FAQ - Revision history

Uncouth: /* What should I do if my customer requests my SPRS score? */

2024-11-04T16:49:41Z

What should I do if my customer requests my SPRS score?

← Older revision		Revision as of 16:49, 4 November 2024
Line 48:		Line 48:

	=== Are phones in scope of a CMMC audit? ===		=== Are phones in scope of a CMMC audit? ===
	~~ANSWERS HERE~~		If phones (mobile devices) are capable of accessing the information system that stores FCI or CUI, yes.

	=== What do I do if I'm sent CUI by my customer? ===		=== What do I do if I'm sent CUI by my customer? ===
Line 68:		Line 68:

	=== What should I do if my customer requests my SPRS score? ===		=== What should I do if my customer requests my SPRS score? ===
	~~ANSWERS HERE~~		If you are prime on the contract, your Contract Officer has the ability to see your score in SPRS, provided that you have submitted a score. If you are a subcontractor, your customer cannot see your score in SPRS. They may request you provide evidence of your submission, and may also request details of the score or even a copy of your SSP. You do not have a DoD contractual obligation to provide this information, however your mileage may vary when it comes to how much you can push back on providing this information.

	=== Do all of my applications have to be FedRAMP to be CMMC compliant? ===		=== Do all of my applications have to be FedRAMP to be CMMC compliant? ===
	ANSWERS HERE		ANSWERS HERE

2024-11-03T23:13:43Z

← Older revision		Revision as of 23:13, 3 November 2024
Line 68:		Line 68:

	=== What should I do if my customer requests my SPRS score? ===		=== What should I do if my customer requests my SPRS score? ===
			ANSWERS HERE

			=== Do all of my applications have to be FedRAMP to be CMMC compliant? ===
	ANSWERS HERE		ANSWERS HERE

2024-11-03T23:11:27Z

@@ Line 11: / Line 11: @@
 === How do I know if I have CUI? ===
-ANSWERS HERE
+It should be marked by the person who sent it to you.  If it's not, but if your purchase order or contract flow-down requires you to protect the data as if it were CUI, contact your buyer/customer and ask for clarification.
 === Are machine files (like CAD models) CUI if I create them as the manufacturer? ===
@@ Line 29: / Line 31: @@
 === What options are out there for training to become a CCP/CCA? ===
 ANSWERS HERE

2024-11-03T22:36:46Z

← Older revision		Revision as of 22:36, 3 November 2024
Line 1:		Line 1:
	The DoD CIO has published their own FAQ here: https://dodcio.defense.gov/CMMC/FAQs/		The DoD CIO has published their own FAQ here: https://dodcio.defense.gov/CMMC/FAQs/

			____________________________________________________

			The COE Discord and CMMC Reddit pages are free resources led by the community. Some of the most common questions are listed below, along with some of the answers offered.

			''NOTE: Depending on your own situation, these answers may not work for your environment. Work with your own compliance or legal team to ensure your implementation and interpretation is acceptable for compliance.''

			=== How much does compliance cost? ===
			ANSWERS HERE

			=== How do I know if I have CUI? ===
			ANSWERS HERE

			=== Are machine files (like CAD models) CUI if I create them as the manufacturer? ===
			ANSWERS HERE

			=== How do I convince management to be compliant? ===
			ANSWERS HERE

			=== What can I expect during a CMMC assessment? ===
			ANSWERS HERE

			=== Do all of my Security Protection Assets (SPA)s need to be CMMC-compliant? ===
			ANSWERS HERE

			=== How do I choose a C3PAO? ===
			ANSWERS HERE

			=== What options are out there for training to become a CCP/CCA? ===
			ANSWERS HERE

2024-10-25T14:49:32Z

Created page with "The DoD CIO has published their own FAQ here: https://dodcio.defense.gov/CMMC/FAQs/"

New page

The DoD CIO has published their own FAQ here: https://dodcio.defense.gov/CMMC/FAQs/