An OSC has provided its System Security Plan (SSP) as evidence for several CMMC practices related to system security. During your examination of the SSP, you discover a section outlining procedures for user access controls. However, upon further review, you find no mention of procedures for managing privileged accounts, which is a critical aspect of secure system access. If the OSC provides a separate document outlining privileged account management procedures, and upon review, these procedures appear sufficient, how should the Lead Assessor proceed with the SSP as evidence?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP allows multiple artifacts to support a practice, provided they collectively demonstrate compliance. If the separate document sufficiently addresses privileged account management, it complements the SSP, and both can be accepted (Option B). Option A (requesting incorporation) is not required during assessment and delays the process. Option C (deducting points) lacks CAP basis, as scoring depends on evidence sufficiency, not initial oversights. Option D (marking 'Not Met') is incorrect if the separate document meets requirements.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Multiple artifacts may be used to demonstrate compliance with a practice, provided they collectively meet the assessment objectives."
CMMC Assessment Process (CAP) v1.0, Section 2.2.
During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a list of recommended vendors to improve their security practices after the assessment.What should the Lead Assessor do?
Comprehensive and Detailed in DepthThe CoPC prohibits consulting, including vendor recommendations (Option B). Options A, C, and D risk violating this principle.Extract from Official Document (CoPC):Paragraph 3.1 Professionalism (pg. 6):"C3PAOs shall not offer consulting services or vendor recommendations."
CMMC Code of Professional Conduct, Paragraph 3.1.
A CCA who works for a C3PAO doubles as a penetration tester. When conducting a CMMC assessment for an OSC, he realizes their cybersecurity practices are lacking. Recognizing potential vulnerabilities in their systems, the CCA approaches the OSC's cyber team and offers his penetration testing services. Which CoPC guiding principle or practice has the CCA failed to live up to?
Answer(s): C
Comprehensive and Detailed in DepthSoliciting business during an assessment violates Professionalism (Option C) by misusing the CCA role. Options A (not a CoPC principle), B (related but not primary), and D (unrelated) are incorrect.Extract from Official Document (CoPC):Paragraph 2.1 Professionalism (pg. 4):"Never actively solicit business from customers during an assessment."
CMMC Code of Professional Conduct, Paragraph 2.1.
You are a CCA on an Assessment Team conducting a CMMC Level 2 assessment. The OSC provides evidence for a practice that includes a log file, but the file is corrupted and cannot be opened. The OSC claims the log proves compliance but cannot provide a readable copy during the assessment.What should you do?
Comprehensive and Detailed in DepthThe CAP requires documenting unavailable evidence like a corrupted file as a gap and assessing based on other evidence (Option B). Option A lacks verification, Option C is premature, and Option D involves directing OSC actions, which is not allowed.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Document unavailable or unreadable evidence as an evidence gap and proceed with assessment based on other evidence."
John, a CCA, is attending a CMMC industry conference. During a networking event, he makes several inappropriate comments with sexual undertones to a female attendee. According to the CoPC's Lawful and Ethical Practices, how should John's behavior be evaluated?
Comprehensive and Detailed in DepthThe CoPC prohibits harassment in all CMMC-related interactions, including industry events, making Option C correct. Options A, B, and D misinterpret the scope of this rule.Extract from Official Document (CoPC):Paragraph 3.6(2) Lawful and Ethical Practices (pg. 8):"Refrain from harassment or discrimination in all interactions related to your role in the CMMC ecosystem."
CMMC Code of Professional Conduct, Paragraph 3.6(2).
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.