CCA CMMC Certification Levels & Requirements 3

Question 1

What is the standard CMMC term for a contractor or subcontractor that undergoes a CMMC assessment to achieve certification?

Accepted Answer

Organization Seeking Certification (OSC)

Answer

In CMMC terminology, an Organization Seeking Certification (OSC) is the entity—whether prime contractor or subcontractor—that undergoes the CMMC assessment process.

Question 2

What does the System Security Plan (SSP) primarily document for a CMMC assessment?

Accepted Answer

The security requirements, system boundaries, and how controls are implemented

Answer

The SSP describes how the organization implements required security controls, defines the system boundary (scope), and documents the overall security architecture that assessors will evaluate.

Question 3

Which of the following is NOT one of the three assessment methods defined in the CMMC Assessment Process for evaluating practices?

Accepted Answer

Survey

Answer

NIST SP 800-171A and the CMMC Assessment Process define three methods: Examine (review documents/artifacts), Interview (discuss with personnel), and Test (exercise mechanisms/procedures); Survey is not a defined CMMC assessment method.

Question 4

In the context of a CMMC assessment, what defines the 'scope' of the assessment?

Accepted Answer

All assets, systems, and personnel that process, store, or transmit CUI and the protections around them

Answer

CMMC assessment scope defines the boundary of what is assessed, encompassing all components, systems, and people that interact with CUI and the security controls protecting it.

Question 5

What is 'conditional CMMC status' and what does it allow a contractor to do?

Accepted Answer

Provisional certification enabling contract award when open POA&Ms exist for eligible not-met practices

Answer

Conditional CMMC status is a provisional certification that allows contract award to proceed when a contractor has open POA&Ms for certain practices, provided deficiencies are closed within 180 days.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA CMMC Certification Levels & Requirements 3