Certified Cybersecurity Maturity Model Certification (CMMC) Professional (CCP) Practice Exam

Which level of CMMC applies practices to a CUI asset?

1. CMMC Level 1

2. CMMC Level 2

3. CMMC Level 3

4. CMMC Level 4

The correct answer is: CMMC Level 2

CMMC Level 2 is designed specifically to bridge the gap between basic safeguarding measures and more advanced cybersecurity practices that focus on Controlled Unclassified Information (CUI). At this level, organizations implement specific practices and processes intended to protect and manage CUI. This includes the introduction of an expanded set of security capabilities that go beyond what is required at Level 1. CMMC Level 2 adopts practices from NIST SP 800-171, which further emphasizes the need for organizations that handle CUI to not only have physical and technical controls in place but also to establish a robust security management program. This level requires organizations to establish policies and procedures around protecting CUI, conducting risk assessments, and ensuring compliance among their employees. This focus on CUI handling and protection is essential for organizations engaging with federal contracts, making CMMC Level 2 a critical milestone for those aiming to assure compliance with government requirements. While CMMC Levels 1, 3, and beyond have their own unique focuses and requirements, it is Level 2 that explicitly lays down practices necessary for the appropriate handling and safeguarding of CUI.