CCA Assessment Planning & Scoping Flashcards
6 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CCA Assessment Planning & Scoping flashcards as text
What is the significance of External Service Providers (ESPs) in CMMC scoping?
Answer: They must be included in scope if they process, store, or transmit CUI
External Service Providers that handle CUI on behalf of the OSC must be included in the assessment scope to ensure comprehensive coverage.
What should a CCA do if an OSC refuses to provide access to required systems during the assessment?
Answer: Document the lack of access, which may result in a 'Not Met' finding for affected practices
If an OSC withholds access to required systems, the assessor must document this and assign a 'Not Met' finding, as evidence cannot be gathered without access.
Which of the following best describes 'assessment scope creep' in CMMC assessments?
Answer: Expanding the assessment boundary beyond what was originally agreed upon without formal change control
Scope creep occurs when the assessment boundary expands informally beyond its agreed limits, potentially causing delays and resource issues without proper change management.
In CMMC assessment planning, what is a 'Letter of Assessment'?
Answer: A formal contract between the C3PAO and the OSC authorizing the assessment
The Letter of Assessment is the formal agreement between the C3PAO and the OSC that authorizes and defines the scope of the assessment engagement.
What is the purpose of the CMMC Supplier Performance Risk System (SPRS) in the assessment lifecycle?
Answer: It is where OSCs submit their self-assessment scores and where C3PAOs upload final assessment results
SPRS is the DoD system where both OSC self-assessment scores and C3PAO assessment results are submitted and stored for DoD acquisition visibility.
How does a CCA assessor determine which CMMC level to assess when the OSC's contract requirements are unclear?
Answer: Consult the contract language, DFARS clauses, and the contracting officer for clarification
The required CMMC level is determined by the contract requirements, relevant DFARS clauses, and if unclear, by seeking clarification from the contracting officer.