CCA Ethics, Standards & Professional Conduct Flashcards
6 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CCA Ethics, Standards & Professional Conduct flashcards as text
What is the primary ethical obligation of a CCA during a CMMC assessment?
Answer: To provide an objective, impartial, and accurate assessment of the OSC's cybersecurity practices
A CCA's primary ethical obligation is objectivity and accuracy — assessments must reflect actual compliance status, not what the OSC or the C3PAO would prefer the outcome to be.
Which of the following scenarios represents a conflict of interest for a CCA assessor?
Answer: Assessing an OSC for which the assessor previously provided CMMC consulting or implementation support
A CCA who previously provided consulting or implementation help to an OSC has a conflict of interest because they would effectively be assessing their own prior work, compromising objectivity.
What must a CCA do when they identify a potential conflict of interest before beginning an assessment?
Answer: Disclose the conflict to the C3PAO and recuse themselves from the assessment if the conflict cannot be mitigated
CCAs must disclose conflicts of interest to their C3PAO and recuse themselves if the conflict cannot be appropriately mitigated, to preserve the objectivity required for a valid assessment.
The Cyber AB Code of Professional Conduct requires CCAs to protect the confidentiality of what type of information?
Answer: All sensitive information about the OSC's systems, security posture, and assessment findings
CCAs must protect the confidentiality of all sensitive OSC information encountered during the assessment, not just formally marked CUI, as disclosure could harm the OSC or compromise national security.
What action should a CCA take if they believe the lead assessor on their team is making inaccurate or biased findings?
Answer: Raise the concern through the C3PAO's quality assurance process and escalate if unresolved
CCAs have a professional obligation to raise concerns about inaccurate findings through their organization's quality assurance process, as the integrity of the CMMC program depends on accurate determinations.
Under the Cyber AB Code of Professional Conduct, which activity is explicitly prohibited for CCAs?
Answer: Accepting gifts, payments, or favors from an OSC in exchange for favorable assessment findings
Accepting gifts or payments from OSCs in exchange for favorable findings is bribery and a direct violation of the Cyber AB Code of Professional Conduct, which could result in decertification.