing a possible Code of Professional Conduct violation is proportionate, professional, and corrective-not punitive or investigative. A CMMC professional must preserve objectivity, professionalism, and accountability while avoiding escalation beyond the facts. Privately requesting clarification allows the professional to confirm whether the observed behavior is truly a violation rather than a misunderstanding. Offering to help rectify the violation supports remediation while maintaining professional respect and confidentiality.
Option B is too aggressive because the DoD contract representative is not the first point for routine ecosystem conduct correction. Option C is inappropriate because a CMMC professional does not have authority to conduct a private investigation into another ecosystem member. Option D is also premature because a corrective action review to the CMMC-AB would normally follow unresolved, material, or reportable misconduct, not a first observation that may be clarified or corrected. The ethical principle is disciplined escalation: address the matter directly and professionally first, preserve evidence if needed, and escalate only if the conduct is confirmed, material, or unresolved. Reference
/topics: CMMC-AB Code of Professional Conduct, professionalism, objectivity, accountability, ethical escalation.

Understanding CMMC Asset Scoping Requirements
Before conducting aCMMC Level 2 Assessment, anOrganization Seeking Certification (OSC)must define theassessment scopeby categorizing all assets. This ensures that only relevant systems are assessed againstCMMC practices, reducing unnecessary compliance burdens.
According to theCMMC Scoping Guide for Level 2, there are four asset categories:
CUI Assets- Assets that process, store, or transmitControlled Unclassified Information (CUI).
Security Protection Assets (SPA)- Assets that providesecurity functions(e.g., firewalls, intrusion detection systems, identity management systems).
Contractor Risk Managed Assets (CRMA)- Assets thatdo not directly store/process CUIbut interact with CUI environments (e.g., BYOD devices, personal computers used for remote access).
Specialized Assets- Unique systems such asOperational Technology (OT), IoT, and Government Furnished Equipment (GFE), which may requirelimitedCMMC assessment.
Which Asset Categories Are Always Assessed?
#1. CUI Assets(ALWAYS ASSESSED)
These are theprimary focusof CMMC Level 2 since they handleCUI.
All110 NIST SP 800-171 controlsapply to these assets.
#2. Security Protection Assets (SPA)(ALWAYS ASSESSED)
Security tools that protectCUI Assetsarealways includedin the assessment.
Examples includefirewalls, antivirus, endpoint detection and response (EDR) tools, and identity management systems.
Why the Other Answer Choices Are Incorrect:
(A) CUI Assets and Specialized Assets#
CUI Assets are assessed, butSpecialized Assets are only assessed in a limited manner, depending on their role inCUI security.
(C) Specialized Assets and Contractor Risk Managed Assets#
Specialized Assets and CRMAsare typicallynot fully assessedagainst CMMC controls unless they directly impactCUI security.
(D) Security Protection Assets and Contractor Risk Managed Assets#
SPAs are always assessed, butCRMAs are not necessarily assessedunless they directly impact CUI.
Final Validation from CMMC Documentation:
TheCMMC Scoping Guide (Level 2)clearly states thatCUI Assets and Security Protection Assetsarealways assessedagainst CMMC practices.
Thus, the correct answer is:
B). Security Protection Assets and CUI Assets.

The core protection principle for OSC-provided assessment information (including PCI/CUI, assessment workpapers/notes, and the assessment results package ) is confidentiality / non-disclosure . The CMMC rules require assessors not to disclose OSC information outside the assessment participants, except as required by law. For example, CMMC assessor requirements include not sharing information about an OSC obtained during pre-assessment and assessment activities with anyone not involved in that specific assessment .
For retention, the authoritative requirement in the CMMC Program rule (32 CFR Part 170) is that assessment-related records are maintained for six (6) years , unless disposition is otherwise authorized by the CMMC PMO. This record set includes assessment materials and working papers generated during Level 2 certification assessments, and it also includes contractual agreements.
Important correction to the multiple-choice options: none of the answers list the official six-year retention period. The best available option is therefore B because it correctly captures the required confidentiality
/non-disclosure principle-but the " 3 years " duration in the option does not match the official CMMC v2.0 retention requirement (which is 6 years ).

Understanding RA.L2-3.11.1 Risk Assessment Scope in CMMC Level 2
TheCMMC Level 2 control RA.L2-3.11.1aligns withNIST SP 800-171, Requirement 3.11.1, which mandates that organizationsperiodically assess risks to operations, assets, and individuals arising from the processing, storage, or transmission of CUI.
What is Required for Compliance?
The organization must performrisk assessments on all assets and entities involved in handling CUI.
Risk assessments mustevaluate potential threats, vulnerabilities, and impacts on CUI security.
The scopemust include people, processes, physical locations, and IT systemsto ensure comprehensive risk management.
Why the Correct Answer is " Processes, people, physical entities, and IT systems in which CUI is processed, stored, or transmitted " :
CUIcan be exposed to risk in multiple ways-not just IT systems but also human error, physical security gaps, and process weaknesses.
Risk assessmentsmust evaluate all areas that could impact CUI security, including:
Personnel security risks(e.g., insider threats, phishing attacks).
Process vulnerabilities(e.g., mishandling of CUI, policy weaknesses).
Physical security risks(e.g., unauthorized access to servers, storage rooms).
IT systems(e.g., networks, servers, cloud environments processing CUI).
Clarification of Incorrect Options:
A). " IT systems " #Too narrow.Risk assessmentmust cover more than just IT systems, includingpeople, physical assets, and processesaffecting CUI.
B). " Enterprise systems " #Too broad.While enterprise systems might be assessed, thefocus is specifically on areas handling CUI, not all enterprise operations.
C). " CUI Marking processes " #Incorrect focus.While marking CUI correctly is important,RA.L2-3.11.1 pertains to risk assessments, not data classification.
References:
NIST SP 800-171 Rev. 2 - Requirement 3.11.1(NIST Official Site)
CMMC 2.0 Level 2 Assessment Guide - Risk Assessment Domain(Cyber AB)
#Final answer: D. Processes, people, physical entities, and IT systems in which CUI is processed, stored, or transmitted.