PECB CMMC Foundations (PECB) — Lesson 3: Access, Configuration, Incident, Media, Personnel, Physical, and System Controls

Learning Objectives

• Assess the dependencies, responsibilities, and control choices involved in access, Configuration, Incident, Media, Personnel, Physical, and System Controls for a defense supplier defining its CMMC boundary and preparing people, processes, technology, and evidence for assessment.
• Complete a guided exercise and preserve CMMC practice evidence matrix as reproducible evidence.
• Challenge the result with a practice is documented but not operating consistently, then document the smallest effective correction.

Detailed Topics

• Access
• Configuration
• Incident
• Media
• Personnel
• Physical
• System Controls
• Decision ownership, prerequisites, and acceptance evidence for access, Configuration, Incident, Media, Personnel, Physical, and System Controls
• Security, compliance, resilience, documentation, and support implications for CMMC readiness foundation

Instructor Demonstration

The demonstration follows access, Configuration, Incident, Media, Personnel, Physical, and System Controls from preparation through validation for a defense supplier defining its CMMC boundary and preparing people, processes, technology, and evidence for assessment. Learners review CMMC practice evidence matrix and observe a safe diagnostic sequence for the case where a practice is documented but not operating consistently.

Hands-On Exercise

Analyze and perform access, Configuration, Incident, Media, Personnel, Physical, and System Controls for a defense supplier defining its CMMC boundary and preparing people, processes, technology, and evidence for assessment. Use CMMC practice evidence matrix to compare intended and observed behavior, then resolve the condition where a practice is documented but not operating consistently and verify downstream impact.

1. Confirm the requirement, stakeholders, environment, assumptions, inputs, and expected result.
2. Perform the CMMC readiness foundation workflow and capture evidence before and after each material decision.
3. Test normal, boundary, failure, security, compliance, recovery, and operational conditions where relevant.
4. Document the root cause, correction, rollback, owner, support action, and next improvement priority.

Scenario Analysis

• Identify the business or assurance decision required within a defense supplier defining its CMMC boundary and preparing people, processes, technology, and evidence for assessment.
• Compare control strength, evidence quality, operational impact, cost, resilience, and stakeholder trade-offs.
• Define escalation, communication, recovery, acceptance, and follow-up requirements for CMMC practice evidence matrix.

Troubleshooting Guidance

Treat “a practice is documented but not operating consistently” as a testable hypothesis. Reconstruct the expected workflow, compare it with CMMC practice evidence matrix, isolate the control or evidence gap, and verify recovery without an unapproved production change.

Validation Checklist

• CMMC practice evidence matrix identifies the approved baseline, accountable owner, inputs, and expected result.
• Evidence confirms access, Configuration, Incident, Media, Personnel, Physical, and System Controls under normal and relevant exception conditions.
• The response to “a practice is documented but not operating consistently” is reversible, tested, and supported by before-and-after records.
• Residual CMMC readiness foundation risk, support ownership, deadlines, and the next action are recorded.

Lesson Outcome

Learners can apply Access, Configuration, Incident, Media, Personnel, Physical, and System Controls, explain the choices made, and defend the result using CMMC practice evidence matrix.