FAQs - Page 3 of 4

Q: What is the purpose of the CMMC Level 1 self-assessment?

The purpose of the CMMC Level 1 self-assessment is for an Organization Seeking Assessment (OSA) to evaluate its own information system when seeking a CMMC Status of Final Level 1 (Self). This self-assessment is required by 32 CFR § 170.15 and must be performed using the objectives defined in NIST Special Publication (SP) 800-171A.

Q: What is an enclave in the context of CMMC, and how does it affect inherited security implementations?

An enclave is a defined portion of an OSA's environment with specific security controls. While some security implementations can be inherited from the enterprise level, the OSA must ensure that all requirements are met within the enclave. If an enterprise-level implementation is invalidated within the enclave, alternative methods must be demonstrated.

Q: Describe the implications for assessing Federal Contract Information (FCI) and CUI when they exist within the same CMMC Assessment Scope.

If FCI and CUI share the same environment, the Level 2 assessment methods also address Level 1 requirements for FCI. However, if FCI and CUI are in separate environments, independent assessments are needed with separate implementation methods for each scope.

Q: Under what circumstances does an External Service Provider (ESP) fall within an OSA's CMMC assessment scope?

An ESP is within scope if it meets the criteria for CUI Assets or Security Protection Assets, meaning it stores, processes, or transmits CUI or provides security functions within the OSA's environment. The ESP's services and responsibilities, as outlined in agreements like the Customer Responsibility Matrix (CRM), are assessed.