During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a preliminary score before the assessment is complete to help prioritize remediation efforts.What should the Lead Assessor do?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP prohibits preliminary scores to ensure a complete assessment (Option B). Options A, C, and D risk bias and violate CAP.Extract from Official Document (CAP v1.0):Section 2.4 Generate Preliminary Findings (pg. 29):"Scores are finalized only after all evidence is assessed; preliminary scores shall not be provided."
CMMC Assessment Process (CAP) v1.0, Section 2.4.
Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings. Fortunately, you can download some of these documents from the DoDCIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment. Which document/template includes the OSC's evidence, assets, and CMMC assessment scope, among other data?
Answer(s): D
Comprehensive and Detailed in DepthThe CAP identifies the Pre-Assessment Form Template as the central document for recording OSC evidence, assets, and scope in Phase 1, unlike the In-Brief (Option A, initial presentation), OSC Data Form (Option B, not a CAP term), or Findings Briefing (Option C, Phase 2).Extract from Official Document (CAP v1.0):Section 1.3 Pre-Assessment Form (pg. 12):"The CMMC Pre-Assessment Form Template provides the central record and information for the Assessment, including documentation of assets, CMMC Assessment Scope, and Evidence."
CMMC Assessment Process (CAP) v1.0, Section 1.3.
Patrick's company was hired to conduct a CMMC Level 2 assessment for Alto Technologies, where his aunt Jane is the VP of Marketing. Patrick did not disclose his relationship to Jane to his employer because he wanted to work on the Assessment Team and did not think Jane was aware of his job. Which of the following was the most appropriate course of action for Patrick?
Answer(s): C
Comprehensive and Detailed in DepthThe CoPC requires disclosure of familial COIs to ensure objectivity, making Option C the most appropriate. Option A (recusing without explanation) lacks transparency. Option B (not disclosing) violates CoPC. Option D (following policies) is vague and secondary to disclosure.Extract from Official Document (CoPC):Paragraph 2.2 Objectivity (pg. 5):"Disclose potential conflicts of interest, such as familialrelationships, to the employer before assignment."
CMMC Code of Professional Conduct, Paragraph 2.2.
You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. During the evidence collection phase, you need to examine the OSC's policies and procedures related to the CMMC practice AC.L2-3.1.5 Least Privilege. Which of the following would be an appropriatesource of evidence for this practice?
Comprehensive and Detailed in DepthFor AC.L2-3.1.5 (Least Privilege), the CAP emphasizes documented policies and procedures as primary evidence to demonstrate compliance with the practice's intent. Examining system configuration documentation (Option C) directly shows how least privilege is implemented, aligning with the CAP's guidance on the `Examine' method. Option A (testing RBAC/PAM) assesses technical implementation, not policies. Option B (observing admins) is less systematic and not policy-focused. Option D (interviewing admins) provides supplementary insights but not the core evidence required.Extract from Official Document (CAP v1.0):Section 2.2 Conduct Assessment (pg. 25):"Examination includes reviewing documented policies, procedures, and system configurations to assess compliance with CMMC practices."
CMMC Assessment Process (CAP) v1.0, Section 2.2.
A C3PAO Assessment Team is conducting a CMMC Level 2 assessment. During the assessment, the OSC provides evidence that a practice is partially implemented, with plans to complete it within a month. The practice is not eligible for the Limited Practice Deficiency Correction Program. How should the Lead Assessor score this practice?
Comprehensive and Detailed in DepthThe CAP requires full implementation for a `MET' score, and ineligible practices cannot be deferred or partially scored (Option B). Options A, C, and D violate CAP scoring rules.Extract from Official Document (CAP v1.0):Section 2.5 Scoring (pg. 30):"Practices not fully implemented and ineligible for deficiency correction must be scored `NOT MET.'"
CMMC Assessment Process (CAP) v1.0, Section 2.5.
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.