The CMMC Assessment Process (CAP) requires the Lead Assessor to validate the CMMC Assessment Scope proposed by the OSC. What is the main task that the Lead Assessor must conduct in validating the CMMC Assessment Scope?

The main task of the Lead Assessor in validating the CMMC Assessment Scope is to independently verify that the boundary proposed by the Organization Seeking Certification (OSC) is correct and complete. This involves confirming that all assets—including people, processes, technology, and facilities—that process, store, or transmit Controlled Unclassified Information (CUI) are contained within the defined assessment boundary. This verification ensures the assessment will be comprehensive and accurately reflect the OSC's security posture regarding CUI, as required by the CMMC Scoping Guidance. The validation is a critical prerequisite for developing the final Assessment Plan.

A. Documenting discrepancies is an outcome or a sub-task of the validation process, not the primary validation task itself.

C. Determining if additional systems are needed is a part of the verification process, but the main task is the overall boundary verification.

D. The OSC proposes and approves its scope; the Lead Assessor's role is to perform an independent technical validation, not confirm the OSC's internal approval.

---

1. CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0 (December 2, 2022).

Section 2.2.2, Readiness Review, Page 10: States, "The Lead Assessor also reviews the OSC’s proposed CMMC Assessment Scope to determine if it is correct." This correctness check involves verifying the boundary contains all relevant assets.

2. CMMC Level 2 Scoping Guidance, Version 2.0 (December 2021).

Section 2, Scoping, Page 4: Specifies that "The CMMC Assessment Scope is determined by the OSC and validated by the C3PAO." The guidance details that the scope must include assets that process, store, or transmit CUI, which is what the assessor must validate.

3. CMMC Model 2.0, CMMC Assessment Guide – Level 2 (December 2021).

Introduction, Page 1: Discusses the assessment scope, stating, "The scope of the CMMC assessment is based on the location of CUI within the contractor’s environment." The assessor's validation task is to confirm this scope is accurately defined.