CCA CCA Assessment Planning & Scoping

Question 1

What is the first step a CCA assessor must complete before beginning a CMMC Level 2 assessment?

Accepted Answer

Define the assessment scope and boundary

Answer

Review contractor invoices

Answer

Install monitoring software on contractor systems

Answer

Submit the final assessment report

Question 2

Which document serves as the primary planning artifact for a CMMC assessment?

Accepted Answer

Assessment Plan (AP)

Answer

System Security Plan (SSP)

Answer

Plan of Action & Milestones (POA&M)

Answer

Incident Response Plan (IRP)

Question 3

When scoping a CMMC assessment, which type of data determines what systems fall within scope?

Accepted Answer

Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)

Answer

Personally Identifiable Information (PII)

Answer

Classified National Security Information (CNSI)

Answer

Export Controlled Technical Data (ECTD)

Question 4

What is the purpose of a pre-assessment kickoff meeting in CMMC assessment planning?

Accepted Answer

To establish ground rules, confirm scope, and align expectations between assessors and the OSC

Answer

To sign the final assessment report

Answer

To conduct penetration testing

Answer

To submit findings to the CMMC-AB

Question 5

Which term describes the boundary within which CMMC requirements must be assessed?

Accepted Answer

Assessment boundary

Answer

Compliance perimeter

Answer

Security enclave

Answer

Certification zone

Question 6

How should a CCA assessor handle a situation where the OSC's scope definition appears to exclude systems that clearly handle CUI?

Accepted Answer

Flag the discrepancy and require the scope to be corrected before proceeding

Answer

Accept the OSC's scope as defined to avoid conflict

Answer

Proceed with the assessment and note the exclusion in a footnote

Answer

Report the OSC immediately to the DoD