CCA Compliance & Reporting 3

Question 1

In CMMC assessments, what does the term 'inherited controls' refer to in the context of compliance reporting?

Accepted Answer

Controls implemented by a cloud service provider that the OSC relies upon

Answer

Inherited controls are security capabilities provided by an external entity (such as a CSP) that the OSC leverages rather than implementing independently.

Question 2

Which NIST publication provides the 110 security requirements that form the basis of CMMC Level 2 compliance?

Accepted Answer

NIST SP 800-171

Answer

NIST SP 800-171 'Protecting CUI in Nonfederal Systems and Organizations' provides the 110 requirements mapped to CMMC Level 2.

Question 3

When an OSC uses an external managed service provider (MSP) that handles CUI, what compliance obligation applies to that MSP?

Accepted Answer

The MSP must obtain its own CMMC certification at the same or higher level

Answer

When an MSP processes or handles CUI on behalf of an OSC, that MSP must also meet the applicable CMMC level requirements.

Question 4

What is the purpose of the CMMC Assessment Scope categorization of 'Contractor Risk Managed Assets' (CRMAs)?

Accepted Answer

Assets that could impact CUI but are managed by the contractor under documented risk controls

Answer

CRMAs are assets that can affect CUI security but are managed through contractor-defined risk controls rather than full CMMC practice application.

Question 5

A CCA is reviewing an OSC's compliance documentation and finds that audit logs are retained for only 30 days. Which NIST SP 800-171 domain does this deficiency fall under?

Accepted Answer

Audit and Accountability (AU)

Answer

Audit log retention requirements fall under the Audit and Accountability domain, specifically AU.3.045 which addresses log protection and retention.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Compliance & Reporting 3