During a CMMC assessment, the Assessment Team observes that the OSC is not enforcing practice objective CM.L2-3.4.5[d] physical access restrictions associated with changes to the system are enforced. Understanding the deficiency, the OSC has requested to track the practice in the Limited Practice Deficiency Correction program, as it is part of their on-premises work. As a CCA, what should you do with respect to the OSC's implementation of this practice?
Answer(s): C
Comprehensive and Detailed in DepthCM.L2-3.4.5 is a high-impact practice ineligible for deficiency correction due to exploitation risks, requiring a `NOT MET' score (Option C). Options A, B, and D misapply CAP rules.Extract from Official Document (CAP v1.0):Section 2.3.2.1 Ineligible Practices (pg. 28):"CM.L2-3.4.5 is ineligible for the Limited Practice Deficiency Correction program and must be scored `NOT MET' if not fully implemented."
CMMC Assessment Process (CAP) v1.0, Section 2.3.2.1.
You are the Lead Assessor for a CMMC Level 2 Assessment of an OSC. During Phase 1 planning, the OSC's Assessment Official informs you that several key personnel who manage the in-scope IT systems will be unavailable during the scheduled assessment dates due to a company-wide training event. The Assessment Official asks if the assessment can proceed with substitute personnel who are less familiar with the systems. What should you do?
Comprehensive and Detailed in DepthThe CAP requires interviews and demonstrations with personnel who manage systems, making rescheduling (Option C) necessary. Options A, B, and D compromise assessment accuracy and violate CAP guidelines.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Interviews and demonstrations must be conducted with the person responsible for carrying out the work."
CMMC Assessment Process (CAP) v1.0, Section 2.2.
An OSC is undergoing a CMMC Level 2 assessment, and the C3PAO Assessment Team has identified several practices that the organization has not yet fully implemented. During the assessment, the CCA notes significant progress by the OSC towards implementing control MP.L2-3.8.4 Media Markings, but acknowledges that not all required steps have been completed. The CCA explains to the OSC that this partially implemented practice will need to be tracked in theLimited Practice Deficiency Correction Program. How should CMMC practices tracked under the Limited Practice Deficiency Correction Program be scored?
Answer(s): A
Comprehensive and Detailed in DepthPractices in the Limited Practice Deficiency Correction Program are scored `Not Met' per CAP, as they are incomplete, not partially met (Option B), inapplicable (Option C), or met (Option D). Option A is correct.Extract from Official Document (CAP v1.0):Section 2.3.2 Deficiency Correction (pg. 28):"All practices tracked under the Limited Practice Deficiency Correction Program will be scored as `NOT MET.'"
CMMC Assessment Process (CAP) v1.0, Section 2.3.2.
Angela, a CCA, is conducting a CMMC assessment for Obsidian Technologies, the OSC. Duringthe assessment, Angela learns that her spouse owns a significant amount of stock in Obsidian Technologies, and she has not disclosed this information to Obsidian Technologies or the C3PAO. Which CMMC CoPC guiding principle has Angela violated in this scenario?
Comprehensive and Detailed in DepthAngela's undisclosed financial tie via her spouse's stock ownership creates a COI, violating the CoPC's Objectivity principle. Option B (Impartiality) is related but not a distinct CoPC principle. Option C (Methods) and D (Confidentiality) are unrelated. Option A is correct.Extract from Official Document (CoPC):Paragraph 2.2 Objectivity (pg. 5):"Disclose any financial or familial conflicts of interest to maintain objectivity."
CMMC Code of Professional Conduct, Paragraph 2.2.
During the initial assessment framing discussions, the OSC POC attempts to sign off on the agreed- upon terms and scope of the assessment, asserting that they have the authority to enter into a legally binding contract with the C3PAO. Which of the following must the C3PAO ascertain before the OSC POC signs off on the agreed terms and scope of the assessment?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP requires verifying the POC's authority to bind the OSC (Option B), not training (Option A), workforce requirements (Option C), or personal review (Option D).Extract from Official Document (CAP v1.0):Section 1.3 Identify OSC PoC (pg. 12):"The C3PAO must verify that the POC has decision-making authority to bind the OSC in agreements."
CMMC Assessment Process (CAP) v1.0, Section 1.3.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.