You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts. If the OSC shares proprietary information with the Lead Assessor during the assessment engagement, what is the C3PAO's responsibility regarding this information after the completion of the assessment?
Answer(s): D
Comprehensive and Detailed in DepthThe CAP and CoPC mandate that proprietary information be returned or destroyed post-assessment to protect OSC confidentiality, making Option D correct. Options A, B, and C violate these requirements.Extract from Official Document (CAP v1.0):Section 3.5 Archive Assessment Artifacts (pg. 36):"The C3PAO must return and/or destroy any OSC proprietary information after the engagement."
CMMC Assessment Process (CAP) v1.0, Section 3.5; CoPC Paragraph 3.2.
You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has implemented a practice using a manual process instead of an automated tool, as described in their SSP. The manual process meets the practice's objectives. How should you evaluate this evidence?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP requires noting deviations from the SSP as gaps while assessing effectiveness (Option B). Option A ignores documentation, Option C is premature, and Option D is consulting.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Document deviations from the SSP as evidence gaps and assess based on actual implementation."
CMMC Assessment Process (CAP) v1.0, Section 2.2.
An OSC is undergoing a CMMC assessment by a C3PAO. The assessment team has been on-site for several days, reviewing the OSC's systems, policies, and procedures against the CMMC requirements. Each day, the assessment team holds a "daily checkpoint" meeting with the OSC's security team and representatives. This checkpoint serves an important purpose in the overall assessment process. What is the significance of the Daily Checkpoint meeting in the CMMC assessment process?
Comprehensive and Detailed in DepthThe CAP mandates Daily Checkpoint meetings to review additional evidence and ensure assessment progress, not to finalize findings (Option A), as optional (Option B), or solely for updates (Option C).Option D reflects its core purpose.Extract from Official Document (CAP v1.0):Section 2.3 Daily Checkpoint Meetings (pg. 27):"The Daily Checkpoint meeting provides an opportunity to review and verify additional evidence presented by the OSC."
CMMC Assessment Process (CAP) v1.0, Section 2.3.
You are the Lead Assessor for a CMMC assessment. During the Final Findings Briefing, the OSC Assessment Official disputes a "NOT MET" finding, claiming the evidence was misinterpreted. What is the OSC's recourse according to the CMMC Assessment Process?
Comprehensive and Detailed in DepthThe CAP provides an Appeals Process for disputes (Option B). Options A, C, and D do not follow CAP procedures.Extract from Official Document (CAP v1.0):Section 3.3 Assessment Appeals Process (pg. 34):"If the OSC disagrees with findings, they may submit an appeal using the Assessment Appeals Process."
CMMC Assessment Process (CAP) v1.0, Section 3.3.
David, a Certified CMMC Assessor (CCA), is conducting a CMMC assessment for a defense contractor. During the assessment, he observes the organization's CEO making several statements to the Assessment Team about the company's security practices that turn out to be false. How should David respond to the CEO's behavior according to the CMMC CoPC?
Answer(s): A
Comprehensive and Detailed in DepthThe CoPC requires CCAs to maintain objectivity and document findings accurately, even when faced with false statements. Option A ensures the assessment remains impartial while recording discrepancies for evaluation. Option B (ignoring) neglects the CCA's duty to report noncompliance. Option C (reporting to Cyber AB) escalates prematurely, as perjury is a legal matter outside CCA scope unless ethics are directly violated. Option D (confronting) risks unprofessionalism and bias, contrary to CoPC.Extract from Official Document (CoPC):Paragraph 3.6 Lawful and Ethical Practices (pg. 8):"Document any noncompliance or inaccuracies observed while conducting the assessment objectively."
CMMC Code of Professional Conduct, Paragraph 3.6.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.