CCA CCA Ethics, Standards & Professional Conduct 2

Question 1

What continuing education requirement must CCAs fulfill to maintain their certification?

Accepted Answer

CCAs must complete Cyber AB-required continuing professional education (CPE) credits each year

Answer

No continuing education is required once certified

Answer

CCAs must retake the full CCA exam every two years

Answer

CCAs must conduct a minimum of 10 assessments per year

Question 2

What is the significance of the CCA oath or attestation taken at certification?

Accepted Answer

It commits the CCA to uphold the Cyber AB Code of Professional Conduct and perform assessments with integrity and objectivity

Answer

It is a formality with no legal significance

Answer

It transfers liability for assessment findings to the Cyber AB

Answer

It certifies the CCA as a licensed cybersecurity attorney

Question 3

How should a CCA respond if an OSC representative attempts to coach or influence the assessor's findings during the assessment?

Accepted Answer

Politely decline and document the attempt, maintaining independent judgment based on evidence

Answer

Accept the guidance if it comes from a senior executive

Answer

Incorporate the feedback as additional context in the findings

Answer

Terminate the assessment immediately and report to DoD IG

Question 4

What is the consequence for a CCA who knowingly certifies an OSC that does not meet CMMC requirements?

Accepted Answer

Potential decertification, civil liability under the False Claims Act, and possible criminal charges

Answer

A formal warning from the Cyber AB

Answer

Required additional training on CMMC requirements

Answer

Temporary suspension of assessment privileges for 30 days

Question 5

What does 'professional skepticism' mean for a CCA assessor?

Accepted Answer

Maintaining a questioning mind and critically assessing evidence rather than accepting all representations at face value

Answer

Distrusting everything the OSC says during the assessment

Answer

Refusing to conduct assessments for OSCs with prior compliance issues

Answer

Requiring external legal counsel to verify all evidence

Question 6

Under what circumstances may a CCA share OSC assessment findings with parties outside the C3PAO and OSC?

Accepted Answer

Only when required by law, court order, or explicitly authorized by the OSC

Answer

Whenever requested by other government contractors

Answer

When sharing would benefit the broader cybersecurity community

Answer

When the information is more than 90 days old