You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC.
You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. Which of the following is not one of the recommended methods for collecting evidence during a CMMC assessment?

• A.Examine
• B.Self-Assessment by the OSC
• C.Interview
• D.Test

Comment: *

Name: *

Email: *

Verification: *

During the initial assessment framing discussions, the OSC POC attempts to sign off on the agreed-upon terms and scope of the assessment, asserting that they have the authority to enter into a legally binding contract with the C3PAO. Which of the following must the C3PAO ascertain before the OSC POC signs off on the agreed terms and scope of the assessment?

• A.That the C3PAO has provided the POC with all necessary training to make binding decisions.
• B.That the POC has decision-making authority within the company and can bind the OSC in agreements with the C3PAO.
• C.That the POC has met the DoD Cyber Workforce Requirements.
• D.That the POC has personally reviewed and approved all the assessment terms and scope details.

Comment: *

Name: *

Email: *

Verification: *

The OSC uses an on-premises ERP system that processes and stores CUI data. A Third-Party Maintenance (TPM) provider has remote access to the ERP system for troubleshooting and maintenance purposes. The OSC allows the TPM to access the system through a secure remote access tool with Multi-Factor Authentication (MFA). As a Lead Assessor, what challenges might you encounter when assessing the OSC's compliance with CMMC's practice AC.L2-3.1.12 - Control Remote Access?

• A.The use of a dedicated remote access tool simplifies the assessment of access controls
• B.You might still face challenges in obtaining evidence of how the TPM's remote access sessions are monitored and controlled to ensure remote access sessions are controlled and authorized
• C.CMMC requirements apply only to cloud-based systems, not on-premises deployments
• D.You may have difficulty verifying the effectiveness of the on-premises security measures

Comment: *

Name: *

Email: *

Verification: *

You are working as a CCA on a Level 2 Assessment for a DoD prime contractor. The Organization Seeking Certification (OSC) seeks to keep assessment costs down, and the C3PAO and OSC have decided to conduct all possible work remotely. You are assigned to work primarily on the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains. In addition, the Lead Assessor has designated you as the one person from the Assessment Team to conduct all the on-premises work. Which of the following factors do you and the Assessment Team not need to consider as part of your on-site work?

• A.For the virtual aspects of the assessment, availability of a DoD-approved collaboration tool for virtual communication with the OSC
• B.Limitations of conducting on-premises assessments for the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains
• C.For the virtual aspects of the assessment, the mandatory Virtual Assessment Evidence Preparation Template must be used to ensure proper assessment methods
• D.Non-critical areas of the OSC facilities

Comment: *

Name: *

Email: *

Verification: *

During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team. If the OSC Assessment Official asks the C3PAO for advice on how to proceed, the Lead Assessor, on behalf of the C3PAO, should do which of the following?

• A.Provide sufficient advice and recommendations.
• B.Politely refuse to provide any advice or recommendations.
• C.Provide general advice but avoid specific recommendations that could be seen as implementation assistance.
• D.Offer limited advice, but only if the OSC agrees to proceed with the assessment as originally scheduled.

Comment: *

Name: *

Email: *

Verification: *