CMMC-CCA Practice Questions

A documented procedure for supervised maintenance should focus on the process and controls for the activity itself. It must define the scope of authorized actions for the maintenance personnel (B), provide emergency contacts for incident response (C), and detail how the supervision will be conducted and monitored (D). Including a detailed list of all CUI assets (A) is inappropriate for a procedural document. This information is an asset inventory, not a process step. Including it would create an unnecessary security risk by aggregating sensitive location information into a document that may have wider distribution than the asset inventory itself.

B. The specific steps authorized for the visiting maintenance personnel with limited access: This is essential for the procedure, as it defines the boundaries of the work and what the supervisor must enforce.

C. Contact information for the organization's IT security team in case of emergencies or unexpected issues: This is a critical component for any IT procedure, ensuring a clear path for incident escalation and response.

D. The method used to authenticate and monitor the supervisor's activity during the maintenance session: This ensures accountability and that the supervision itself is being performed correctly and can be audited if necessary.

---

1. NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Section 3.7.6, Page 21: The control states, "Supervise maintenance activities of personnel without required access authorization." The discussion notes emphasize controlling access, which is achieved through procedural steps, not by listing the data that requires protection within the procedure itself. The focus is on the actions of personnel.

2. CMMC Model Version 2.0, CMMC Level 2 Practices.

Practice MA.L2-3.7.6, Page 45: This practice is directly derived from NIST SP 800-171 3.7.6. The requirement is to supervise the activities. A procedure, therefore, must define the rules and steps for that supervision, not provide a data inventory.

3. NIST SP 800-171A, Assessing Security Requirements for CUI.

Section 3.7.6, Assessment Procedures, Page 68: The assessment objectives focus on determining if procedures for supervision are defined and if personnel are supervised. The potential assessment methods include examining "procedures addressing the supervision of maintenance personnel." This confirms the expected evidence is a document outlining a process, not an asset list.

According to the CMMC Assessment Process (CAP), a practice is scored based on its implementation status at the time of the assessment. A Plan of Action & Milestones (POA&M) is a document used to track planned measures to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. The very existence of a POA&M for a specific practice, such as CM.L2-3.4.2, is an explicit acknowledgment by the organization that the practice is not currently fulfilled. Therefore, during a CMMC assessment, any practice being tracked in a POA&M must be scored as "NOT MET." The organization has a plan to fix it, but it is not fixed at the time of evaluation.

B. Need more information to score this practice: The presence of a POA&M for the practice is sufficient and definitive information to assign a "NOT MET" score according to the CMMC Assessment Process.

C. Met: A practice cannot be scored as "Met" if it has a documented deficiency that requires a POA&M for remediation. The two states are mutually exclusive.

D. Not Applicable: This practice, which involves enforcing security configurations, is fundamental to system security and is clearly applicable to an organization managing computer systems and networks.

---

1. CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.0.

Reference: Section 4.3, "Scoring," and Section 5.3, "Final Findings." The CAP specifies that for a CMMC Level 2 Certification Assessment, all applicable practices must be scored as "MET." A practice with a POA&M is, by definition, not fully implemented and thus scored as "NOT MET." The POA&M outlines the path to achieving a "MET" status in the future.

2. NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations."

Reference: Section 3.4, "Configuration Management," Requirement 3.4.2. This is the source requirement for CMMC's CM.L2-3.4.2. The discussion section notes that organizations can use various sources for security configuration settings. However, the assessment question hinges on the scoring process, where a POA&M indicates a failure to meet the requirement, regardless of the chosen configuration source.

3. CMMC Model, Version 2.0.

Reference: Domain: Configuration Management (CM), Practice: CM.L2-3.4.2. The model defines the requirement to "Establish and enforce security configuration settings for information technology products employed in organizational systems." The scoring is governed by the CAP, which treats items on a POA&M as "NOT MET."

The Certification Assessment Readiness Review (CA-RR) is a procedural milestone focused on the operational readiness to conduct the CMMC assessment. Its purpose is to confirm that both the Organization Seeking Certification (OSC) and the Assessment Team have all necessary resources, schedules, and logistical arrangements in place. It also addresses any risks that could impede the assessment process itself. The CA-RR is not the assessment; it does not involve evaluating the OSC's implementation of security controls or determining their actual cybersecurity posture. That evaluation is the objective of the assessment that follows the CA-RR.

B. Assessment readiness: This is incorrect because the primary purpose of the CA-RR is to determine and confirm the overall readiness of all parties to proceed with the assessment.

C. Assessment risk status: This is incorrect because the CA-RR explicitly involves identifying and mitigating risks that could negatively impact the successful and timely execution of the assessment.

D. Logistics: This is incorrect because verifying logistical arrangements, such as travel, site access, and availability of personnel and resources, is a core component of the CA-RR.

---

1. The Cyber AB. (2023). CMMC Assessment Process (CAP) for Level 2, Version 1.0. Section 3.3.2, "Conduct Certification Assessment Readiness Review (CA-RR)," Page 16. This section explicitly states, "The CA-RR addresses all aspects of readiness to conduct the assessment, including but not limited to: assessment readiness, assessment risk status, and logistics." It makes no mention of evaluating the OSC's cybersecurity posture.

The CMMC Assessment Process (CAP) is structured into four distinct phases. Phase 1, "Plan and Prepare for the Assessment," involves initial scoping, readiness reviews, and logistical planning. During this phase, the Assessor uses the CMMC Pre-Assessment Form Data Template, the CMMC Assessment Readiness Review (CA-RR) Checklist, and, if applicable, the Virtual Assessment Evidence Preparation Template. The CMMC Assessment Quality Review Checklist, however, is not used until Phase 4, "Assessment Closeout." This final phase requires the C3PAO to conduct a thorough quality review of the entire assessment package before submission, ensuring all documentation is complete and accurate.

B. CMMC Assessment Readiness Review (CA-RR) Checklist: This is a key document for Phase 1, used to verify that the Organization Seeking Certification (OSC) is prepared for the formal assessment to begin.

C. Virtual Assessment Evidence Preparation Template: This template is used during Phase 1 planning to guide the OSC in organizing and preparing evidence specifically for a remote or virtual assessment.

D. CMMC Pre-Assessment Form Data Template: This is one of the initial documents completed in Phase 1 to gather foundational data about the OSC and define the assessment scope.

1. Cybersecurity Maturity Model Certification (CMMC) Program, CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1, The Cyber AB, December 21, 2023.

Section 3.1, Phase 1: Plan and Prepare for the Assessment: This section details the activities and required documentation for the initial phase, including the CMMC Pre-Assessment Form Data Template (p. 11), the CMMC Assessment Readiness Review (p. 12), and planning for evidence collection which would include the virtual template if applicable.

Section 3.4, Phase 4: Assessment Closeout: This section explicitly states that the C3PAO must "Conduct a quality review of the assessment package" (p. 20), which is the function of the CMMC Assessment Quality Review Checklist.

The scenario describes a session lock activating after a specific period of user inactivity (5 minutes). This aligns directly with CMMC requirements, which are based on NIST SP 800-171. The primary purpose of this control is to automatically prevent unauthorized access to an unattended system after a defined period has elapsed without user interaction. The automatic, time-based initiation is the key mechanism for enforcing this security policy consistently, as described in the question's details.

B: Administrator-initiated locks are for specific administrative or security incidents, not the typical method for handling user inactivity.

C: Authentication is the process of verifying identity to gain access or unlock a session, not to initiate the lock itself.

D: While manual locking is a best practice, CMMC requires an automatic lock, making the "Only" in this option incorrect.

1. NIST Special Publication 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, December 2020. Security Requirement 3.1.11, Page 17, states: "Lock a session after a defined period of inactivity." The discussion notes this prevents unauthorized access to unattended systems.

2. Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0, December 2021. Practice AC.L2-3.1.11, Page 21, requires organizations to "Use session lock with an inactivity timeout." This directly implies an automatic, time-based initiation.

3. NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, September 2020. Control AC-11, "Session Lock," states the system "prevents further access to the system by initiating a session lock after a [Assignment: organization-defined time period] of inactivity." This specifies the trigger is a period of inactivity.

The C3PAO and its designated Lead Assessor are responsible for determining the appropriate size and composition of the assessment team based on the assessment's scope. The primary requirement is that the team collectively possesses the necessary competence and qualifications to assess all CMMC practices and objectives within that scope. If a team member becomes unavailable, the Lead Assessor must re-evaluate if the remaining members can still provide full and adequate coverage. If they can, and the OSC agrees to proceed, the assessment can continue. The decision is based on the team's capability, not a fixed roster, ensuring the integrity and validity of the assessment are maintained.

B. The Cyber AB accredits C3PAOs but does not micromanage the staffing of individual assessments. This operational responsibility is delegated to the C3PAO.

C. The OSC is the subject of the assessment and cannot dictate the terms of team composition. This is the C3PAO's responsibility to ensure an objective and valid assessment.

D. Postponement is a possible outcome if the remaining team is no longer sufficient, but it is not mandatory if the team's qualifications can still cover the entire scope.

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for Level 2, Version 2.1, Section 3.2.1, "Assessment Team Composition": This section states, "The C3PAO is responsible for determining the size and composition of the Assessment Team based on the assessment scope..." This establishes that the C3PAO has the authority and responsibility to ensure the team is adequate, implying they can adjust as needed, provided the team remains competent for the scope.

2. Cyber AB Code of Professional Conduct (CoPC) for CMMC Professionals, Version 2.1, Canon 1, "Responsibility to the Profession": This canon requires certified professionals to "Act with integrity, competence, diligence, and responsibility." A Lead Assessor proceeding with an under-qualified or under-staffed team would violate this principle. Therefore, the decision to proceed hinges on whether the remaining team is still competent to perform the assessment diligently.

3. CMMC Assessment Process (CAP) for Level 2, Version 2.1, Section 3.2.2, "Lead Assessor (LA)": This section outlines the LA's responsibilities, which include "Manages the Assessment Team and oversees the assessment activities." This management function includes ensuring the team is capable of executing the assessment plan, even if the original composition changes.

The Certified CMMC Assessor (CCA) upholds the principle of objectivity by refusing to provide a subjective opinion ("good enough") or engage in consulting. Instead, the CCA directs the Organization Seeking Certification (OSC) back to the objective, verifiable requirements of the CMMC standard. This action ensures that the assessor's judgment remains impartial, free from bias, and is based solely on the evidence presented against the established criteria, which is the core tenet of objectivity in an assessment context.

A. Confidentiality: This principle relates to protecting sensitive information from unauthorized disclosure, which is not the subject of this interaction.

B. Professionalism: While the response is professional, objectivity is the more specific and primary principle being demonstrated by avoiding a conflict of interest (consulting).

D. Information Integrity: This principle concerns providing accurate and truthful information, but the core of the CCA's response is about maintaining impartiality, not just the accuracy of the CMMC requirements.

---

1. Cyber AB, Code of Professional Conduct (CoPC), Version 2.1, June 28, 2022.

Canon 2: Objectivity (Page 3): "CMMC Professionals shall be objective and impartial in all professional matters. They shall not allow bias, conflict of interest, or the undue influence of others to override their professional judgments and responsibilities." The CCA's response directly avoids a conflict of interest by refraining from consulting.

2. Cyber AB, CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0, July 2023.

Section 2.3.1, C3PAO and Assessor Objectivity (Page 11): This section emphasizes that C3PAOs and their assessors must be free from conflicts of interest and maintain objectivity. Providing an opinion on whether a control is "good enough" constitutes consulting, which is a prohibited conflict of interest for an assessor during an assessment.

Under the CMMC 2.0 program, an Organization Seeking Certification (OSC) that receives a "CMMC Level 2 Conditional Certification" is permitted to have a Plan of Action & Milestones (POA&M) for certain non-critical, unmet practices. The OSC is granted a 180-day period, starting from the assessment's completion date, to remediate these items. Since the OSC submitted evidence of corrective actions at 170 days, they are within the allowed timeframe. The C3PAO is therefore able to proceed with a POA&M close-out assessment to verify that the remediation actions are complete and effective.

A. No, the 180-day window has closed.

This is factually incorrect. The submission at 170 days is within the 180-day period allowed for POA&M remediation.

B. No, the OSC must wait for the next assessment cycle.

This is incorrect. The POA&M close-out process is specifically designed to allow certification within the current cycle without requiring a full new assessment.

D. Yes, but the OSC must re-perform the entire CMMC L2 assessment.

This is incorrect. A close-out assessment is a limited-scope engagement focused solely on verifying the remediation of the specific items listed on the POA&M.

---

1. Title 32, Code of Federal Regulations, Part 170, "Cybersecurity Maturity Model Certification (CMMC) Program" (December 26, 2023).

§ 170.22(a): "An OSC that has been issued a CMMC Level 2 Conditional Certification Assessment must resolve all POA&M items within 180 calendar days of the assessment completion date identified in the final report." This confirms the 180-day window.

§ 170.22(c): "The C3PAO will conduct a POA&M closeout assessment to verify that all POA&M items have been resolved." This confirms the C3PAO's role in conducting the close-out.

2. The Cyber AB, CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1 (or latest version).

The CAP document outlines the procedural steps for a CMMC assessment. The section on POA&M Closeout details that the OSC has 180 days to submit evidence of remediation, after which the C3PAO conducts a closeout assessment to verify the evidence and convert a conditional certification to a final one. This process validates that a close-out assessment is the correct next step.

The highest priority in a formal assessment context, such as CMMC, is the comprehensive planning, risk management, and documentation of the methodology. This foundational step ensures that all aspects of the virtual data collection process are considered, structured, and defensible. It involves identifying the specific techniques to be used, proactively assessing the associated risks, defining appropriate mitigations (which include training and encryption), and establishing clear protocols for the management and protection of all sensitive information (CUI, FCI, and OSC proprietary data). This documented plan governs all subsequent activities, ensuring they are performed securely and consistently.

A. Training is a critical mitigation strategy, but it is a component of the overall risk management plan, not the primary overarching action.

C. Scheduling is a logistical and project management task; while important for smooth execution, it is not the highest security or compliance priority.

D. Encryption is a vital technical control for protecting data in transit, but it represents one specific mitigation within the broader, required risk management framework.

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2, Version 1.0, The Cyber AB, December 2022.

Section 2.3, Assessment Plan: This section details the requirement for a comprehensive Assessment Plan before the assessment begins. The plan must document the "detailed plan for the CMMC Assessment," which includes the methodology for evidence collection. A plan for virtual collection would inherently require documenting the techniques, associated risks, and how sensitive data will be protected, aligning directly with option B as the foundational step.

2. The Cyber AB Code of Professional Conduct (CoPC), Version 2.1, The Cyber AB, October 2022.

Principle 2, "Responsibility to the Profession": This principle requires certified professionals to "Perform all professional services and duties...with the due diligence and professional care required to protect the public trust." Formally documenting the virtual collection process, its risks, and mitigations (as described in option B) is a direct fulfillment of this requirement for due diligence and professional care.

3. NIST Special Publication 800-172A, Assessing Enhanced Security Requirements for Controlled Unclassified Information, February 2021.

Section 2.2, Assessment Planning: This document, which informs CMMC assessment methodology, emphasizes that "The first step in any assessment is planning... The assessment plan provides the roadmap for conducting the assessment." This reinforces that planning, which includes identifying methods, risks, and protections, is the highest priority action.

The question addresses the retention period for incident records for a Department of Defense (DoD) contractor, which is governed by the Defense Federal Acquisition Regulation Supplement (DFARS). While the scenario describes the implementation of CMMC practice IR.L2-3.6.2, the specific retention requirement flows down from DFARS Clause 252.204-7012. This clause mandates that when a contractor discovers a cyber incident, they must preserve and protect images of affected systems and all relevant monitoring data for at least 90 days from the submission of the incident report. This allows the DoD the opportunity to request the media for forensic analysis or to decline interest.

A. 72 hours: This is the maximum timeframe for reporting a cyber incident to the DoD Cyber Crime Center (DC3), not the data retention period.

C. 90 hours: This is an incorrect duration and does not align with any specific requirement in the DFARS clause or CMMC framework for incident handling.

D. 72 days: This is an incorrect duration and does not align with any specific requirement in the DFARS clause or CMMC framework for incident handling.

---

1. Defense Federal Acquisition Regulation Supplement (DFARS), Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. (Oct 2016). Section (e), "Media preservation and protection," states: "When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest." (Available at: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.)

2. U.S. Department of Defense, Office of the Chief Information Officer (DoD CIO), Guidance for Implementing Cybersecurity Requirements. This guidance frequently clarifies the obligations under DFARS 252.204-7012, reinforcing that the 90-day preservation requirement is distinct from the 72-hour reporting requirement. The DoD Procurement Toolbox provides resources and FAQs that reiterate this specific timeframe. (Reference: DoD Procurement Toolbox, Cybersecurity FAQs, https://dodprocurementtoolbox.com/faqs/cybersecurity)

3. CMMC Level 2 Assessment Guide, NIST SP 800-171 Rev 2. While the guide for practice IR.L2-3.6.2 (NIST 3.6.2) focuses on the act of reporting, the entire incident response family within CMMC for DoD contractors operates under the legal and contractual obligations set by DFARS 252.204-7012, which includes the 90-day retention rule as a foundational requirement for the overall incident response capability. (Available at: https://dodcio.defense.gov/CMMC/Documentation/)