The CMMC assessment process mandates a clearly defined and validated scope prior to the conduct phase. When an Assessment Team member discovers that critical documentation, like a network diagram, is ambiguous and fails to clearly delineate the CUI environment boundary, it directly impacts scope validation. The correct professional procedure is to escalate this finding to the Lead Assessor. The Lead Assessor holds the responsibility for all official communication with the Organization Seeking Certification (OSC). They will formally request the necessary clarification and revised documentation from the OSC to ensure the assessment scope is mutually understood and accurately defined before proceeding. This prevents scope creep and ensures a valid and reliable assessment.

A. Proceeding with an unclear scope violates the fundamental principles of the CMMC assessment process, which requires a well-defined and agreed-upon assessment boundary before the conduct phase.

C. Recommending specific solutions, such as hiring a specialist, constitutes consulting. The Assessment Team's role is to assess against the standard, not to provide advisory services.

D. The assessment scope must be finalized during the planning phase. Adjusting the scope during the assessment conduct phase is improper, inefficient, and can invalidate the assessment results.

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2, Version 1.0, The Cyber AB, December 2022.

Section 3.1, Phase 1: Plan and Prepare the Assessment, Activity 1.4 Validate Assessment Scope: This section details that the C3PAO must validate the OSC’s defined scope. An unclear network diagram prevents proper validation, necessitating a request for clarification, which is managed by the Lead Assessor as the primary point of contact.

2. U.S. Department of Defense, CMMC Scoping Guide, Level 2, Version 2.0, December 2021.

Section 2.2, Documenting the Scope: This guide states, "The OSC must document the scope of the CMMC assessment in the SSP... The OSC should also have a network diagram of the assessment scope that clearly shows the assessment boundary." The failure of the diagram to clearly delineate boundaries is a failure to meet this documentation expectation, which the Assessment Team must address.

3. Carnegie Mellon University, Software Engineering Institute, "The Certified CMMC Professional (CCP) and Certified CMMC Assessor (CCA) Roles," CMMC-AB/CMMC-COE Training Material Outline.

Courseware outlines for CCA certification emphasize the distinct roles within the assessment team. They specify that the Lead Assessor is responsible for managing the assessment, including all formal communications with the OSC regarding planning, scoping, and evidence requests. Team members are expected to report issues internally to the Lead Assessor.