During a CMMC assessment, the OSC provides a service-level agreement (SLA) with an external provider as evidence for an inherited practice. The SLA outlines general security commitments but lacks specific details on how the practice's objectives are met. How should the Lead Assessor proceed?

• A.Accept the SLA as sufficient evidence since it shows a contractual obligation.
• B.Request additional detailed evidence from the external provider to demonstrate compliance with the practice's objectives.
• C.Score the practice as "NOT MET" due to the lack of specific details.
• D.Ask the OSC to renegotiate the SLA to include detailed compliance information.

Comment: *

Name: *

Email: *

Verification: *

You are a CCA conducting a CMMC assessment for an OSC. While evaluating Risk Assessment (RA) practices, you check how the OSC has addressed assessment objective [a] of RA.L2-3.11.1, "Determine if the frequency for assessing risk to organizational operations, organizational assets, and individuals is defined." Which Assessment Object would most likely provide the answer to this requirement?

• A.Risk Assessment Policy
• B.Plan of Actions
• C.Risk Assessment Report
• D.Vulnerability scanning results

Comment: *

Name: *

Email: *

Verification: *

An OSC has contacted your C3PAO organization for a prospective CMMC Level 2 assessment. You have been selected to lead the Assessment Team. When ascertaining the assessment conditions and requirements, you discuss the prospective CMMC assessment scope with the OSC. Before proceeding to Phase 2 of the CMMC assessment process, the OSC must complete the following steps of its high-level scoping process, EXCEPT?

• A.Identify and take inventory of the various categories of CMMC assets contained in the networked environment.
• B.Propose the scope of the CMMC assessment that will be evaluated by the Lead Assessor and validated by the C3PAO.
• C.Establish the CMMC Assessment Scope of their networked environment.
• D.Evaluate Model Non-Duplication.

Comment: *

Name: *

Email: *

Verification: *

As a CCA, John feels he can make some extra cash by aggregating and rewriting CMMC materials into a book titledAcing Your CMMC Assessment: A Complete Guide. You ask him about potential issues, such as the failure to get permission from the Cyber Accreditation Body. John tells you that since he is a CCA, this is not a requirement, and in any case, the information is already publicly available. Has John broken any CoPC guiding principles or practices? If so, which one?

• A.No, he has not.
• B.Yes, information integrity.
• C.Yes, respect for intellectual property.
• D.Yes, adherence to materials and methods.

Comment: *

Name: *

Email: *

Verification: *

An OSC uses an External Service Provider (ESP) to support part of its CUI processing scope. The OSC has selected an accredited ESP with FedRAMP MODERATE authorization. The OSC has a contract requiring the ESP to meet its security requirements. The ESP has provided a Shared Responsibility Matrix (SRM) consistent with the contract terms.
When assessing these assets, what should the assessor MOST carefully review?

• A.The contract terms to ensure that the OSC's CMMC Level 2 requirements are in the contract, and the SRM to ensure that the shared responsibilities are well defined.
• B.The contract terms to ensure that the OSC's CMMC Level 2 requirements are in the contract, and the SRM to ensure that the ESP's responsibilities are well defined.
• C.The ESP's FedRAMP MODERATE authorization to ensure the OSC's CMMC Level 2 requirements are MET, and the SRM to ensure that the ESP's responsibilities are well defined.
• D.The ESP's FedRAMP MODERATE authorization to ensure the OSC's CMMC Level 2 requirements are MET, and the SRM to ensure that the shared responsibilities are well defined.

Comment: *

Name: *

Email: *

Verification: *