Cyber AB CMMC-CCP Exam With Confidence Using Practice Dumps

Step 1: Responsibility for Subcontractor Compliance

The prime contractor (contractor organization)is responsible for ensuring thatits subcontractorshave the requiredCMMC certification levelbefore engaging them inDoD contracts that involve FCI or CUI.

This requirement is enforced throughflow-down clausesinDFARS 252.204-7021, which mandates that subcontractors handlingCUImeet the necessaryCMMC Level 2 or Level 3 requirements.

Step 1: Understanding CMMC Level 1 Self-Assessment Scope

CMMC Level 1applies toFederal Contract Information (FCI)systems.

Any system or device that is connected to an FCI-handling network is within the assessment scopebecause it canintroduce vulnerabilitiesinto the environment.

Step 2: Why the Thermostat is in Scope

TheWi-Fi-enabled thermostat is connected to the FCI network, meaning it haspotential accessto sensitive contract-related data.

PerCMMC Scoping Guidance, this type of device is classified as aRestricted Information System (Restricted IS)—devices that do not store, process, or transmit FCI but areconnected to networks that do.

Restricted IS must be accounted for in the self-assessment scope to ensure they do not compromise security controls.

Per DoDI 5200.48, Controlled Unclassified Information (CUI), the minimum marking requirement is that the word “CUI” must appear in the header and footer of each page of a document containing CUI. Additional markings such as portion markings or cover sheets may be applied depending on the situation, but the minimum baseline requirement is header and footer placement of "CUI".

Reference Documents:

DoDI 5200.48,Controlled Unclassified Information (CUI)