The Assessment Kickoff meeting is one of the most important sessions of any CMMC Assessment engagement. All the following are participants in this meeting, EXCEPT?
Answer(s): D
Comprehensive and Detailed in DepthThe CAP lists the Kickoff Meeting participants as the Lead Assessor, OSC evidence providers, and OSC PoC, but not the CQAP, whose role is post-assessment QA, not initial planning. Option D is the exception.Extract from Official Document (CAP v1.0):Section 1.6 Prepare for Assessment (pg. 18):"The Assessment Kickoff Meeting includes the Lead Assessor, OSC personnel providing evidence, and the OSC PoC."
CMMC Assessment Process (CAP) v1.0, Section 1.6.
As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has thoroughly reviewed all evidence provided by the OSC for the in-scope CMMC practices. Throughout the assessment process, daily checkpoint meetings were held with the OSC to allow them to present additional evidence and clarify any concerns. After the final evidence review and discussions, the Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as `MET.' Additionally, 18 practices have been scored as `NOT MET,' with 5 of those practices deemed ineligible for a Plan of Action and Milestones (POA&M) due to their potential impact on network exploitation or CUI exfiltration. The OSC has provided a draft POA&M for the remaining 13 `NOT MET' practices, outlining their proposed remediation actions and timelines. In reviewing the OSC's draft POA&M, you notice that one of the proposed remediation actions involves implementing a new security control that could potentially impact the effectiveness of another practice that was scored as `MET.' How should you proceed?
Answer(s): C
Comprehensive and Detailed in DepthThe CAP prohibits POA&M actions that impact `MET' practices, requiring revision (Option C). Options A and B risk certification integrity, and Option D (full rejection) is excessive when targeted revision suffices.Extract from Official Document (CAP v1.0):Section 2.3.2 Deficiency Correction (pg. 28):"Remove any POA&M actions that limit the effectiveness of practices scored as `MET.'"
CMMC Assessment Process (CAP) v1.0, Section 2.3.2.
An OSC receives a POA&M during their CMMC L2 assessment. 170 days later, they submit an updated POA&M with evidence of all corrective actions. Can the C3PAO still conduct a close-out assessment?
Comprehensive and Detailed in DepthThe CAP's 180-day window is a guideline for scheduling, not a strict deadline barring closeout if submitted within reason (170 days here). Option A and B misinterpret this flexibility. Option D (full reassessment) is unnecessary if corrections are verified. Option C is correct.Extract from Official Document (CAP v1.0):Section 3.4 POA&M Closeout (pg. 35):"Within 180 days from the Final Findings Briefing, conduct a POA&M Closeout Assessment to verify corrective actions, focusing on successful implementation."
CMMC Assessment Process (CAP) v1.0, Section 3.4.
An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet. What is the Assessment Team's initial finding regarding the OSC's implementation of CM.L2-3.4.1 System Baselining, and how should it be scored?
Comprehensive and Detailed in DepthCM.L2-3.4.1 requires maintaining updated baseline configurations. The unlisted software indicates failure to meet objectives [c], [d], and [f], making the practice `NOT MET.' Per the DoD Scoring Methodology in CAP, a `NOT MET' practice deducts its full point value (5 points for CM.L2-3.4.1). Options A and C assign incorrect points, and Option B (Not Applicable) is inappropriate as the practice applies.Extract from Official Document (CAP v1.0):Section 2.5 Scoring (pg. 30):"If any objectives are scored as `NOT MET,' the entire practice is scored as `NOT MET,' deducting the full point value per the DoD Scoring Methodology (5 points for CM.L2- 3.4.1)."
CMMC Assessment Process (CAP) v1.0, Section 2.5.
You are the Lead Assessor for a CMMC assessment of an OSC that has previously obtained ISO 27001 certification for its information security management system. During the initial discussions, the OSC requests that you consider their ISO 27001 certification and grant them credit toward their CMMC certification. They believe there is a significant overlap between CMMC and ISO 27001. What should your response to the OSC be?
Comprehensive and Detailed in DepthThe CAP states no automatic credit for other certifications like ISO 27001 unless DoD policy allows, making Option C correct. Option A (deferring) implies potential credit, which isn't supported. Option B (verifying) suggests possible credit without policy backing. Option D (granting) violates CAP.Extract from Official Document (CAP v1.0):Section 1.1 Purpose (pg. 7):"Alternative cybersecurity certifications do not automatically bestow any status or credit towards CMMC certification unless DoD publishes non-duplication policies."
CMMC Assessment Process (CAP) v1.0, Section 1.1.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.