The Cyber AB is the sole authorized certification and accreditation partner for the DoD in its CMMC program. It is responsible for overseeing and establishing a trained, qualified, and high-fidelity community of assessors, including C3PAOs and CCAs. What is the main requirement before The Cyber AB can accredit an Assessor?
Answer(s): C
Comprehensive and Detailed in DepthThe Cyber AB's authority to accredit assessors hinges on its compliance with international standards, specifically ISO/IEC 17011, which governs conformity assessment bodies accrediting other organizations. This standard ensures impartiality, consistency, and competence in the accreditation process, critical for maintaining the integrity of the CMMC ecosystem. Option A (DFARS 7012 compliance) applies to contractors handling CUI, not accreditation bodies. Option B (FISMA moderate compliance) is a federal IT security standard irrelevant to Cyber AB's accreditation role. Option D (DoD approval) is a prerequisite but not the "main requirement" for accrediting assessors, as ISO/IEC 17011 is the operational standard. Option C is the correct answer per Cyber AB's documented requirements.Extract from Official Document (CAP v1.0):Section 1.1 Purpose (pg. 7):"The Cyber AB must achieve compliance with the ISO/IEC 17011 Conformity Assessment to oversee the certification process and provide necessary accreditations to the trained CMMC ecosystem."
CMMC Assessment Process (CAP) v1.0, Section 1.1.
A CCA is reviewing an OSC's evidence for a CMMC practice and finds that the documentation is in draft form, marked "For Internal Use Only," and lacks final approval. The OSC insists it is actively used. How should the CCA evaluate this evidence?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP requires noting deficiencies like lack of approval as gaps while assessing all evidence (Option B). Options A, C, and D misapply CAP procedures.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Document lack of final approval as an evidence gap and assess based on all available evidence."
CMMC Assessment Process (CAP) v1.0, Section 2.2.
The OSC has contracted a C3PAO to perform a CMMC assessment. During Phase 1, the C3PAO discovers that the OSC does not have a Commercial and Government Entity (CAGE) code. The OSC's Assessment Official argues that they have never needed one before and asks what they should do. What should the Lead Assessor tell the OSC Assessment Official?
Answer(s): A
Comprehensive and Detailed in DepthThe CAP requires a valid CAGE code for assessment continuation, and C3PAOs cannot assist due to CoPC restrictions on consulting. Option A is correct. Options B, C, and D contradict CAP and CoPC rules.Extract from Official Document (CAP v1.0):Section 1.2 Confirm Corporate Identity (pg. 11):"If the OSC does not have a valid CAGE code, the assessment cannot continue."CoPC Paragraph 3.1 Professionalism (pg. 6):"C3PAOs shall not offer implementation assistance."
CMMC Assessment Process (CAP) v1.0, Section 1.2; CoPC Paragraph 3.1.
John has just passed the CCA examination and is looking to gain real-world knowledge. You are a CCA working for a leading C3PAO and a friend of John's, and he hears that you are conducting a CMMC assessment and wants to learn about how some documents are completed. He asks if you could provide a CA-RR document you completed during your current engagement to help him understand how various fields are filled out. Which of the following is the most appropriate course of action?
Comprehensive and Detailed in DepthThe CoPC prohibits sharing assessment documents containing OSC data, even with redactions, due to confidentiality and integrity risks. Option A (redacting) still risks exposure. Option C (blank templates) is unnecessary as templates are publicly available. Option D (sharing completed) directly violates CoPC. Option B is the ethical choice.Extract from Official Document (CoPC):Paragraph 3.2 Confidentiality (pg. 6):"Do not share assessment documents, reports, or materials with unauthorized individuals, as this violates confidentiality and information integrity."
CMMC Code of Professional Conduct, Paragraphs 3.2, 3.3, & 3.4.
The Certification Assessment Readiness Review (CA-RR) aims to determine whether the OSC and the Assessment Team are ready to conduct the assessment as planned and within the allocated time. It addresses all of the following aspects of readiness to conduct the assessment except which one?
Comprehensive and Detailed in DepthThe CA-RR focuses on logistical and procedural readiness (Options B, C, D), not the OSC's cybersecurity posture (Option A), which is assessed during the actual assessment.Extract from Official Document (CAP v1.0):Section 1.6 Prepare for Assessment (pg. 18):"The CA-RR addresses assessment readiness, risk status, and logistics, not OSC cybersecurity posture."
CMMC Assessment Process (CAP) v1.0, Section 1.6.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.