CCA CMMC Certification Levels & Requirements 3

Question 1

What is the standard CMMC term for a contractor or subcontractor that undergoes a CMMC assessment to achieve certification?

Accepted Answer

Organization Seeking Certification (OSC)

Answer

Defense Industrial Base Contractor (DIBC)

Answer

Prime Defense Contractor (PDC)

Answer

Certified Security Organization (CSO)

Question 2

What does the System Security Plan (SSP) primarily document for a CMMC assessment?

Accepted Answer

The security requirements, system boundaries, and how controls are implemented

Answer

The organization's incident response playbook and breach notification contacts

Answer

The roster of all CCA-certified assessors authorized to evaluate the organization

Answer

The POA&M tracking all open security deficiencies and remediation timelines

Question 3

Which of the following is NOT one of the three assessment methods defined in the CMMC Assessment Process for evaluating practices?

Accepted Answer

Survey

Answer

Examine

Answer

Interview

Answer

Test

Question 4

In the context of a CMMC assessment, what defines the 'scope' of the assessment?

Accepted Answer

All assets, systems, and personnel that process, store, or transmit CUI and the protections around them

Answer

The total number of DoD contracts a company currently holds

Answer

The total count of CMMC practices being evaluated during the engagement

Answer

The geographic and physical locations included in the assessment visit

Question 5

What is 'conditional CMMC status' and what does it allow a contractor to do?

Accepted Answer

Provisional certification enabling contract award when open POA&Ms exist for eligible not-met practices

Answer

Certification when only 50% of practices are MET, valid for 6 months before mandatory reassessment

Answer

A temporary status for companies awaiting their first scheduled C3PAO assessment

Answer

An exemption from third-party assessment for small businesses with fewer than 10 employees

Question 6

Which DoD-published document provides the specific assessment objectives and evaluation criteria for each of the 110 CMMC Level 2 practices?

Accepted Answer

CMMC Level 2 Assessment Guide

Answer

CMMC Assessment Process (CAP) document

Answer

NIST SP 800-171A Assessing Security Requirements for CUI

Answer

Defense Federal Acquisition Regulation Supplement (DFARS)

Question 7

If an OSC undergoes a significant change to its IT environment after receiving CMMC Level 2 certification, what is the expected course of action?

Accepted Answer

The OSC must notify the Cyber AB and may be required to undergo a new assessment to confirm continued compliance

Answer

The certification automatically expires and an immediate emergency assessment must be initiated

Answer

The existing certification remains fully valid until the scheduled triennial reassessment regardless of changes

Answer

The OSC has 30 days to document the change and submit it to their contracting officer for approval