ACertified CMMC Professional (CCP)advising anOrganization Seeking Certification (OSC)must ensure thatFederal Contract Information (FCI)andControlled Unclassified Information (CUI)are properly documented within required security documents.
Step-by-Step Breakdown:#1. System Security Plan (SSP)
* CMMC Level 2requires anSSPto documenthow CUI is protected, including:
* Security controlsimplemented
* Asset categorization(CUI Assets, Security Protection Assets, etc.)
* Policies and proceduresfor handling CUI
#2. Asset Inventory
* Anasset inventorylistsall relevant IT systems, applications, and hardwarethat store, process, or transmitCUI or FCI.
* TheCMMC Scoping Guiderequires OSCs to identifyCUI-relevant assetsas part of their compliance.
#3. Network Diagram
* Anetwork diagramvisually representshow data flows across systems, showing:
* WhereCUI is transmitted and stored
* Security boundaries protectingCUI Assets
* Connectivity betweenCUI Assets and Security Protection Assets
#4. Why the Other Answer Choices Are Incorrect:
* (B) Within the hardware inventory, data flow diagram, and in the network diagram#
* While adata flow diagramis useful,hardware inventory alone is insufficientto document CUI.
* (C) Within the asset inventory, in the proposal response, and in the network diagram#
* Aproposal responseis not a required document for CMMC assessments.
* (D) In the network diagram, in the SSP, within the base inventory, and in the proposal response#
* Base inventoryis not a specific CMMC documentation requirement.
* TheCMMC Assessment Guideconfirms that FCI and CUI must be documented in:
* The SSP
* The asset inventory
* The network diagram
Final Validation from CMMC Documentation:Thus, the correct answer is:
#A. "In the SSP, within the asset inventory, and in the network diagram."