CCA CCA Contractor & Supplier Requirements 2

Question 1

What is a 'covered contractor information system' under DFARS 252.204-7012?

Accepted Answer

An unclassified information system owned or operated by a contractor that processes, stores, or transmits covered defense information

Answer

A covered contractor information system is an unclassified system that processes, stores, or transmits covered defense information (CUI) as required or authorized by the DoD contract.

Question 2

Under CMMC, what is the contractor's obligation regarding media containing CUI that is sent off-site for maintenance?

Accepted Answer

CUI must be sanitized or encrypted on media prior to removal, and the chain of custody must be documented

Answer

CMMC media protection practices require that CUI be sanitized or appropriately encrypted when media is sent for maintenance, and the chain of custody must be maintained to protect against unauthorized disclosure.

Question 3

Which practice requires contractors to limit the use of portable storage devices on organizational systems?

Accepted Answer

MP.2.120

Answer

MP.2.120 requires organizations to control and limit the use of removable media on system components to reduce the risk of data exfiltration or introduction of malicious code.

Question 4

What is the significance of the CMMC Ecosystem in contractor compliance?

Accepted Answer

It encompasses the network of C3PAOs, CCAs, RPOs, RPs, and the Cyber AB that support contractor CMMC certification

Answer

The CMMC Ecosystem includes all the accredited organizations and individuals (C3PAOs, CCAs, RPOs, RPs) that support contractors in achieving and maintaining CMMC compliance under the Cyber AB's oversight.

Question 5

When a contractor uses a cloud service provider (CSP) to store CUI, which federal authorization standard must the CSP meet?

Accepted Answer

FedRAMP authorization at the appropriate impact level

Answer

CSPs that store, process, or transmit CUI for defense contractors must meet FedRAMP authorization requirements at the appropriate impact level (typically Moderate or High for CUI).

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA CCA Contractor & Supplier Requirements 2