An OSC has recently obtained an ISO 27001 certification and a FedRAMP Authorization to Operate (ATO) for its information systems. During the initial stages of the CMMC Assessment Process, the OSCclaims that these certifications should grant them automatic credit or exemption from certain CMMC requirements. As the Lead Assessor, what should be your response?
Answer(s): D
Comprehensive and Detailed in DepthThe CAP explicitly states that other certifications like ISO 27001 or FedRAMP do not automatically grant CMMC credit unless DoD publishes non-duplication policies, making Option D correct. Option A (disregarding) is incomplete without explanation. Option B (consulting Cyber AB) is unnecessary without policy support. Option C (accepting) violates CAP.Extract from Official Document (CAP v1.0):Section 1.1 Purpose (pg. 7):"Other cybersecurity conformance regimes do not grant automatic status or credit towards CMMC Assessment unless the DoD publishes non-duplication policies."
CMMC Assessment Process (CAP) v1.0, Section 1.1.
Ron is the Lead Assessor for an OSC's CMMC assessment. His team has scheduled interviews and demonstrations with the OSC's system administrator, Olivia. However, on the first day, the CEO informs Ron that Olivia is very ill and is unavailable. The CEO offers to be interviewed about Olivia's responsibilities instead, even though he does not actually perform those tasks. What should Ron do in this scenario?
Comprehensive and Detailed in DepthThe CAP requires interviews with individuals who perform the tasks, not proxies like the CEO (Options A, B, C). Option D ensures compliance by seeking the appropriate personnel.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Interviews and demonstrations must be conducted with the person responsible for carrying out the work."
CMMC Assessment Process (CAP) v1.0, Section 2.2; CoPC Paragraph 2.4.
An OSC and a C3PAO Assessment Team are in the early stages of preparing for their CMMC assessment. During the process of confirming the corporate identity for the assessment, the Assessment Team discovers that the OSC does not have a valid Commercial and Government Entity (CAGE) code issued by the Department of Defense. The team is now considering the implications of this finding and the next steps they should take. When confirming the corporate identity to be assessed, what can happen if you determine that the HQ organization doesn't have a valid CAGE code?
Answer(s): B
Comprehensive and Detailed in DepthA valid CAGE code is mandatory for DoD contractors, and CAP requires it for assessment continuation. Option A (helping register) is consulting, prohibited by CoPC. Option C (waiver) is not a CAP option. Option D (continuing) violates CAP. Option B is correct.Extract from Official Document (CAP v1.0):Section 1.2 Confirm Corporate Identity (pg. 11):"If the OSC does not have a valid CAGE code, the assessment cannot continue."
CMMC Assessment Process (CAP) v1.0, Section 1.2.
As a CCA, John feels he can make some extra cash by aggregating and rewriting CMMC materials into a book titledAcing Your CMMC Assessment: A Complete Guide. You ask him about potential issues, such as the failure to get permission from the Cyber Accreditation Body. John tells you that since he is a CCA, this is not a requirement, and in any case, the information is already publicly available. Has John broken any CoPC guiding principles or practices? If so, which one?
Comprehensive and Detailed in DepthCreating derivative works from CMMC materials without Cyber AB permission violates Adherence to Materials and Methods (Option D), not Integrity (Option B) or IP (Option C, though related). Option A is incorrect.Extract from Official Document (CoPC):Paragraph 3.3(3) Proper Use of Methods (pg. 7):"Do not create derivative works using CMMC intellectual property without explicit written permission from the Cyber AB."
CMMC Code of Professional Conduct, Paragraph 3.3(3).
SecureLogic Inc. is a cybersecurity consulting firm that provides managed security services to various defense contractors. During a CMMC assessment of one of their clients, the Lead Assessor finds that SecureLogic Inc. has provided evidence supporting several inherited practices related to incident response and vulnerability management. Which of the following actions should the Lead Assessor take?
Comprehensive and Detailed in DepthThe CMMC Assessment Process (CAP) allows for practices to be inherited from an External Service Provider (ESP) such as SecureLogic Inc., provided that the evidence demonstrates that the ESP adequately performs the inherited practices and that these practices apply to the Organization Seeking Certification's (OSC) in-scope assets. The Lead Assessor's role is not to automatically accept or reject evidence but to evaluate its adequacy and sufficiency against the CMMC assessment objectives. Option A (automatically scoring as 'MET') skips this critical evaluation, risking an inaccurate assessment. Option B (scoring as 'NOT MET' regardless of evidence) disregards valid evidence, which is inconsistent with CAP guidance. Option C (prohibiting inheritance) is incorrect, as the CAP explicitly permits inheritance from ESPs when properly evidenced. Option D aligns with the CAP's requirement to assess evidence for inherited practices thoroughly.Extract from Official Document (CAP v1.0):Section 1.6.1 Access and Verify Evidence (pg. 19):"Evidence from an enterprise or entity from which objectives are inherited must show that Assessment Objectives are met and applicable to the OSC's in-scope assets."Section 2.2 Conduct Assessment (pg. 25):"The Assessment Team shall determine ifpractices implemented by an External Service Provider (ESP) meet the intent of the CMMC Assessment Objectives."
CMMC Assessment Process (CAP) v1.0, Sections 1.6.1 and 2.2.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.