The primary intent of the "verify evidence and record gaps" activity is to perform a comparative analysis. The Assessment Team systematically evaluates the objective evidence collected from the Organization Seeking Certification (OSC) against the explicit requirements defined by the CMMC practices and their associated assessment objectives. This verification process is designed to identify any discrepancies, deficiencies, or "gaps" where the provided evidence is insufficient to prove that a requirement has been met. Documenting these differences is crucial for determining the final assessment score and providing the OSC with a clear understanding of areas needing remediation.

A. Mapping evidence to practices is an organizational task that typically precedes or occurs concurrently with evidence analysis, not the primary intent of gap identification.

B. Conducting interviews is a method for collecting evidence, which happens before the activity of verifying that evidence and recording gaps.

C. Determining the relationship between a practice and an assessment object is a foundational part of the assessment methodology, established during the planning phase.

1. U.S. Department of Defense

Office of the Under Secretary of Defense for Acquisition & Sustainment. (2021). CMMC Assessment Process (CAP) for CMMC Level 2

Version 1.0. Section 4.3.4

"Make and Document Determination

" page 16. This section states

"If the Assessment Team determines that the evidence is insufficient to satisfy an assessment objective

the Assessment Team documents the deficiency..." This directly describes the process of identifying and recording differences (gaps) between required standards and collected evidence.

2. U.S. Department of Defense. (2021). CMMC Model Version 2.0

Assessment Guide

Level 2. Introduction

page 1. The guide explains that its purpose is to provide assessment procedures for CMMC practices. The assessment process inherently involves using these procedures to "verify that the required CMMC practices and processes are in place

" which necessitates identifying where they are not—i.e.

finding the gaps.