Q: 24

You are a CCA working for a well-known C3PAO. You have been selected for an Assessment Team tasked with conducting a CMMC assessment on a C3PAO. While you are reviewing the presented evidence, one of the Assessment Team members informs you that they weren’t trained for the job and that a friend helped them get the position. By employing non-credentialed individuals and assigning them assessment tasks, which requirement of the CoPC has the C3PAO violated?

Options

Correct Answer:

Explanation

The Cyber AB Code of Professional Conduct (CoPC) explicitly requires ecosystem members to act with professionalism. This tenet mandates that all professional duties be performed with the highest degree of due diligence, care, and competence. By knowingly assigning an untrained and non-credentialed individual to an assessment team, the C3PAO has failed to exercise due care and has not ensured the professional competence of its staff. This action directly undermines the quality and credibility of the assessment process, constituting a clear violation of the professionalism requirement.

Why Incorrect

A. Integrity: This is incorrect because integrity primarily relates to honesty and avoiding deceptive acts. The core violation here is the lack of competence and due care, which is more specifically addressed by professionalism.
B. None; it is well within their rights to hire whomever they want: This is incorrect. C3PAOs are bound by strict Cyber AB requirements to use trained, certified, and suitable personnel for conducting official assessments.
C. Confidentiality: This is incorrect as the scenario does not describe any breach or unauthorized disclosure of sensitive or confidential information.

References

1. The Cyber AB, "Code of Professional Conduct," Version 2.1, June 2, 2022.

Section: Professionalism (Page 2): "Perform all professional responsibilities and duties with the highest degree of professionalism, due diligence, and care." This directly supports that assigning an unqualified individual is a failure of due diligence and care.

Section: Professionalism (Page 2): "Maintain and enhance their professional and technical competence through continuing education and training." This implies that competence is a foundational requirement that the C3PAO failed to uphold for its team member.

2. The Cyber AB, "CMMC Assessment Process (CAP) for CMMC Level 2," Version 1.0, July 21, 2023.

Section 2.3, Assessment Team (Page 10): "The Assessment Team is comprised of a Lead Assessor and one or more Assessment Team members. Assessment Team members must be Certified CMMC Assessors (CCAs) or Certified CMMC Professionals (CCPs) in good standing with the Cyber AB." This document confirms that assessment team members must be credentialed, making the C3PAO's action a violation of established process.

Cyber AB CMMC-CCA Real Exam Questions [October 2026 Update] Quiz

Premium Access Includes