You are part of the team conducting a CMMC assessment for an OSC. Because of the sensitive nature of the OSC's technologies, your team signed an NDA. However, you observe one of the Assessment Team members copying something from the OSC's computer systems. You know they don't have permission because the NDA states that the OSC POC will provide any required material. What should you do in this case?
Answer(s): C
Comprehensive and Detailed in DepthThe CoPC requires internal correction of confidentiality breaches first, making Option C appropriate. Informing the OSC (Option A) or reporting to Cyber AB (Option D) skips this step, and allowing copying (Option B) violates the NDA and CoPC.Extract from Official Document (CoPC):Paragraph 3.2(3) Confidentiality (pg. 6):"Do not copy materials from external entities without explicit permission."
CMMC Code of Professional Conduct, Paragraph 3.2(3).
You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts. If the OSC insists on excluding the subsidiary's network and assets from the CMMC Assessment Scope despite your recommendation to include them, what should you do?
Answer(s): A
Comprehensive and Detailed in DepthThe CAP requires that disagreements over the CMMC Assessment Scope be resolved before proceeding, and if unresolvable, the Lead Assessor should terminate the engagement. Excluding CUI- handling assets like the subsidiary's network invalidates the scope, and proceeding (Option C) or forcing inclusion (Option D) violates CAP guidelines. Escalation to Cyber AB (Option B) is not a specified step unless further guidance is needed post-termination. Option A is the correct action per CAP.Extract from Official Document (CAP v1.0):Section 1.4 Define Assessment Scope (pg. 13):"If disagreement regarding the CMMC Assessment Scope cannot be resolved with the OSC, the Lead Assessor shall terminate the Assessment engagement."
CMMC Assessment Process (CAP) v1.0, Section 1.4.
During a CMMC assessment, the OSC's PoC asks the Lead Assessor if they can skip the daily checkpoint meetings to save time, promising to provide all evidence upfront. What should the Lead Assessor do?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP mandates daily checkpoint meetings, making Option B correct. Options A, C, and D violate this requirement.Extract from Official Document (CAP v1.0):Section 2.3 Daily Checkpoint Meetings (pg. 27):"Daily checkpoint meetings are a required component of the CMMC assessment process."
CMMC Assessment Process (CAP) v1.0, Section 2.3.
You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. What does the criterion of `Adequacy' primarily assess in the context of evidence collection for a CMMC assessment?
Comprehensive and Detailed in Depth`Adequacy' in the CAP assesses whether evidence is relevant and directly demonstrates a CMMC practice's performance, not broader policy (Option A), quantity (Option B), or measure quality (Option D). Option C ensures evidence aligns with specific practice objectives.Extract from Official Document (CAP v1.0):Section 2.1 Evidence Collection (pg. 24):"Adequacy assesses whether the gathered evidence is relevant and demonstrates the performance of a CMMC practice."
CMMC Assessment Process (CAP) v1.0, Section 2.1.
During a social event after work, a CCA from your C3PAO team brags about providing "consulting advice" to an OSC they recently assessed for CMMC compliance. You know this directly violates the CoPC's restrictions on CCAs offering such services during an assessment. What is your ethical obligation in this situation?
Comprehensive and Detailed in DepthThe CoPC encourages internal resolution of violations before escalation, making Option B the ethical first step. Public confrontation (Option A) risks unprofessionalism, immediate reporting (Option C) skips internal correction, and ignoring (Option D) neglects duty. Providing advice during an assessment violates CoPC professionalism.Extract from Official Document (CoPC):Paragraph 4.1(1)(a) Violation Reporting (pg. 10):"Attempt to rectify the violation with the individual in question prior to reporting."Paragraph 3.1 Professionalism (pg. 6):"Do not offer consulting advice during an assessment."
CMMC Code of Professional Conduct, Paragraphs 4.1(1)(a) and 3.1.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.