What best describes a covered contractor information system?

In the context of Cybersecurity Maturity Model Certification (CMMC) and NIST SP 800-171, a CCIS is the environment where CUI is handled and thus must comply with specific cybersecurity requirements.

A CCIS:

• Includes all computing platforms, network devices, applications and components used to create, receive, maintain, or transmit CUI;
• Must implement controls mandated by NIST SP 800-171 to protect CUI from unauthorized access or disclosure;
• Are subject to cybersecurity assessments and audits for compliance verification; and
• May be segmented or isolated to reduce the scope of compliance requirements.

The security of a CCIS is critical because contractors that fail to protect CUI risk penalties, contract loss and damage to national security.