During a CMMC Level 2 assessment, the Assessment Team discovers that the OSC has implemented a practice using a tool that is not listed in their System Security Plan (SSP). The tool appears to meet the assessment objectives for the practice, but its absence from the SSP raises concerns about documentation accuracy. How should the Lead Assessor proceed?
Answer(s): C
Comprehensive and Detailed in DepthThe CAP instructs documenting discrepancies as evidence gaps and assessing based on available evidence (Option C). Option A ignores documentation issues, Option B delays unnecessarily, and Option D is premature without full assessment.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Incomplete or inaccurate documents should be recorded as evidence gaps, with the practice assessed based on available evidence."
CMMC Assessment Process (CAP) v1.0, Section 2.2.
Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings. Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment. Where would you document the OSC's readiness to proceed to the second phase of the CMMC Assessment Process (CAP)?
Comprehensive and Detailed in DepthThe CA-RR Checklist is the CAP-designated document for verifying OSC and team readiness to transition from Phase 1 to Phase 2. Option A (Results) is for final outcomes. Option B (Quality Review) is for post-assessment QA. Option D (Findings Briefing) is for preliminary findings, not readiness.Extract from Official Document (CAP v1.0):Section 1.6 Prepare for Assessment (pg. 18):"The CMMC Assessment Readiness Review (CA-RR) Checklist is completed to verify readiness to proceed from Phase 1 to Phase 2."
CMMC Assessment Process (CAP) v1.0, Section 1.6.
A CCA is assessing an Organization Seeking Certification (OSC). During the assessment, they discover that the OSC is pressuring the CCA to overlook certain security practices that do not meet the CMMC requirements. The organization threatens to withhold payment if the CCA does not modify her findings at the request of the OSC. According to the CoPC, which of the followingactions would be most appropriate for the CCA to take in this situation?
Answer(s): A
Comprehensive and Detailed in DepthThe CoPC requires resisting pressure to compromise integrity and reporting to the C3PAO (Option A). Options B, C, and D fail to address the violation promptly or ethically.Extract from Official Document (CoPC):Paragraph 1.1 Purpose (pg. 3):"Uphold integrity and report pressure to compromise values to the C3PAO."
CMMC Code of Professional Conduct, Paragraph 1.1.
John, a CCA, has been assigned by his C3PAO to conduct a CMMC assessment for an OSC. During the assessment, John notices that the OSC's security practices leave much to be desired. After speaking with the OSC's IT staff, John offers to connect them with a vendor he knows who sells a vulnerability management tool that could address some of their weaknesses. According to the CMMC CoPC, which of the following best describes John's actions?
Answer(s): D
Comprehensive and Detailed in DepthThe CoPC prohibits CCAs from soliciting business or offering vendor recommendations during assessments, violating Professionalism and Objectivity. Option A (appropriate) ignores this. Option B (IP) is unrelated. Option C (no profit) doesn't excuse the violation. Option D is correct.Extract from Official Document (CoPC):Paragraph 3.3(4) Proper Use of Methods (pg. 7):"Do not solicit business for third-party vendors while serving on an Assessment Team."
CMMC Code of Professional Conduct, Paragraph 3.3(4).
After completing a CMMC assessment, the OSC should hash all the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide. However, you have just realized that this requirement was not fulfilled, and the OSC Assessment Official cannot be reached to confirm it was done. To avoid any issues, you quickly complete this step and later inform the OSC Assessment Official. Which CoPC principle have you just violated by hashing the evidence artifacts in place of the OSC?
Comprehensive and Detailed in DepthHashing evidence artifacts is the OSC's responsibility to ensure their integrity, not the LeadAssessor's. By performing this task, the Lead Assessor compromises the evidence package's integrity, violating the CoPC's Information Integrity principle. Option A (Professionalism) is not directly breached here. Option B (Confidentiality) is unrelated, as no disclosure occurred. Option C (Objectivity) is unaffected by this action. Option D is the correct violation.Extract from Official Document (CoPC):Paragraph 3.4(2) Information Integrity (pg. 7):"Ensure that actions taken do not compromise the integrity of evidence packages, which is the responsibility of the OSC."
CMMC Code of Professional Conduct, Paragraph 3.4(2).
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.