CCA Evaluation Methodology 5

Question 1

What is the purpose of the Affirmation requirement in the CMMC certification process, and who must execute it?

Accepted Answer

A senior official of the OSC affirming that the organization continues to meet CMMC requirements between assessments

Answer

The Affirmation is a formal declaration by a senior OSC official confirming that CMMC requirements continue to be met, and it must be renewed annually between triennial assessments.

Question 2

During a CMMC assessment, an assessor notices that log files required for audit practice review have been deleted within the last 24 hours. What is the MOST appropriate assessor response?

Accepted Answer

Note the absence of evidence, score the relevant practice(s) NOT MET, and document the circumstance in the assessment findings

Answer

Missing evidence that cannot be otherwise obtained results in a NOT MET finding; assessors must document the circumstances and cannot accept unverifiable verbal substitutes.

Question 3

How does the CMMC Assessment Process (CAP) define the relationship between the OSC's SSP and the formal Assessment Plan (AP)?

Accepted Answer

The SSP is reviewed by the assessor during the Plan phase to inform the development of the AP, which tailors assessment procedures to the OSC's environment

Answer

Assessors review the SSP during planning to understand the OSC's environment, then develop the AP to tailor assessment procedures, interview plans, and evidence requests accordingly.

Question 4

An assessor is evaluating an OSC that recently migrated to a new system mid-year. Evidence for some practices only covers the new system, with gaps in coverage for the period when the old system was in use. How should this be handled?

Accepted Answer

Evaluate the completeness and continuity of evidence, noting any gaps, and score practices based on whether requirements were continuously met throughout the assessment period

Answer

Assessors evaluate whether practices were continuously implemented throughout the relevant period; evidence gaps during a migration may result in NOT MET if continuity cannot be demonstrated.

Question 5

Under CMMC methodology, what distinguishes a 'finding' from an 'observation' in assessment reporting?

Accepted Answer

A finding represents a scored deficiency (NOT MET) against a specific CMMC practice, while an observation is a noteworthy item that does not affect scoring

Answer

Findings are formal scored deficiencies tied to specific practices, while observations are noteworthy items — such as best practice recommendations — that do not change a practice's MET/NOT MET score.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Evaluation Methodology 5