You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery. What would you recommend the contractor do to avert the risk?

• A.Institute mandatory overtime for the engineer to complete tasks faster
• B.Fully implement AC.L2-3.1.4, Separation of Duties by assigning different engineers responsibility for design, coding, testing, and deployment. Implement peer code reviews and separate test and deployment duties
• C.Invest in more powerful development machines
• D.Increase the engineer's salary to incentivize careful work

Comment: *

Name: *

Email: *

Verification: *

A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor is deciding whether the company can be moved to a POA&M Close-Out. What condition will result if a POA&M Close-Out option cannot be utilized?

• A.The assessment will be paused until the OSC can meet all practices.
• B.The Lead Assessor will ask the OSC to justify not meeting all the practices.
• C.The OSC will be granted a provisional status until it can meet all the practices.
• D.The Lead Assessor will not recommend the OSC for CMMC Level 2 certification.

Comment: *

Name: *

Email: *

Verification: *