CCA CCA Ethics, Standards & Professional Conduct 1 — Questions and Answers
Question 1: What is the primary ethical obligation of a CCA during a CMMC assessment?
- To help the OSC achieve the highest possible CMMC score
- To provide an objective, impartial, and accurate assessment of the OSC's cybersecurity practices (Correct answer)
- To recommend specific security products that the assessor is familiar with
- To complete the assessment as quickly as possible to minimize disruption to the OSC
Correct answer: To provide an objective, impartial, and accurate assessment of the OSC's cybersecurity practices
A CCA's primary ethical obligation is objectivity and accuracy — assessments must reflect actual compliance status, not what the OSC or the C3PAO would prefer the outcome to be.
Question 2: Which of the following scenarios represents a conflict of interest for a CCA assessor?
- Assessing an OSC in an industry the assessor is unfamiliar with
- Assessing an OSC for which the assessor previously provided CMMC consulting or implementation support (Correct answer)
- Assessing an OSC in a different state than where the assessor is located
- Assessing an OSC that is a competitor of a former employer
Correct answer: Assessing an OSC for which the assessor previously provided CMMC consulting or implementation support
A CCA who previously provided consulting or implementation help to an OSC has a conflict of interest because they would effectively be assessing their own prior work, compromising objectivity.
Question 3: What must a CCA do when they identify a potential conflict of interest before beginning an assessment?
- Proceed if the conflict is minor and disclose it only in the final report
- Disclose the conflict to the C3PAO and recuse themselves from the assessment if the conflict cannot be mitigated (Correct answer)
- Ask the OSC if they are comfortable proceeding despite the conflict
- Document the conflict and continue, as disclosure satisfies the ethical obligation
Correct answer: Disclose the conflict to the C3PAO and recuse themselves from the assessment if the conflict cannot be mitigated
CCAs must disclose conflicts of interest to their C3PAO and recuse themselves if the conflict cannot be appropriately mitigated, to preserve the objectivity required for a valid assessment.
Question 4: The Cyber AB Code of Professional Conduct requires CCAs to protect the confidentiality of what type of information?
- Only information explicitly marked 'CUI' during the assessment
- All sensitive information about the OSC's systems, security posture, and assessment findings (Correct answer)
- Only information shared during formal interviews
- Information the OSC designates as confidential in writing
Correct answer: All sensitive information about the OSC's systems, security posture, and assessment findings
CCAs must protect the confidentiality of all sensitive OSC information encountered during the assessment, not just formally marked CUI, as disclosure could harm the OSC or compromise national security.
Question 5: What action should a CCA take if they believe the lead assessor on their team is making inaccurate or biased findings?
- Silently note the disagreement in their personal assessment notes
- Raise the concern through the C3PAO's quality assurance process and escalate if unresolved (Correct answer)
- Agree with the lead assessor to maintain team cohesion
- Contact the OSC directly to alert them of the discrepancy
Correct answer: Raise the concern through the C3PAO's quality assurance process and escalate if unresolved
CCAs have a professional obligation to raise concerns about inaccurate findings through their organization's quality assurance process, as the integrity of the CMMC program depends on accurate determinations.
Question 6: Under the Cyber AB Code of Professional Conduct, which activity is explicitly prohibited for CCAs?
- Working for multiple C3PAOs simultaneously
- Accepting gifts, payments, or favors from an OSC in exchange for favorable assessment findings (Correct answer)
- Discussing assessment methodology with other CCAs
- Conducting assessments outside the assessor's primary geographic region
Correct answer: Accepting gifts, payments, or favors from an OSC in exchange for favorable assessment findings
Accepting gifts or payments from OSCs in exchange for favorable findings is bribery and a direct violation of the Cyber AB Code of Professional Conduct, which could result in decertification.
CCA CCA Ethics, Standards & Professional Conduct 1
What is the primary ethical obligation of a CCA during a CMMC assessment?