The Lead Assessor's primary duty is to objectively evaluate the Organization Seeking Certification's (OSC) cybersecurity posture as it exists at the time of the assessment. An outdated signature on a policy document represents a weakness in the policy lifecycle management process and should be documented as a finding or potential evidence gap. However, CMMC assessment relies on multiple forms of evidence (Examine, Interview, Test). Since staff interviews confirm the policy is actively enforced, the assessor must continue to gather and evaluate all available evidence to determine if the practice is implemented effectively. A single documentary flaw does not automatically result in a "NOT MET" score if other sufficient evidence demonstrates the practice is performed and institutionalized.

A. Accept the policy as valid evidence since it is still enforced. This is incorrect because it ignores a clear deficiency in the policy management process. The outdated signature is a finding that must be documented, as it relates to institutionalization.
C. Reject the policy due to the outdated signature and score the practice as "NOT MET." This is incorrect because it is a premature conclusion. The assessor must consider all evidence, and the interviews already suggest the practice is implemented, which contradicts an immediate "NOT MET" score.
D. Request the OSC to obtain a new signature from current management before proceeding. This is incorrect as it constitutes consulting, which is a violation of the assessor's code of conduct. The assessor's role is to assess the "as-is" state, not direct remediation activities. ---

1. Cyber AB Code of Professional Conduct (CoPC), Version 2.1, Section 3.2 Objectivity: "CMMC Professionals shall be objective and impartial in all professional dealings and shall not allow bias, conflict of interest, or the undue influence of others to override professional judgments... CMMC Professionals shall not provide CMMC consulting services to any OSC for which they are providing CMMC assessment services." This reference directly invalidates option D.

2. CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0, Section 3.3.1 Evidence: The CAP emphasizes that assessors must "collect sufficient, appropriate evidence to support the assessment scope." It further details the three evidence sources: Examine, Interview, and Test. This supports the methodology in option B, where the assessor uses interviews and other evidence to corroborate or refute the flawed policy document, rather than relying on a single source as suggested in options A and C.

3. CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0, Section 3.3.3 Assessment Findings: "The Assessment Team documents all findings discovered during the assessment... A finding is the conclusion of an evidence-based assessment activity." This supports the first part of option B, which is to "Document the outdated signature as an evidence gap" (or finding), as it is a conclusion based on examining the policy document.