CCA Evaluation Methodology 3

Question 1

Which NIST publication provides the assessment procedures that directly underpin the CMMC Level 2 evaluation methodology?

Accepted Answer

NIST SP 800-171A

Answer

NIST SP 800-171A provides the assessment procedures for verifying the security requirements in NIST SP 800-171, which form the basis for CMMC Level 2 assessments.

Question 2

During the planning phase, an assessor develops the Assessment Plan (AP). Which element is MOST important to establish in the AP to ensure a focused, efficient assessment?

Accepted Answer

The assessment scope including the OSC's CUI boundary and in-scope systems

Answer

Establishing the assessment scope — particularly the CUI boundary and in-scope assets — is foundational to ensuring the assessment is focused and all relevant systems are evaluated.

Question 3

An assessor finds that an OSC has implemented a compensating control in place of a standard CMMC practice. Under CMMC methodology, how should this be handled?

Accepted Answer

Compensating controls are not recognized in CMMC; the practice is marked NOT MET

Answer

CMMC Level 2 does not have a formal compensating controls framework; practices must be met as defined, so a deviation results in a NOT MET finding.

Question 4

What is the purpose of the 'examine' method in CMMC assessment methodology?

Accepted Answer

Reviewing specifications, mechanisms, and documentation to understand or confirm security control implementation

Answer

The 'examine' method involves reviewing documents, specifications, policies, and configurations to gain understanding or confirm that security controls are implemented.

Question 5

An OSC operates two geographically separated facilities, both processing CUI. How should the assessor treat each facility's controls during the assessment?

Accepted Answer

Assess each facility independently since they may have different control implementations

Answer

Each facility must be assessed independently because control implementations may differ by location, and all in-scope environments must meet CMMC requirements.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Evaluation Methodology 3