PECB CMMC Foundations (PECB) — Lesson 4: Evidence, Self-Assessment, SSP, POA&M, Readiness Review, and Continual Improvement

Learning Objectives

• Trace evidence, Self-Assessment, SSP, POA&M, Readiness Review, and Continual Improvement from business need through implementation evidence in a defense supplier defining its CMMC boundary and preparing people, processes, technology, and evidence for assessment.
• Create assessment readiness and remediation plan that another practitioner can independently review.
• Diagnose the readiness review accepts weak evidence without remediation, test a reversible response, and confirm no residual failure remains.

Detailed Topics

• Evidence
• Self-Assessment
• SSP
• POA&M
• Readiness Review
• Continual Improvement
• Decision ownership, prerequisites, and acceptance evidence for evidence, Self-Assessment, SSP, POA&M, Readiness Review, and Continual Improvement
• Security, compliance, resilience, documentation, and support implications for CMMC readiness foundation

Instructor Demonstration

Using a defense supplier defining its CMMC boundary and preparing people, processes, technology, and evidence for assessment, the instructor performs evidence, Self-Assessment, SSP, POA&M, Readiness Review, and Continual Improvement, preserves assessment readiness and remediation plan, and tests the result against the realistic failure condition where the readiness review accepts weak evidence without remediation.

Hands-On Exercise

Execute a scenario-based task covering evidence, Self-Assessment, SSP, POA&M, Readiness Review, and Continual Improvement. Record assumptions and controls in assessment readiness and remediation plan, troubleshoot the case where the readiness review accepts weak evidence without remediation, and obtain a result another reviewer can reproduce.

1. Confirm the requirement, stakeholders, environment, assumptions, inputs, and expected result.
2. Perform the CMMC readiness foundation workflow and capture evidence before and after each material decision.
3. Test normal, boundary, failure, security, compliance, recovery, and operational conditions where relevant.
4. Document the root cause, correction, rollback, owner, support action, and next improvement priority.

Scenario Analysis

• Identify the business or assurance decision required within a defense supplier defining its CMMC boundary and preparing people, processes, technology, and evidence for assessment.
• Compare control strength, evidence quality, operational impact, cost, resilience, and stakeholder trade-offs.
• Define escalation, communication, recovery, acceptance, and follow-up requirements for assessment readiness and remediation plan.

Troubleshooting Guidance

If the readiness review accepts weak evidence without remediation, pause unsupported conclusions. Recheck criteria, roles, records, interfaces, and exceptions; use assessment readiness and remediation plan to prove the root cause and the effectiveness of the selected correction.

Validation Checklist

• assessment readiness and remediation plan identifies the approved baseline, accountable owner, inputs, and expected result.
• Evidence confirms evidence, Self-Assessment, SSP, POA&M, Readiness Review, and Continual Improvement under normal and relevant exception conditions.
• The response to “the readiness review accepts weak evidence without remediation” is reversible, tested, and supported by before-and-after records.
• Residual CMMC readiness foundation risk, support ownership, deadlines, and the next action are recorded.

Lesson Outcome

Learners can apply Evidence, Self-Assessment, SSP, POA&M, Readiness Review, and Continual Improvement, explain the choices made, and defend the result using assessment readiness and remediation plan.