An OSC lead has provided company information, identified that they are seeking CMMC Level 2, stated that they handle FCI. identified stakeholders, and provided assessment logistics. The OSC has provided the company's cyber hygiene practices that are posted on every workstation, visitor logs, and screenshots of the configuration of their FedRAMP-approved applications. The OSC has not won any DoD government contracts yet but is working on two proposals Based on this information, which statement BEST describes the CMMC Level 2 Assessment requirements?
Answer(s): C
CMMC Level 2 Readiness and Certification RequirementsCMMCLevel 2is required forOrganizations Seeking Certification (OSCs) that handle Controlled Unclassified Information (CUI)and aligns withNIST SP 800-171's 110 security controls.Key Readiness Indicators for a Level 2 Assessment:The OSC must have implemented all 110 security practices from NIST SP 800-171.Documented and validated cybersecurity policies and procedures must exist.The OSC must be prepared to provide objective evidence (artifacts) proving compliance.Why the OSC in the Question is Not Ready:They have not won a DoD contract yet This means they do not yet have a contractually definedCUI environment, which is the foundation for defining their security scope.They have only provided FCI-related artifacts(e.g., visitor logs, workstation policies, FedRAMP configurations).Lack of full documentation of CMMC Level 2 controls The assessment requiresevidence for all 110 security practices(e.g., system security plans, incident response records, security awareness training documentation).Clarification of Incorrect Options:A . "Ready because there is no need to certify this company until after they win a DoD contract."Incorrect Some organizationsseek certification proactivelybefore winning contracts. However, readiness depends on implementingall 110 required controls, not contract status alone.B . "Not ready because the OSC is not on contract because they do not know the scope of FCI protection required by the contract."Incorrect CMMC Level 2focuses on CUI, not just FCI. While FCI protection is important, the assessment's focus is onCUI security requirements, which arenot fully addressed by the provided artifacts.D . "Ready because all DoD contractors are required to achieve CMMC Level 2; therefore, they are being proactive in seeking certification."Incorrect While it is commendable that the OSC is being proactive,readiness is based on full compliance with NIST SP 800-171, not just intent.
NIST SP 800-171 Rev. 2(NIST Official Site)CMMC 2.0 Level 2 Assessment Guide(Cyber AB)DFARS 252.204-7012 & CMMC 2.0 Requirements(DoD CIO)Final Answe r: C. Not ready because the OSC still lacks artifacts that prove they have implemented
An assessment is being completed at a client site that is not far from the Lead Assessor's home office. The client provides a laptop for the duration of the engagement. During a meeting with the network engineers, the Lead Assessor requests information about the network. They respond that they have a significant number of drawings they can provide via their secure cloud storage service. The Lead Assessor returns to their home office and decides to review the documents. What is the BEST way to retrieve the documents?
Answer(s): B
Best Practices for Handling Sensitive Assessment InformationCMMC assessments involve handlingsensitive and potentially CUI-related documents. Assessors must follow strictsecurity policiesto avoid unauthorized access, data leaks, or non-compliance withCMMC 2.0 and NIST SP 800-171 requirements.Why Logging into the Client VPN on the Client Laptop is the Best Approach:Ensures Data Protection:The client laptop is likely configured to meet security controls required for handling assessment-related materials.Prevents Data Spillage:Keeping all assessment-related activities within the client's secured environment reduces the risk ofdata leakage or unauthorized storage.Maintains Compliance with CMMC/NIST Guidelines:Using aproperly configured client laptop and secured connectionensures compliance withNIST SP 800-171 controls on secure remote access(Requirement3.13.12).Clarification of Incorrect Options:A . "Log into the secure cloud storage service to save copies of the documents on both the work and client laptops."IncorrectSensitive data should not be duplicated across multiple systems, especially a non-client- approved laptop. Storing it on an unauthorized systemviolates data handling best practices.C . "Log into the client VPN from the assessor's laptop and retrieve the documents from the secure cloud storage service."Incorrect Theassessor's laptop may not be authorizedorsecuredto handle client data. CMMC guidelines emphasizeusing approved, secured systemsfor assessment-related information.D . "Use their home office workstation to retrieve the documents from the secure cloud storage service and save them to a USB stick."IncorrectTransferring sensitive documents via USBintroduces security risks, including unauthorized data storage and potential malware contamination.Home office workstationsare unlikely to be authorized for handling CMMC-sensitive data.
NIST SP 800-171 Rev. 2, Control 3.13.12 ("Use of Secure Remote Access")CMMC 2.0 Level 2 Assessment Process Guide(Cyber AB)DoD CUI Handling Guidelines(DoD CIO)Final Answe r: B. Log into the client VPN from the client laptop and retrieve the documents from the
A Lead Assessor has been assigned to a CMMC Assessment During the assessment, one of the assessors approaches with a signed policy. There is one signatory, and that person has since left the company. Subsequently, another person was hired into that position but has not signed the document. Is this document valid?
In the context of a CMMC Level 2 Assessment, assessors must evaluate the "Institutionalization" of practices, which includes the review of Policies. The validity of a policy document depends on the Organization Seeking Certification (OSC)'s internal governance and administrative procedures.Internal Governance (The "Why"): CMMC does not dictate exactlyhowa company must authorize its policies (e.g., whether a signature must be refreshed immediately upon a personnel change). Instead, the assessor must verify if the document is considered "active" and "authoritative" by the OSC's own standards.The Role of the Assessor: As per the CMMC Assessment Process (CAP) and CCP training materials, an assessor cannot unilaterally declare a policy invalid simply because a signatory has left. The assessor must perform "more research" (typically through Interviews or examining Supplemental Documents) to determine the OSC's internal rules for policy management.If the OSC's "Policy on Policies" states that a signature is tied to the individual, the document may be expired.If the OSC's rules state that the authority is tied to the role/position (which is common in most corporate governance), the policy remains in effect until it is formally rescinded or updated.Distinction from other options:Option A is too restrictive; it assumes a universal rule that doesn't exist in the CMMC framework.Option C is incorrect because a signatory (or formal approval)isoften what gives a policy its "authoritative" status in an audit; ignoring it would be a failure of the Examine method.Option D is a common business assumption, but an assessor must verify this via the OSC's own procedures rather than assuming it is true for every company.Reference Documents:CMMC Assessment Process (CAP) v1.0: Section on "Examine" methods and evaluating evidence integrity.NIST SP 800-171A: Discussion on "Organizational Policies" as assessment objects and the requirement for policies to be "established and maintained."CMMC Level 2 Assessment Guide: Clarifies that policies must be "formally documented" and "representative of organizational requirements."
During Phase 4 of the Assessment process, what MUST the Lead Assessor determine and recommend to the C3PAO concerning the OSC?
What Happens in Phase 4 of the CMMC Assessment Process?Phase 4 of theCMMC Assessment Process (CAP)is theFinal Reporting and Decision Phase. During this phase, theLead Assessormust:Review all assessment findingsDetermine the Organization Seeking Certification's (OSC) eligibility for certificationMake a recommendation to the C3PAO (Certified Third-Party Assessment Organization)Key Responsibilities of the Lead Assessor in Phase 4:Ensure that the OSC hasmet the required practices and processes.Confirm that anydeficiencieshave been corrected or appropriately documented.Recommendwhether the OSC is eligible for certificationbased on assessment results.Since theLead Assessor must determine and recommend the OSC's eligibilityto the C3PAO, the correct answer isB. Eligibility.Why the Other Answers Are IncorrectA . AbilityIncorrect. While assessing an OSC's ability to meet CMMC requirements is part of the process, the final determination in Phase 4 is abouteligibilityfor certification.C . CapabilityIncorrect. Capability refers to an organization'stechnical and operational readiness. The Lead Assessor is making a recommendation oneligibility, not just capability.D . SuitabilityIncorrect. Suitability is not a defined term in theCMMC CAP processfor final assessment recommendations. The correct term iseligibility.CMMC Official Reference:CMMC Assessment Process (CAP) Document Specifies that the Lead Assessor must determine and recommend theeligibilityof the OSC in Phase 4.CMMC 2.0 Model Defines the assessment process, including certification decision-making.Thus,option B (Eligibility) is the correct answer, as per official CMMC guidance.
A CMMC Assessment Team arrives at an OSC to begin a CMMC Level 2 Assessment. The team checks in at the front desk and lets the receptionist know that they are here to conduct the assessment. The receptionist is aware that the team is arriving today and points down a hallway where the conference room is. The receptionist tells the Lead Assessor to wait in the conference room. as someone will be there shortly. The receptionist fails to check for credentials and fails to escort the team. The receptionist's actions are in direct violation of which CMMC practice?
Answer(s): A
ThePhysical Protection (PE) domaininCMMC 2.0 Level 1includes the requirementPE.L1-3.10.3, which mandates that organizationsescort visitors and monitor their activity.Breaking Down the Scenario:TheCMMC Assessment Teamarrives at the OSC.Thereceptionist acknowledges their arrival but does not verify credentials or escort themto the appropriate location.Failing to verify visitor identity and failing to escort them is a violation of PE.L1-3.10.3.Analysis of the Given Options:A . PE.L1-3.10.3: Escort visitors and monitor visitor activityCorrectThis requirement ensures that visitorsdo not have unsupervised access to sensitive areas.The receptionistshould have checked credentials and escorted the assessment team.B . PE.L1-3.10.5: Control and manage physical access devicesIncorrectThis requirement refers to managingkeys, access badges, and security devices, which isnot the issue in this scenario.C . PS.L2-3.9.1: Screen individuals prior to authorizing access to organizational systems containing CUIIncorrectThis control applies to personnel screeningsbefore granting access to CUI systems, not physical visitor access.D . PS.L2-3.9.2: Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfersIncorrectThis requirement deals withoffboarding employees and ensuring they no longer have system access.It isnot relevant to visitor escorting.Official Reference Supporting the correct answer:CMMC 2.0 Level 1 - PE.L1-3.10.3 (Physical Protection)Requires organizations toescort visitors and monitor visitor activityat facilities containingFCI or CUI.NIST SP 800-171 Rev. 2, Control 3.10.3States thatvisitors must be escorted and monitored at all timesto prevent unauthorized access.Conclusion:Since the receptionist failed to verify credentials and escort the visitors, this violatesPE.L1-3.10.3. A. PE.L1-3.10.3: Escort visitors and monitor visitor activity
During a CMMC readiness review, the OSC proposes that an associated enclave should not be applicable in the scope. Who is responsible for verifying this request?
During aCMMC readiness review, anOrganization Seeking Certification (OSC)may argue that a specificenclave (network segment or system) is out of scopefor assessment. TheLead Assessor is responsible for verifying and approving this request.Roles and Responsibilities in CMMC Assessments:Certified CMMC Professional (CCP)A CCP supports OSCs inpreparing for assessmentsbutdoes not make final scope determinations.Certified Third-Party Assessment Organization (C3PAO)The C3PAOoversees the assessmentbut doesnot personally verify scope exclusions--that falls under theLead Assessor's role.Lead Assessor (Correct Answer)TheLead Assessor has the authorityto determine if anenclave is out of scopebased on OSC-provided evidence.The Lead Assessor followsCMMC Assessment Process (CAP) guidelinesto ensure proper scoping.Advisory BoardTheCMMC-AB (Advisory Board) does not make scope determinations. It focuses onprogram oversightandcertification processes.Official Reference Supporting the correct answer:CMMC Assessment Process (CAP) v1.0TheLead Assessor is responsible for confirming the assessment scopeand determining enclave applicability.CMMC Scoping Guidance for Level 2 AssessmentsRequires theLead Assessor to review and approve any enclave exclusionsbefore finalizing the assessment scope.Conclusion:TheLead Assessoris the correct answer because they have the authority to verify scope determinations during the assessment.Answer(s): C. Lead Assessor
During the planning phase of a CMMC Level 2 Assessment, the Lead Assessor is considering what would constitute the right evidence for each practice. What is the Assessor attempting to verify?
Understanding Evidence Sufficiency in CMMC Level 2 AssessmentsDuring aCMMC Level 2 Assessment, theLead Assessormust determine whether the evidence collected for each practice issufficientto support an assessment finding. This aligns with theCMMCAssessment Process (CAP) Guide, which requires assessors to evaluate:Examinations Reviewing documents, configurations, and system records.Interviews Speaking with personnel to confirm implementation and understanding.Testing Observing security controls in action to validate effectiveness.To determine whether evidence issufficient, the assessor ensures that it:Directly supports the assessment objective.Demonstrates that the practice is consistently implemented.Can be independently verified.Why Option B (Sufficiency) is CorrectSufficiencyrefers to whetherenoughevidence has been collected to make an accurate determination about compliance.Option A (Adequacy)is incorrect because adequacy relates tothe qualityof evidence, while sufficiency focuses on whetherenoughevidence exists.Option C (Process Mapping)is incorrect because process mapping is used for understanding workflows but is not an assessment verification method.Option D (Assessment Scope)is incorrect because defining the scope happensbeforeevidence collection, during the planning phase.Official CMMC Documentation ReferenceCMMC Assessment Process (CAP) Guide Section 3.6 (Determining Sufficiency of Evidence)CMMC Level 2 Assessment Guide Evidence Collection and EvaluationFinal VerificationSince theLead Assessor is ensuring enough evidence is available to verify compliance, the correct answer isOption B: Sufficiency.
Within the CMMC Ecosystem which organization ultimately will manage and oversee the training, testing, authorization, and certification of candidate assessors and instructors?
Answer(s): D
Understanding the Role of CAICO in the CMMC EcosystemTheCMMC Ecosystemconsists of multiple organizations that manage, implement, and oversee different aspects of theCybersecurity Maturity Model Certification (CMMC)program.One of the key organizations is theCMMC Assessors and Instructors Certification Organization (CAICO), which is responsible for:Training and certifying assessors and instructors.Managing testing, authorization, and certificationfor CMMC professionals.Ensuring assessors meet qualification and compliance standards.Why Option D (CAICO) is CorrectTheCAICO is explicitly taskedwith thetraining, testing, authorization, and certification of candidate assessors and instructors.Option A (DoD OUSD)is incorrect because theDoD Office of the Under Secretary of Defense(OUSD) provides policy oversight butdoes not handle certification of assessors.Option B (DIB Collaborative Information Sharing Environment)is incorrect because theDIB CISfocuses on information sharing within the Defense Industrial Base, not assessor certification.Option C (Committee on National Security Systems Instructions)is incorrect because CNSSI provides security standards butdoes not manage assessor training or certification.Official CMMC Documentation ReferenceCMMC Ecosystem Overview Role of the CAICOCMMC Assessment Process (CAP) Guide Assessor Certification and TrainingFinal VerificationSinceCAICO is responsible for training, testing, and certifying CMMC assessors and instructors, the correct answer isOption D: CMMC Assessors and Instructors Certification Organization.
Post your Comments and Discuss Cyber AB CMMC-CCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCP content, but please register or login to continue.