You are a CCA working for a well-known C3PAO. You have been selected for an Assessment Team tasked with conducting a CMMC assessment on a C3PAO. While you are reviewing the presented evidence, one of the Assessment Team members informs you that they weren't trained for the job and that a friend helped them get the position. By employing non-credentialed individuals and assigning them assessment tasks, which requirement of the CoPC has the C3PAO violated?
Answer(s): D
Comprehensive and Detailed in DepthThe CoPC requires C3PAOs to employ only credentialed individuals for assessment tasks, and using an untrained, non-credentialed person violates Professionalism. Option A (Integrity) is related but less specific. Option B is incorrect as CoPC sets hiring standards. Option C (Confidentiality) is unrelated. Option D is the violation.Extract from Official Document (CoPC):Paragraph 2.1 Professionalism (pg. 4):"Refrain from dishonesty by employing only credentialed individuals for CMMC assessment services."
CMMC Code of Professional Conduct, Paragraph 2.1.
During a readiness assessment for CoolPlanes Inc., Liz, a CCA, discovers a folder of technical drawings and illustrations of the aircraft that CoolPlanes produces. Liz has a younger brother,
Comprehensive and Detailed in DepthCopying and using OSC proprietary data for personal use breaches Confidentiality, not Objectivity (Option A), Professionalism (Option B, though related), or Ethical Practices (Option C, too broad).Option D is precise.Extract from Official Document (CoPC):Paragraph 3.5 Respect for Intellectual Property (pg. 8):"Do not use OSC confidential information for personal purposes."
CMMC Code of Professional Conduct, Paragraph 3.5.
During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can exclude a small subsidiary from the assessment scope because it only handles a minimal amount of CUI. The subsidiary's systems are networked with the main OSC environment. What should the Lead Assessor do?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP requires all CUI-handling systems, including networked subsidiaries, to be in scope (Option B). Options A, C, and D violate CAP scoping rules.Extract from Official Document (CAP v1.0):Section 1.4 Define Assessment Scope (pg. 13):"All systems handling CUI, including networked subsidiaries, must be included in the assessment scope."
CMMC Assessment Process (CAP) v1.0, Section 1.4.
A CMMC assessment for an OSC finds it has fully implemented 87 out of 110 practices. Unfortunately, the Assessment Team determines that the POA&M Closeout Assessment option cannot be used. Consequently, the OSC will not be recommended for certification. However, the OSC Assessment Official humbly requests the Lead Assessor to adjust the findings to allow for POA&M closeout and mark a five-point practice as implemented. How should the Lead Assessor respond?
Answer(s): A
Comprehensive and Detailed in DepthAdjusting findings violates CoPC Objectivity and Integrity (Option A). Options B, C, and D are inappropriate responses.Extract from Official Document (CoPC):Paragraph 2.2 Objectivity (pg. 5):"Do not alter findings to influence certification outcomes."
CMMC Code of Professional Conduct, Paragraph 2.2.
During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team. Can the Lead Assessor proceed with the assessment using a reduced assessment team size?
Comprehensive and Detailed in DepthThe CAP allows flexibility in team size if remaining members are qualified, not requiring Cyber AB consent (Option B), OSC sole decision (Option C), or mandatory postponement (Option D). Option A is correct.Extract from Official Document (CAP v1.0):Section 1.5 Assessment Team Roles (pg. 16):"The Lead Assessor may proceed with a reduced team if remaining members are qualified to cover all practices."
CMMC Assessment Process (CAP) v1.0, Section 1.5.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.