A CCA is reviewing an OSC’s evidence for a CMMC practice and finds that the documentation is in draft form, marked “For Internal Use Only,” and lacks…

The role of a Certified CMMC Assessor (CCA) is to conduct a point-in-time evaluation of an Organization Seeking Certification's (OSC) cybersecurity posture based on the totality of available evidence. A draft document lacking final approval indicates a potential gap in the institutionalization of a process, which is a critical finding the CCA must record. However, this single piece of evidence is not, by itself, grounds for an immediate "NOT MET" determination. The CCA must triangulate this finding with other evidence, such as interviews and testing, to verify the OSC's claim of active use and make a holistic judgment on whether the practice's objectives are satisfied. This approach ensures a thorough and objective assessment.

A. Accepting draft documentation as sufficient ignores the lack of formal approval, which is a key indicator of whether a process is fully institutionalized and consistently implemented as required by CMMC.

C. This action is premature. The assessor must evaluate all available evidence (examine, interview, test) before concluding a practice is "NOT MET," as other evidence may sufficiently demonstrate implementation.

D. An assessor's role is to evaluate, not consult. Requesting the OSC to finalize documentation during an assessment compromises the integrity of the point-in-time evaluation and crosses the line into consulting.

---

1. Cyber AB, CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0, July 28, 2023.

Section 4.3.3, "Evidence Evaluation," states: "The Assessment Team evaluates the collected evidence to determine if it is sufficient to make a finding for each practice... The Assessment Team must use their professional judgment to determine if the evidence provided is authentic, reliable, and sufficient." This supports evaluating all available evidence, not just one document.

Section 4.4, "Documenting Assessment Findings," requires assessors to document the rationale for their findings. This would include noting the draft status of a document as a gap or weakness, even if other evidence leads to a "MET" conclusion.

2. U.S. Department of Defense, CMMC Model 2.0, "CMMC Level 2 Assessment Guide," December 2021.

Page 8, "How to Use This Guide," specifies that assessors use three methods to gather information: "Examine," "Interview," and "Test." This reinforces that an assessment is not based solely on documentation ("Examine") but requires a multi-faceted approach to verify implementation, aligning with the need to confirm the OSC's claim of active use.

3. Carnegie Mellon University, "The CMMC Ecosystem and the CMMC Assurance Process," CMMC-AB-001, Version 1.02, March 2021. (Note: While an older document, the principles of assessment remain foundational and are taught in academic contexts).

Section 4.2, "Assessment," describes the assessment as a process of collecting and evaluating evidence to determine conformity. It emphasizes that "Assessors must remain objective and impartial." This principle directly contradicts option D (acting as a consultant) and supports option B (objectively documenting a gap while continuing to assess).