Foundations
Before diving into the 110 requirements, you need to understand the framework they sit inside. Misunderstanding scoring, POA&M eligibility, the difference between an enduring exception and a temporary deficiency, or the affirmation cycle can derail your entire assessment strategy.
| Topic | What it covers |
|---|---|
| What Is CMMC? | Three levels, FCI vs CUI, who it applies to, why it exists |
| Timeline | The four-phase rollout schedule and where we are today |
| Key Documents | The regulatory, technical, and operational sources that define CMMC Level 2 |
| Scoring | Point values, MET / NOT MET / N/A, POA&M eligibility rules, certification outcomes, and the requirements that cannot be POA&M’d |
| Affirmations & Continuous Compliance | The Affirming Official role, what gets affirmed and when, what triggers a new assessment vs an annual affirmation |
| Flow-Down to Subcontractors | How CMMC requirements flow to subs, what level a sub needs, prime obligations to verify sub status |