Q: 14
As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has
thoroughly reviewed all evidence provided by the OSC for the in-scope CMMC practices. Throughout
the assessment process, daily checkpoint meetings were held with the OSC to allow them to present
additional evidence and clarify any concerns. After the final evidence review and discussions, the
Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as ‘MET.’
Additionally, 18 practices have been scored as ‘NOT MET,’ with 5 of those practices deemed ineligible
for a Plan of Action and Milestones (POA&M) due to their potential impact on network exploitation
or CUI exfiltration. The OSC has provided a draft POA&M for the remaining 13 ‘NOT MET’ practices,
outlining their proposed remediation actions and timelines. In reviewing the OSC’s draft POA&M,
you notice that one of the proposed remediation actions involves implementing a new security
control that could potentially impact the effectiveness of another practice that was scored as ‘MET.’
How should you proceed?
Options
Discussion
C. If the remediation impacts a MET control, it's a problem since that could create new gaps. Pretty sure that's how CMMC wants assessors to handle it. Agree?
C . Anything that would mess with an already MET practice can’t just slide, otherwise you’re risking compliance in another area. Better to have the OSC clean up the POA&M now before finalizing. That’s what I’ve seen in CMMC guidance. Anyone think A could make sense here?
Option C B is a trap since you can't just accept the risk to a MET control. If the POA&M could mess with another scored practice, you need them to revise it.
Be respectful. No spam.
