Evaluation Methodology Flashcards
7 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evaluation Methodology flashcards as text
What is the purpose of the Affirmation requirement in the CMMC certification process, and who must execute it?
Answer: A senior official of the OSC affirming that the organization continues to meet CMMC requirements between assessments
The Affirmation is a formal declaration by a senior OSC official confirming that CMMC requirements continue to be met, and it must be renewed annually between triennial assessments.
During a CMMC assessment, an assessor notices that log files required for audit practice review have been deleted within the last 24 hours. What is the MOST appropriate assessor response?
Answer: Note the absence of evidence, score the relevant practice(s) NOT MET, and document the circumstance in the assessment findings
Missing evidence that cannot be otherwise obtained results in a NOT MET finding; assessors must document the circumstances and cannot accept unverifiable verbal substitutes.
How does the CMMC Assessment Process (CAP) define the relationship between the OSC's SSP and the formal Assessment Plan (AP)?
Answer: The SSP is reviewed by the assessor during the Plan phase to inform the development of the AP, which tailors assessment procedures to the OSC's environment
Assessors review the SSP during planning to understand the OSC's environment, then develop the AP to tailor assessment procedures, interview plans, and evidence requests accordingly.
An assessor is evaluating an OSC that recently migrated to a new system mid-year. Evidence for some practices only covers the new system, with gaps in coverage for the period when the old system was in use. How should this be handled?
Answer: Evaluate the completeness and continuity of evidence, noting any gaps, and score practices based on whether requirements were continuously met throughout the assessment period
Assessors evaluate whether practices were continuously implemented throughout the relevant period; evidence gaps during a migration may result in NOT MET if continuity cannot be demonstrated.
Under CMMC methodology, what distinguishes a 'finding' from an 'observation' in assessment reporting?
Answer: A finding represents a scored deficiency (NOT MET) against a specific CMMC practice, while an observation is a noteworthy item that does not affect scoring
Findings are formal scored deficiencies tied to specific practices, while observations are noteworthy items — such as best practice recommendations — that do not change a practice's MET/NOT MET score.
What is the primary reason CMMC assessors must maintain assessor independence from the OSC being assessed?
Answer: To ensure findings are objective and unbiased, preserving the integrity and credibility of the certification outcome
Assessor independence ensures that findings reflect actual control implementation rather than relationships or financial interests, which is essential to the trust and credibility of the CMMC program.
When an OSC achieves a CMMC Level 2 certification, how long is the certification valid before a full reassessment is required?
Answer: 3 years
CMMC Level 2 certifications issued by a C3PAO are valid for three years, after which the OSC must undergo a full reassessment to renew certification.