During the Planning phase, the C3PAO and Lead Assessor will collect information from the OSC to provide a Rough Order of Magnitude (ROM). This enables the Assessor to approximate the duration, schedule, and cost of the Assessment. To determine the Rough Order of Magnitude (ROM), the Lead Assessor can use the following inputs, EXCEPT?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP lists OSC-related inputs like location, size, and readiness for ROM (Options A, C, D), but team education (Option B) is irrelevant to this estimate.Extract from Official Document (CAP v1.0):Section 1.5 Assessment Planning (pg. 16):"ROM inputs include OSC location, size, complexity, and readiness."
CMMC Assessment Process (CAP) v1.0, Section 1.5.
During a CMMC assessment, the Lead Assessor discovers that the OSC has outsourced its incident response to a third-party provider. The OSC provides a contract with the provider but no detailed evidence of the provider's processes. What should the Lead Assessor do?
Comprehensive and Detailed in DepthThe CAP requires specific evidence from third parties for inherited practices (Option B). Options A, C, and D do not follow CAP evidence rules.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Request detailed evidence from third-party providers to verify inherited practice objectives."
CMMC Assessment Process (CAP) v1.0, Section 2.2.
You are a CCA with an active and good standing on the Cyber AB Marketplace. An OSC has contracted your C3PAO for a prospective CMMC Assessment. The OSC provides signal processing services for the DoD. You assisted the OSC in preparing for the upcoming CMMC assessment by conducting an initial evaluation of their implementation practices. With your background in cybersecurity and extensive experience, your C3PAO and Lead Assessor have selected you to join the Assessment Team. Based on this scenario, which of the following is the most important factor for the C3PAO to consider when assigning assessors to the Assessment Team?
Answer(s): A
Comprehensive and Detailed in DepthThe CAP emphasizes that the C3PAO must verify an assessor's active status and good standing on the Cyber AB Marketplace as the primary factor for assignment, ensuring credentialed participation. While hourly rate (Option B), reputation (Option C), and specialization (Option D) may be considered, they are secondary to the foundational requirement of verified credentials. However, in this scenario, the CCA's prior consulting role introduces a conflict of interest (CoPC Paragraph 3.1), which should preclude assignment, but the question focuses on general assignment factors, making Option A the most critical.Extract from Official Document (CAP v1.0):Section 1.5 Assessment Team Roles (pg. 16):"The C3PAO is responsible for verifying that all assessment team members possess an active status in good standing as a CMMC Certified Assessor or CMMC Certified Professional, confirmed on Cyber AB's CMMC Marketplace." CoPC Paragraph 3.1 Professionalism (pg. 6):"Credentialed individuals shall not conduct a certified assessment if they have served as a consultant to prepare the organization."
CMMC Assessment Process (CAP) v1.0, Section 1.5; CMMC Code of Professional Conduct, Paragraph 3.1.
You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has implemented a practice using a custom-built tool developed by their IT team. The tool appears to meet the practice's objectives, but no formal documentation or testing records exist. How should you evaluate this evidence?
Comprehensive and Detailed in DepthThe CAP instructs assessors to document missing documentation as an evidence gap and assess based on observed evidence (Option B). Option A overlooks documentation needs, Option C is premature, and Option D involves consulting, which is prohibited.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Lack of formal documentation should be recorded as an evidence gap, with assessment based on observed functionality."
When conducting a CMMC assessment, the CCA must follow the steps outlined in the CMMC Assessment Process (CAP). This document is organized into several phases, each requiring the CCA to complete specific documents. The CAP also provides templates, some of which the Assessor must use and complete during specific phases. A CCA must complete all the following documents in Phase 1 of the CAP, EXCEPT?
Comprehensive and Detailed in DepthThe Quality Review Checklist is a Phase 3 document, not Phase 1, unlike Options B, C, and D, which are Phase 1 requirements.Extract from Official Document (CAP v1.0):Section 1.6 Prepare for Assessment (pg. 18):"Phase 1 requires completion of the CA-RR Checklist, Virtual Evidence Template, and Pre-Assessment Form."
CMMC Assessment Process (CAP) v1.0, Section 1.6.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.