CCP Lesson 7

Question 1

Evidence

Answer 1

The observable proof that an organization has either met or not met the standard for a particular CMMC practice

Question 2

Artifacts

Answer 2

Tangible and reviewable records that are the direct outcome of a practice or process being performed by a system, person or persons performing a role in that practice, control, or process. Artifacts may be a printed hard-copy or a soft-or electronic copy of a document or file embedded in a system or software but must be a result or an output from the performance of a process within the OSC.

Question 3

Stakeholder

Answer 3

A person with an interest or concern in the success of a business, interviews with them provide an excellent opportunity to gain insight and establish context

Question 4

Observation

Answer 4

A real-time demonstration or review of a test, system, tool, software, hardware, practice, control, or process being performed and witnessed first-hand by the Lead Assessor and, if applicable, Assessment Team.

Question 5

Acceptable Evidence

Answer 5

Must be created, provided, or demonstrated by people who implement the practice.

Question 6

OSC

Answer 6

Organization seeking certification

Question 7

CAP requirements for evidence

Answer 7

adequacy- does information provided meet the intent of cmmc practice (do I have the right data)

sufficiency- does information provided contain enough of the “right data” (do I have ENOUGH of that data)

Question 8

3 Assessment methods used by CCP’s and CCA’s

Answer 8

Examine - process of analyzing assessment objects (artifacts) EX: reading privacy/security policies

Interview - discussing with groups or individuals to facilitate understanding, or obtain evidence Ex: interviewing SysAdmins/DevTeams

Test - exercising assessment objectives with specified conditions to compare actual results with expected results. Ex: Observe notification banner warnings

Question 9

CMMC Assessment Process (CAP) phases

Answer 9

1. Plan and prepare the assesment
2. Conduct the assessment
3. Report Recommended assessment results.
4. CMMC Plans of action and Milestones (POA&M) Close-out Assessment

Question 10

NIST SP 800-171A

Answer 10

Superceding and Authoritative guidance for assessing CUI security requirements in NIST SP 800-171

Question 11

MET, NOT MET, or N/A

Answer 11

How objectives are scored during a CMMC assessment

Question 12

Assessment Depth

Answer 12

Addresses the level of detail of the assessment: Basic, focused, or comprehensive

Question 13

Assessment Coverage

Answer 13

Addresses the scope or breadth of the assessment: Basic, focused, or comprehensive

Question 14

CMMC Level 1 & 2 practices are derived from

Answer 14

NIST SP 800-171