FAQs - Page 2 of 4

Q: What are three assets that might be considered "in scope" for a CMMC Level 1 self-assessment?

Three assets that might be considered "in scope" for a CMMC Level 1 self-assessment are a laptop used to access contract documents, a server storing FCI data, and an email system used to transmit FCI.

Q: Explain the concept of "least privilege" in access control.

The concept of "least privilege" means that users are only granted the minimum level of access permissions necessary to perform their assigned tasks. This minimizes the potential damage from unauthorized access or accidental misuse of privileges.

Q: What is the purpose of a DMZ in network security?

A DMZ (Demilitarized Zone) acts as a buffer zone between the public internet and a private network. It allows controlled access to public-facing services while isolating the internal network from direct exposure, enhancing security by limiting the impact of potential breaches.

Q: What is the difference between a "vulnerability" and a "flaw" in an information system?

A "flaw" is a general term for any weakness or imperfection in an information system, which may include vulnerabilities. A "vulnerability" is a specific type of flaw that can be exploited by a threat to gain unauthorized access or compromise the system.