Security Protection Assets (SPAs) include people, technologies, and facilities. Which of the following technologies is not an SPA?

Security Protection Assets (SPAs) are defined within the CMMC framework as assets that provide security functions or services. Their primary role is to protect other assets, such as those containing Controlled Unclassified Information (CUI). Hosted VPNs, cloud-based security solutions, and SIEMs are all technologies whose fundamental purpose is to provide security (e.g., secure access, threat detection, monitoring). In contrast, a virtualized desktop is a user-end environment for productivity. While it must be secured, its primary function is not to provide security to other systems; rather, it is an asset that is protected by SPAs.

A. Hosted VPN Services: This is incorrect because a VPN's primary function is to provide a secure, encrypted communication channel, which is a core security service, making it an SPA.

C. Cloud-based security solutions: This is incorrect because this category, by definition, includes technologies (e.g., CASB, cloud firewalls) designed specifically to provide security functions, classifying them as SPAs.

D. SIEM Solutions: This is incorrect because a SIEM's primary purpose is security monitoring, event correlation, and threat detection, which are quintessential security functions of an SPA.

---

1. Cybersecurity Maturity Model Certification (CMMC) Scoping Guide, CMMC Level 2, Version 2.0, December 2021.

Page 6, Section "Step 2: Categorize Assets": This document defines Security Protection Assets (SPAs) as assets that "provide security functions or services to the OSC’s CUI assets." It provides examples such as firewalls, email gateways, and authentication servers. This definition supports the exclusion of virtualized desktops, which are user productivity environments, and the inclusion of the other options, which provide direct security services.