Free CMMC-CCA Practice Test Questions and Answers (2026)

During the scoping phase of a CMMC Level 2 assessment, the Assessment Team must validate the CMMC Assessment Scope (CAS) defined by the Organization Seeking Certification (OSC). According to the CMMC Assessment Process (CAP), the OSC is required to provide a System Security Plan (SSP) and network topology diagrams. These documents are fundamental for defining the assessment boundary and understanding the CUI environment. A preliminary list of evidence may also be reviewed to gauge the OSC's readiness. However, "System Design documentation" is a broad category. While it includes required items like network diagrams, the entire set of design documents is not a standard requirement for the initial scoping activity. Detailed design documents are more typically reviewed as objective evidence for specific practices during the assessment itself.

A. Network diagrams: Incorrect. Network diagrams are explicitly required to visualize the assessment boundary, asset locations, and CUI data flows, which is a core activity of scoping.

B. System Security Plan (SSP): Incorrect. The SSP is a foundational document required by NIST SP 800-171 (3.12.4) and the CMMC CAP. It formally describes the system environment and the assessment scope.

C. Preliminary List of Evidence: Incorrect. While not a primary scoping document, this may be requested as part of the initial planning and readiness review to ensure the OSC is prepared for the assessment.

1. U.S. Department of Defense, CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1, December 21, 2022.

Section 2.3.1, Phase 1 – Plan and Prepare the Assessment: This section lists the key inputs from the OSC for the initial phase, which includes the "Assessment Scope," "System Security Plan (SSP)," and "Network topology diagram of the assessment scope." It does not list "System Design documentation" as a required input for this phase.

2. U.S. Department of Defense, CMMC Scoping Guidance Level 2, Version 2.0, November 2021.

Section 2.2, Step 2: Categorize Assets: States, "The OSC should use network and data flow diagrams to help identify where CUI is processed, stored, or transmitted and to identify assets that are part of CUI security protection." (Supports the requirement for Network Diagrams).

Section 2.3, Step 3: Determine the CMMC Assessment Scope: Notes that "The CMMC Assessment Scope is documented in the SSP..." (Supports the requirement for the SSP).

3. NIST Special Publication 800-171, Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020.

Section 3.12.4 (System Security Plan): Explicitly requires organizations to "Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems." This makes the SSP a mandatory document.

The CMMC Assessment Process (CAP) explicitly requires the C3PAO and the Organization Seeking Certification (OSC) to agree on the assessment scope before the assessment formally begins. As the Lead Assessor, your responsibility is to ensure the scope is accurate and mutually understood. The most professional and procedurally correct first step is to engage in a dialogue with the OSC Assessment Official to resolve the discrepancy. This action upholds the principles of professional conduct by seeking clarification and agreement, which is a foundational requirement for a valid and reliable assessment, before considering any form of escalation or concession.

B. Demand the OSC nominates another Assessment Official. This is an unprofessional and overly aggressive response to a procedural disagreement and is not a constructive conflict-resolution step.

C. Give in to the OSC Assessment Official’s demands. This would compromise the Lead Assessor's objectivity and the integrity of the assessment, as it would be based on an inaccurate scope.

D. Report the OSC Assessment Official to the CMMC Accreditation Body. This is a premature escalation. The Cyber AB should only be contacted after direct attempts to resolve the issue between the C3PAO and OSC have failed.

---

1. Cyber AB, "CMMC Assessment Process (CAP) for CMMC Level 2," Version 2.1, December 21, 2023.

Section 2.1, Phase 1: Plan and Prepare the Assessment, Page 10: This section states, "The C3PAO and the OSC must agree on the CMMC Assessment Scope prior to the assessment." This directly supports the requirement to resolve scope disagreements before the assessment starts (Answer A).

2. Cyber AB, "Cyber AB Code of Professional Conduct (CoPC)," Version 2.0, October 21, 2022.

Canon 2: Act honorably, honestly, justly, responsibly, and legally, Page 3: This canon requires assessors to act responsibly. Attempting to resolve a disagreement directly (Answer A) is the most responsible first action. Giving in (Answer C) would be dishonest, while demanding a replacement (Answer B) or escalating prematurely (Answer D) would be unjust and irresponsible.

Canon 4: Advance and protect the profession, Page 3: This canon implies maintaining professional decorum and following established processes, which includes collaborative scope finalization rather than immediate confrontation or capitulation.

The External Service Provider (ESP) is delivering critical security functions (SIEM, log management, MDM) that are integral to the OSC's ability to meet CMMC practice requirements for protecting Controlled Unclassified Information (CUI). According to official CMMC scoping guidance, when an ESP provides security protection for CUI assets, the ESP's offering is considered in-scope for the OSC’s CMMC assessment. The Assessment Team is therefore required to assess the ESP's services against all applicable CMMC practices to verify their implementation and effectiveness. The OSC remains accountable for ensuring the ESP's services meet these CMMC requirements.

B. Assess them against CA.L2-3.12.4 - System Security Plan only.

This is incorrect because assessing only the documentation in the SSP is insufficient; the actual implementation and effectiveness of the security controls provided by the ESP must be validated.

C. Review the SSP per practice CA.L2-3.12.4 - System Security Plan.

This is incorrect as it implies only a documentation review. The assessment must go beyond the SSP to test and verify that the ESP's services effectively meet the required CMMC practices.

D. They are out of scope; there is no need to assess them against CMMC practices.

This is incorrect because the ESP provides security protection for CUI assets, which explicitly places their services within the CMMC assessment boundary according to official scoping guidance.

---

1. Department of Defense (DoD). (2021, December 3). CMMC Scoping Guide Level 2. Version 2.0.

Section 2.4, External Service Providers (ESPs), Page 7: "If an ESP is used to process, store, or transmit CUI, or provides security protection for CUI assets, the ESP offering is in-scope for the OSC’s CMMC assessment." The scenario describes the ESP providing security protection (SIEM, Intune), making it in-scope.

Section 2.4, Page 7: "If the ESP does not have a CMMC assessment or a FedRAMP authorization with a scope that is appropriate for the OSC’s assessment, the C3PAO will assess the ESP’s offering as part of the OSC’s assessment against the applicable CMMC practices." This directly supports assessing the ESP against the practices.

2. Department of Defense (DoD). (2023, July). CMMC Assessment Process (CAP) for CMMC Level 2. Version 2.0.

Section 3.3.3, Scoping, Page 14: "The Assessment Team Lead validates the OSC’s proposed CMMC Assessment Scope... The CMMC Assessment Scope must include all assets that process, store, or transmit CUI as well as assets that provide security protection for CUI assets." This reinforces that the ESP's security services are part of the scope to be assessed.

The main task of the Lead Assessor in validating the CMMC Assessment Scope is to independently verify that the boundary proposed by the Organization Seeking Certification (OSC) is correct and complete. This involves confirming that all assets—including people, processes, technology, and facilities—that process, store, or transmit Controlled Unclassified Information (CUI) are contained within the defined assessment boundary. This verification ensures the assessment will be comprehensive and accurately reflect the OSC's security posture regarding CUI, as required by the CMMC Scoping Guidance. The validation is a critical prerequisite for developing the final Assessment Plan.

A. Documenting discrepancies is an outcome or a sub-task of the validation process, not the primary validation task itself.

C. Determining if additional systems are needed is a part of the verification process, but the main task is the overall boundary verification.

D. The OSC proposes and approves its scope; the Lead Assessor's role is to perform an independent technical validation, not confirm the OSC's internal approval.

---

1. CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0 (December 2, 2022).

Section 2.2.2, Readiness Review, Page 10: States, "The Lead Assessor also reviews the OSC’s proposed CMMC Assessment Scope to determine if it is correct." This correctness check involves verifying the boundary contains all relevant assets.

2. CMMC Level 2 Scoping Guidance, Version 2.0 (December 2021).

Section 2, Scoping, Page 4: Specifies that "The CMMC Assessment Scope is determined by the OSC and validated by the C3PAO." The guidance details that the scope must include assets that process, store, or transmit CUI, which is what the assessor must validate.

3. CMMC Model 2.0, CMMC Assessment Guide – Level 2 (December 2021).

Introduction, Page 1: Discusses the assessment scope, stating, "The scope of the CMMC assessment is based on the location of CUI within the contractor’s environment." The assessor's validation task is to confirm this scope is accurately defined.

As a Certified CMMC Assessor (CCA), your duty is to validate the assessment scope against official CMMC requirements. The CMMC Assessment Process (CAP) explicitly states that if an External Service Provider (ESP) manages any part of the OSC’s CUI environment, the ESP must possess a CMMC certification at the same or higher level as the OSC. Therefore, the CCA's mandatory first action is to verify that the ESP holds a valid CMMC Level 2 or higher certification. This ensures that the protection of CUI is maintained consistently across all in-scope environments and that the assessment can proceed on a valid basis.

B. The CCA must actively validate the scope against CMMC requirements, not just passively accept the OSC's proposal. This includes verifying the ESP's compliance.

C. This is premature consultative advice. The CCA's primary duty is to first verify the current ESP's certification status, not recommend a business change.

D. A self-assessment is insufficient for a Level 2 assessment. The ESP must have a formal CMMC certification from a C3PAO, not just a self-attestation.

---

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2, Version 5.1.1, July 2023.

Section 3.4.3, External Service Providers (ESPs), Page 16: "If the OSC uses an External Service Provider (ESP) (e.g., Managed Service Provider (MSP) or Managed Security Service Provider (MSSP)) to manage its CUI environment, the ESP must have a CMMC certification at the same or higher level as the OSC."

2. CMMC Scoping Guide: Level 2, Version 2.1, December 2023.

Section 2.4.3, External Service Provider (ESP) Systems, Page 10: This section details how ESP systems that process, store, or transmit CUI are considered in-scope for the CMMC assessment, reinforcing the need for them to meet CMMC requirements. It clarifies that the responsibility for protection remains with the OSC, necessitating verification of the ESP's compliance.

The core requirement of practice AC.L2-3.1.14 is to ensure that all remote connections are channeled through specific, managed, and controlled entry points before accessing the internal network where CUI resides. This prevents unauthorized or unmanaged pathways into the secure environment. The assessment objective for this practice, as defined by the CMMC Level 2 Assessment Guide, is to determine if the organization has (a) identified, (b) implemented, and (c) routed remote access through these managed access control points. Option B is the only choice that comprehensively covers all three of these essential determination criteria for the practice.

A. The contractor manages access control points: This is only one part of the requirement. The practice also requires that these points are identified and that all remote traffic is actively routed through them.

C. All remote access is monitored: While monitoring is a good security practice often implemented at access control points, it is a separate requirement covered by the Audit and Accountability (AU) domain, not AC.L2-3.1.14.

D. All users are authenticated before being granted remote access: Authentication is a fundamental security principle but is addressed by other practices, such as those in the Identification and Authentication (IA) domain (e.g., IA.L1-3.5.2).

1. Cybersecurity Maturity Model Certification (CMMC) CMMC Level 2 Assessment Guide, Version 2.0 (December 2021).

Reference: Page 31, Practice AC.L2-3.1.14, Assessment Objectives.

Content: The guide explicitly lists the assessment objectives as: "[a] managed access control points are identified; [b] managed access control points are implemented; and [c] remote access is routed through the managed network access control points." This directly corresponds to the correct answer.

2. NIST Special Publication (SP) 800-171, Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Reference: Page 17, Section 3.1, Control 3.1.14.

Content: The control states, "Route remote access through managed access control points." The discussion clarifies that these points (e.g., firewalls, VPN gateways) are used to direct traffic flow and protect internal networks, reinforcing the focus on routing and management.

3. NIST Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information.

Reference: Page 2-21, Control 3.1.14, Assessment Objectives.

Content: This document, which provides the methodology for assessing NIST SP 800-171 controls, lists the objectives for this control as determining if "managed access control points are identified" and "remote access is routed through the managed access control points," which aligns with the CMMC guide and the correct answer.

The CMMC assessment scope is not limited to an OSC’s on-premises assets; it extends to any system that processes, stores, or transmits Controlled Unclassified Information (CUI), including those managed by an External Service Provider (ESP) like an MSP. The OSC remains responsible for ensuring that CUI is protected in accordance with CMMC requirements. The primary challenge for the assessor in this scenario is the limited visibility into the MSP's environment, which directly impedes the ability to gather sufficient objective evidence that controls for external connections (e.g., AC.L1-3.1.20) are effectively implemented. A Service Level Agreement (SLA) is contractual and may not provide the granular detail or verifiable proof of implementation required for an assessment.

A. Using a web browser is a common method for external connection; it does not negate the need for security evaluation but rather necessitates it, focusing on aspects like encryption and authentication.

C. The CMMC assessment boundary is dictated by the flow and location of CUI, not physical network perimeters. External cloud services handling CUI are explicitly in scope.

D. Employee training is a separate CMMC practice area. The core challenge presented in the scenario is the technical verification of controls within an external, third-party environment.

1. Cybersecurity Maturity Model Certification (CMMC) Scoping Guide, Level 2, Version 2.0 (December 21, 2021): Section 2.4, "External Service Providers (ESPs)," states, "The OSC is responsible for the protection of CUI that is processed, stored, or transmitted by an ESP... The OSC must be able to provide evidence to the C3PAO that the ESP meets the CMMC requirements..." This highlights the OSC's responsibility and the need for assessors to get evidence from the ESP environment.

2. NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" (February 2020): Requirement 3.1.20, "Control connections to and use of external information systems," directly applies. The discussion notes emphasize managing the risks from such connections, which is precisely what the assessor must verify. Limited visibility hinders this verification.

3. CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1 (March 20, 2023): Section 3.4, "Evidence," details that assessors must collect "sufficient" and "appropriate" evidence. It specifies that evidence must be "factual (i.e., objective)." An SLA alone is typically insufficient objective evidence of a control's implementation and effectiveness.

The requirement for displaying privacy and security notices is defined by CMMC Level 2 practice AC.L2-3.1.9, which is derived from NIST SP 800-171. The discussion for the corresponding NIST control (3.1.9) clarifies that notices must be placed on "system entry points" and "on any system component that provides user access."

A "system entry point" refers to the initial system logon. A "system component that provides user access" includes specific applications, databases, or file shares that contain CUI. Therefore, displaying the notice at both initial logon and upon accessing specific CUI-related resources is the most comprehensive and correct implementation, ensuring users are consistently aware of their responsibilities at relevant access points.

A. This is insufficient because it omits the requirement to display notices on other system components that provide user access beyond the initial logon.

C. This is overly restrictive; the notice requirement applies to all systems processing any category of CUI, not just export-controlled technical data.

D. While a persistent banner is a valid implementation method, the core requirement is about displaying notices at points of access, not necessarily continuously.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-171 Rev. 2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. Section 3.1.9, Access Control, Discussion. The text states, "Notices are placed on system entry points and on any system component that provides user access."

2. U.S. Department of Defense (DoD). (2021). Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0. Practice AC.L2-3.1.9, "Provide privacy and security notices consistent with applicable CUI rules."

3. National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. Control AC-8, System Use Notification. This foundational control specifies displaying a notice "before granting access to the system."

The CMMC assessment scope is not limited to the organizational unit directly handling Controlled Unclassified Information (CUI). It must also include any assets or services that provide security protection for the CUI environment. In this scenario, the Manufacturing Division processes, stores, or transmits CUI, making it the primary focus. However, because the centralized IT department performs administrative tasks for this division, its systems and personnel are considered "Security Protection Assets" (SPAs). According to official CMMC scoping guidance, both CUI assets and SPAs are within the assessment boundary. Therefore, both the Manufacturing Division and the supporting centralized IT department must be assessed.

A. The Manufacturing Division: This is incorrect because it omits the centralized IT department, whose administrative functions are essential for securing the CUI environment and are therefore considered in-scope as Security Protection Assets.

B. The centralized IT department: This is incorrect because the IT department only provides supporting functions. The primary CUI assets, which are the main subject of the assessment, reside within the Manufacturing Division.

D. The entire aerospace company: This is incorrect because CMMC allows for the assessment scope to be tailored to a specific enclave or segment. Assessing the entire company is unnecessary if other divisions do not handle CUI for the contract.

1. U.S. Department of Defense (DoD), Office of the Under Secretary of Defense for Acquisition & Sustainment. (December 2021). CMMC Scoping Guide: CMMC Level 2. Version 2.0.

Page 4, Section 2.2, "Asset Categories": This section explicitly states, "The CMMC Assessment Scope includes CUI assets and Security Protection Assets."

Page 5, "Security Protection Assets (SPAs)": This page defines SPAs as "Assets that provide security functions or services to the CMMC Assessment Scope... Examples of SPAs can include... systems that provide security services (e.g., authentication, authorization, malware protection, security event monitoring/logging)." The centralized IT department's administrative tasks fall under this definition.

2. U.S. Department of Defense (DoD), Office of the Under Secretary of Defense for Acquisition & Sustainment. (November 2021). CMMC Model Overview. Version 2.0.

Page 5, "Scoping": This document notes that scoping is a critical activity and directs organizations to the official scoping guides to determine the "people, technology, and facilities" that are part of the assessment, reinforcing that the boundary extends beyond just the direct CUI environment.

The Freedom of Information Act (FOIA) applies exclusively to federal government agencies, not to private entities like a Certified Third-Party Assessment Organization (C3PAO). The CMMC assessment results are the confidential and proprietary information of the Organization Seeking Certification (OSC). The C3PAO and its assessors are bound by non-disclosure agreements (NDAs) with the OSC and the Cyber AB Code of Professional Conduct, which mandates the protection of client information. Releasing any assessment information would be a breach of these legal and ethical obligations. Therefore, the C3PAO has no legal standing to fulfill the FOIA request and must deny it to protect the OSC's sensitive data.

A. Releasing a redacted version is incorrect because the C3PAO is not subject to FOIA and has a primary duty to maintain the OSC's confidentiality.

B. The Cyber AB is also a private, non-profit organization, not a federal agency, and therefore is not the correct authority to adjudicate a FOIA request.

C. Releasing the full results would be a severe violation of the C3PAO's contractual and ethical obligations to the OSC, exposing sensitive security information.

1. U.S. Department of Justice, Guide to the Freedom of Information Act, "Agencies Subject to the FOIA" section (2022). This guide explicitly states that FOIA's disclosure requirements apply to federal executive branch agencies. It clarifies that private organizations, such as C3PAOs, are not subject to FOIA requests.

2. The Cyber AB, Code of Professional Conduct, Version 2.1 (December 2022), Section 2.1 "Confidentiality". This section states, "Cyber AB credentialed individuals shall not disclose any confidential or proprietary information entrusted to them in the course of their professional duties, unless disclosure is required by law or authorized by the information owner." Since FOIA does not apply, disclosure is not required by law, and the C3PAO must protect the information.

3. Department of Defense, 32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program, § 170.16 "Information sharing and protection" (Proposed Rule, Dec 26, 2023). This rule specifies that "CMMC Assessment information is the proprietary information of the OSC" and outlines strict procedures for protecting and sharing this information, reinforcing that it is not public data. The C3PAO's role is to protect this information, not disclose it.

The scenario describes a situation where a contractor has a documented Plan of Action and Milestones (POA&M) but fails in its execution. The CMMC practice CA.L2-3.12.2 requires organizations to both "Develop and implement plans of action." The contractor has successfully developed the plan, as evidenced by the documented POA&M. However, the statement that "remediating measures are not always taken, and when taken, they are not always practical" points to a direct failure in the implementation phase. This directly violates the assessment objective that requires the developed plan of action to be effectively implemented to correct deficiencies and reduce vulnerabilities.

A. This is incorrect because the scenario explicitly details a failure to consistently and practically execute the remediation measures, which is a core part of the practice.

B. This is incorrect because a change management plan is associated with the Configuration Management (CM) domain (e.g., CM.L2-3.4.1), not the Security Assessment (CA) domain's POA&M practice.

D. This is incorrect because the scenario states the contractor "documents specific vulnerabilities and deficiencies in an audit report" and has a POA&M, indicating this objective has been met.

---

1. U.S. Department of Defense (DoD), CMMC Model Version 2.0, CMMC Level 2 Assessment Guide (December 2021).

Reference: Page 151, Practice CA.L2-3.12.2, Assessment Objectives.

Content: This guide specifies the assessment objectives for CA.L2-3.12.2, which are derived from NIST SP 800-171. The objectives include "[a] A plan of action is developed to correct deficiencies," "[b] A plan of action is developed to reduce or eliminate vulnerabilities," and "[c] The plan of action is implemented." The scenario clearly shows a failure in objective [c].

2. National Institute of Standards and Technology (NIST), Special Publication (SP) 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (February 2020).

Reference: Page 26, Section 3.12.2.

Content: This document is the source for the CMMC Level 2 requirement. It states, "Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems." The dual requirement of "develop" and "implement" is foundational.

3. National Institute of Standards and Technology (NIST), Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information (June 2018).

Reference: Page 101, Section 3.12.2, Assessment Procedures.

Content: This guide provides procedures for assessing the implementation of NIST SP 800-171 controls. For 3.12.2, it specifies checking if "b. the plan of action is implemented." The evidence in the scenario demonstrates this procedure would result in a "not met" finding.

The CMMC assessment process mandates a clearly defined and validated scope prior to the conduct phase. When an Assessment Team member discovers that critical documentation, like a network diagram, is ambiguous and fails to clearly delineate the CUI environment boundary, it directly impacts scope validation. The correct professional procedure is to escalate this finding to the Lead Assessor. The Lead Assessor holds the responsibility for all official communication with the Organization Seeking Certification (OSC). They will formally request the necessary clarification and revised documentation from the OSC to ensure the assessment scope is mutually understood and accurately defined before proceeding. This prevents scope creep and ensures a valid and reliable assessment.

A. Proceeding with an unclear scope violates the fundamental principles of the CMMC assessment process, which requires a well-defined and agreed-upon assessment boundary before the conduct phase.

C. Recommending specific solutions, such as hiring a specialist, constitutes consulting. The Assessment Team's role is to assess against the standard, not to provide advisory services.

D. The assessment scope must be finalized during the planning phase. Adjusting the scope during the assessment conduct phase is improper, inefficient, and can invalidate the assessment results.

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2, Version 1.0, The Cyber AB, December 2022.

Section 3.1, Phase 1: Plan and Prepare the Assessment, Activity 1.4 Validate Assessment Scope: This section details that the C3PAO must validate the OSC’s defined scope. An unclear network diagram prevents proper validation, necessitating a request for clarification, which is managed by the Lead Assessor as the primary point of contact.

2. U.S. Department of Defense, CMMC Scoping Guide, Level 2, Version 2.0, December 2021.

Section 2.2, Documenting the Scope: This guide states, "The OSC must document the scope of the CMMC assessment in the SSP... The OSC should also have a network diagram of the assessment scope that clearly shows the assessment boundary." The failure of the diagram to clearly delineate boundaries is a failure to meet this documentation expectation, which the Assessment Team must address.

3. Carnegie Mellon University, Software Engineering Institute, "The Certified CMMC Professional (CCP) and Certified CMMC Assessor (CCA) Roles," CMMC-AB/CMMC-COE Training Material Outline.

Courseware outlines for CCA certification emphasize the distinct roles within the assessment team. They specify that the Lead Assessor is responsible for managing the assessment, including all formal communications with the OSC regarding planning, scoping, and evidence requests. Team members are expected to report issues internally to the Lead Assessor.

The scenario describes a compromise of assessor objectivity due to a positive bias, often referred to as the "halo effect." This bias causes the assessor to be less critical and "hesitant to identify deficiencies." Such a mindset directly undermines the core principles of a CMMC assessment, which demand impartiality and a rigorous evaluation based on objective evidence. A favorable predisposition towards the Organization Seeking Certification (OSC) will lead to an assessment that is not sufficiently thorough, potentially overlooking non-compliant practices. This results in a lenient and, therefore, inaccurate conclusion about the OSC's true cybersecurity posture, compromising the integrity of the CMMC certification.

A: Assessor bias is a critical concern in CMMC assessments, as objectivity and impartiality are fundamental tenets of the Cyber AB Code of Professional Conduct.

B: A positive bias leads to a less rigorous and thorough evaluation because the assessor is predisposed to overlook or minimize potential deficiencies.

C: Bias directly and negatively affects the assessment process by skewing judgment and the collection of objective evidence, thereby altering the outcome.

1. Cyber AB Code of Professional Conduct (CoPC), Version 2.1 (June 28, 2023):

Section 3.1, Independence and Objectivity: "Act with independence and objectivity in all professional engagements. Certified Professionals shall not offer or render any professional services that would impair their independence or objectivity." The assessor's positive bias is a direct violation of this principle, leading to an inaccurate assessment.

Section 2.2, Due Care: "Exercise due professional care in the performance of professional services." A lenient assessment resulting from bias is a failure to exercise due care.

2. ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements: C3PAOs are accredited to this standard, which underpins the CMMC assessment ecosystem.

Section 4.2.1: "Certification activities shall be undertaken impartially."

Section 4.2.3: This section identifies threats to impartiality, including the "familiarity threat," which is "the threat that arises from a person or body being too familiar with or trusting of another person instead of seeking audit evidence." The assessor's admiration and trust in the OSC's capabilities is a form of this threat, leading to a lenient outcome.

3. CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0 (December 2023):

Section 4.1, Conduct Assessment: This section details the requirement for the assessment team to "collect and review objective evidence (OE) to determine if each practice and assessment objective is MET or NOT MET." A biased assessment (D) is inherently not based on a complete and impartial review of objective evidence.

The Lead Assessor's primary responsibility is to ensure the integrity and accuracy of the entire assessment, which includes the validity of any resulting Plan of Action and Milestones (POA&M). A POA&M remediation action that negatively impacts an already compliant practice introduces a new deficiency. This negates the purpose of the POA&M, which is to improve the organization's overall cybersecurity posture. The assessor must address this conflict directly with the Organization Seeking Certification (OSC). Requesting a revision of the specific problematic action is the most appropriate, constructive, and professionally responsible course of action to ensure the final POA&M is viable and does not degrade security.

A. Allowing a known issue that degrades a security control to proceed is a failure of the assessor's due diligence and compromises the integrity of the CMMC assessment.

B. The technical validity and impact of a proposed remediation action are more critical than its timeline; accepting a flawed plan that introduces new risks is unacceptable.

D. Rejecting the entire POA&M is an overly broad response for a single identified issue. A more targeted request for revision is the appropriate and collaborative first step.

1. The Cyber AB, CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0, December 2023.

Section 5.5, "Conduct Daily Checkpoints," and Section 5.6, "Conduct Out-brief," describe the iterative and collaborative communication process between the Assessment Team and the OSC. These interactions are designed to clarify findings and ensure mutual understanding. Identifying a flaw in a draft POA&M and requesting a revision aligns perfectly with this prescribed collaborative process. The assessor's role is to ensure the final assessment package is accurate, which includes a valid POA&M.

2. U.S. Department of Defense, CMMC Program, Level 2 Assessment Guide, November 2021.

The foundational principle of the assessment guide is to determine if each CMMC practice is satisfied. A POA&M action that would cause a previously 'MET' practice to become 'NOT MET' is counter-productive to the goal of CMMC. The assessor must ensure the OSC's plan for remediation leads to a net-positive security outcome, not a redistribution of non-compliance. The assessor's final attestation relies on the validity of the entire assessment picture, including the POA&M.

The Department of Defense (DoD) CIO memo on FedRAMP equivalency, dated June 8, 2022, mandates that for a Cloud Service Offering (CSO) to be considered "FedRAMP Moderate equivalent," it must achieve 100% compliance with the FedRAMP Moderate security control baseline. The existence of an open Plan of Action and Milestones (POA&M) signifies that there are unresolved security findings. Therefore, the CSO has not met the mandatory 100% compliance threshold. This failure to meet the baseline is the primary regulatory reason the contractor is prohibited from using the service for Covered Defense Information (CDI) under DFARS 252.204-7012.

A. The open POA&Ms are the evidence of non-compliance, but the fundamental reason is the failure to meet the 100% compliance standard defined by the DoD.

B. DFARS 252.204-7019 concerns NIST SP 800-171 assessment score reporting, not the security requirements for cloud services, which are specified in DFARS 252.204-7012.

C. A Joint Authorization Board (JAB) Provisional Authorization to Operate (P-ATO) is not required for equivalency; the requirement is meeting the baseline, which can be verified by a 3PAO.

1. U.S. Department of Defense, Office of the Chief Information Officer. (2022, June 8). Memorandum for Senior Pentagon Leadership; Commanders of the Combatant Commands; Defense Agency and DoD Field Activity Directors: Department of Defense Guidance for the Use of Cloud Computing Services that are FedRAMP Authorized or FedRAMP Equivalent. Section: "FedRAMP Moderate Equivalent," Page 2. This memo states, "To be considered FedRAMP Moderate equivalent, a CSP's CSO must achieve 100 percent compliance with the latest FedRAMP Moderate security control baseline... The CSP must have a Plan of Action and Milestones (POA&M) that documents and tracks all findings, and the CSP must have closed out all findings."

2. Defense Federal Acquisition Regulation Supplement (DFARS). (2023). 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. Paragraph (b)(2)(ii)(D). This clause requires that when using an external cloud service provider for CDI, the provider must meet security requirements "equivalent to those established by the Government for the FedRAMP Moderate baseline."

3. Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0. (2021, November). CMMC Level 2 (Advanced). The CMMC Level 2 requirements are aligned with NIST SP 800-171, the foundation of the DFARS 252.204-7012 clause, which in turn mandates FedRAMP equivalency for cloud services handling CDI.

According to the CMMC Assessment Process (CAP), evidence is considered sufficient only when it is adequate in quantity and scope to support a definitive assessment finding (i.e., Met or Not Met). In this scenario, the collected evidence, while potentially valid for the HR system, does not cover other critical, in-scope systems like the Engineering Design Database and Manufacturing Control System. Because the evidence fails to address the full scope of the access control practice's implementation across the organization's CUI environment, it is quantitatively lacking. Therefore, the evidence collected so far is insufficient to make a final determination for the practice.

A. Valid but incomplete: While the evidence for the HR system may be valid, "insufficient" is the formal CMMC assessment term describing a lack of evidence quantity and scope coverage needed to make a finding.

B. Sufficient: This is incorrect because evidence is completely missing for multiple in-scope systems, failing to meet the requirement for comprehensive coverage across the CMMC Assessment Scope.

D. Inconclusive: This term is used when collected evidence is conflicting, ambiguous, or contradictory. The issue here is a clear lack of evidence for parts of the scope, not a conflict within the evidence.

---

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2, Version 1.0, October 2023.

Section 3.5, Conducting the Assessment, Page 12: States, "The Assessment Team must collect sufficient evidence to support their determination for each practice." This implies that evidence must cover the entire scope of the practice's implementation to be deemed sufficient.

Section 3.6, Determining Findings, Page 13: Explains that findings are based on the "sufficiency of the objective evidence." A finding of "Met" requires that the practice is "fully implemented." Without evidence from all in-scope systems, the assessor cannot confirm full implementation, rendering the current evidence insufficient.

2. CMMC Model Overview Version 2.0, December 2021.

Section: CMMC Assessment, Page 5: This document establishes that assessments are conducted to "verify the implementation of cybersecurity requirements." Verification requires evidence covering all areas where the requirements (practices) apply, which in the scenario includes all in-scope systems handling CUI.

The scenario describes a tangible room with physical access controls (a door with a CAC card scanner). In cybersecurity and information assurance frameworks like NIST SP 800-53 and CMMC, a location defined by geographic space and protected by physical barriers is classified as a physical location. The controls mentioned—a secure room and card-based entry—are fundamental components of the Physical and Environmental Protection (PE) control family, which governs access to such locations to safeguard information systems and assets contained within them.

A. Printer location: This is a functional description of the room's purpose, not a formal security classification used in access control terminology.

B. Logical location: This refers to a non-physical, virtual space within a system, such as a network folder, database, or cloud storage location.

C. Industrial location: This describes the general type of facility (e.g., a factory or plant) but is not the specific term for a controlled security area.

1. NIST Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations. The entire Physical and Environmental Protection (PE) control family is predicated on the concept of physical locations. Control PE-3, "Physical Access Control," explicitly discusses measures to "control physical access to systems and the facilities in which the systems reside." The room described is a "facility."

Reference: Section 2, Control Family: Physical and Environmental Protection (PE), Page 199.

2. NIST Special Publication 800-171, Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. This document, which forms the basis for CMMC Level 2, specifies requirements for physical protection.

Reference: Section 3.10, Physical Protection, Requirement 3.10.1 states, "Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals." The printer room is a prime example of such an "operating environment."

3. CMMC Model Version 2.0, CMMC Level 2 Assessment Guide. The assessment objectives for practice PE.L2-3.10.1 directly address the verification of physical access controls.

Reference: Page 138, Assessment Objectives for PE.L2-3.10.1, [a], "physical access to organizational systems, equipment, and the respective operating environments is limited to authorized individuals." The assessment would involve examining the controls for the physical room.

The scenario describes a hybrid architecture. The web application, hosted by a third-party vendor and accessed over the internet, represents a logical location from the Organization Seeking Certification (OSC) perspective. The OSC interacts with the application's interface, not its physical hardware. Conversely, the document storage servers are explicitly stated to be maintained "within its network," which constitutes a physical location under the OSC's direct or indirect control. The employee's action of uploading a document requires interaction with both the logical application front-end and the physical storage back-end.

B. A secure area within the OSC’s data center: This is incomplete as it only addresses the document storage servers and completely ignores the externally hosted web application.

C. The physical location of their internet-connected devices: This is incorrect because it focuses on the user's endpoint device, not the system components (application and storage) that are the subject of the interaction.

D. The physical location of the vendor’s data center: This is incomplete as it only addresses the web application's location and ignores the OSC's internal servers used for document storage.

---

1. Cybersecurity Maturity Model Certification (CMMC) Level 2 Scoping Guide, Version 2.0 (December 2021).

Section 2.3, "Categorization of Assets," and Section 2.4, "Scoping of External Service Providers (ESPs)": This guide establishes the framework for identifying and categorizing assets within an assessment scope. The OSC's servers are "CUI Assets" within their physical or logical boundary. The vendor's web application is an asset managed by an External Service Provider (ESP), which is treated as a distinct logical component that processes, stores, or transmits CUI. The interaction described involves both asset types.

2. CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.0 (December 2021).

Section 2.3, "Scoping": This section details that the assessment scope must be defined by identifying "all CMMC assets that will be assessed." It clarifies that the scope boundary includes physical facilities, system components, and networks. This supports the distinction between the physical location of the OSC's servers and the logical nature of the external web application service.

The CMMC Code of Professional Conduct (CoPC) mandates that all certified professionals maintain objectivity and impartiality. Alex's behavior suggests a potential cognitive bias (e.g., confirmation bias) stemming from a past negative experience, which compromises the integrity of the assessment. The C3PAO, as the accredited organization, has an overarching responsibility to ensure the quality and objectivity of its assessments. This requires implementing a systemic program to proactively identify, manage, and mitigate potential assessor biases through training, internal policies, and oversight. Relying solely on a Lead Assessor to reactively manage bias during an assessment is insufficient; prevention is a key organizational responsibility.

A. Avoid working with assessors who have previous experience with the OSC

This is an overly broad and impractical policy that fails to distinguish between unbiased professional experience and a conflict of interest or bias.

B. Rely on the Lead Assessor to mitigate any potential bias

This is a reactive measure. The question asks for preventive steps, which are an organizational responsibility of the C3PAO, not just a real-time task for the Lead Assessor.

C. Undergo additional training in the CMMC requirements

The issue described is not a lack of technical knowledge regarding CMMC practices but a behavioral problem related to professional judgment and objectivity.

1. The Cyber AB, CMMC Code of Professional Conduct (CoPC) Version 1.1, November 2021.

Canon 2, Section 2.2: "Maintain objectivity and impartiality in all professional activities. Avoid any activity that creates or gives the appearance of a conflict of interest." This canon directly establishes the professional obligation to manage bias.

2. ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements. (The foundational standard for C3PAO accreditation).

Section 5.2, "Managing impartiality": This section requires certification bodies (like C3PAOs) to identify risks to their impartiality on an ongoing basis. It states, "The certification body shall have a process to identify, analyze, evaluate, treat, monitor, and document the risks related to conflict of interests...arising from provision of certification including any conflicts arising from its relationships." This includes managing biases of its personnel.

3. Carnegie Mellon University, Software Engineering Institute, Diagnosing and Mitigating Cognitive Biases in Threat Analysis (CMU/SEI-2021-TR-003), April 2021.

Section 3.1, page 10: Discusses confirmation bias, where analysts "seek, interpret, and recall information that confirms their preexisting beliefs." This academic source explains the underlying psychological mechanism of Alex's behavior, reinforcing the need for formal processes to manage such biases in assessment and analysis environments. (DOI: https://doi.org/10.1184/R1/14478810.v1)

The scenario describes using a distinct IP subnet (192.168.50.0/24) to create a separate network segment for the engineering department. This practice is a form of logical separation. While the servers share a physical location, network controls like firewalls, Access Control Lists (ACLs), and Virtual Local Area Networks (VLANs) are configured to enforce boundaries. These configurations restrict traffic flow between the engineering segment and other parts of the network, thereby creating logical isolation for the engineering resources. This directly aligns with the CMMC practice of controlling information flow.

B. Physical barriers within the data center: This is incorrect because the question explicitly states the servers are in a shared data center and isolated logically, not through physical means like separate cages or rooms.

C. Encryption of engineering data at rest: This is incorrect because encryption protects the confidentiality of data on storage media. It does not create network-level isolation or control traffic flow between network segments.

D. Requirement of a security badge to access the data center: This is a physical access control for the entire facility. It does not segment the network or create logical isolation for a specific department's digital resources.

---

1. NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations."

Section 3.1, Access Control, Control 3.1.3: The discussion for this control, which requires controlling the flow of CUI, states that flow control is achieved by "separating CUI into separate subnets with firewalls or other boundary protection devices." This directly supports the concept of using network segmentation (subnets) for logical separation.

Section 3.13, System and Communications Protection, Control 3.13.1: The discussion mentions that access control policies can be implemented at "the operating system, and network levels (e.g., through the use of access control lists in routers and firewalls and separate subnets for CUI)." This explicitly links subnets to network-level access control and isolation.

2. NIST Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Control SC-7, Boundary Protection: The discussion section for this control states, "Boundaries can be physical (e.g., controlled physical perimeters) or logical (e.g., virtual private networks, VLANs, or network firewalls)." It further elaborates on establishing boundaries for "publicly accessible systems, demilitarized zones, and systems containing CUI." This source clearly defines the use of network configurations to create logical boundaries.

3. CMMC Model Version 2.0, "Cybersecurity Maturity Model Certification (CMMC) Model," December 2021.

Practice AC.L2-3.1.3 (Control the flow of CUI): The description for this practice involves implementing security mechanisms to manage and control how CUI flows through the network. The primary method for achieving this is through logical segmentation using tools like firewalls and routers to create isolated network segments, as described in the question's scenario.