CMMC-CCA practice question 2 of 35

A defense contractor retains your services to assess their information systems for CMMC compliance, particularly configuration management. The…

Choose your answer, then check it against the explanation.

A defense contractor retains your services to assess their information systems for CMMC compliance, particularly configuration management. The contractor uses CFEngine 3 for automated configuration and maintenance of its computer systems and networks. While chatting with the network’s system admins, you realize they have deployed a modern compliance checking and monitoring tool. However, when examining their configuration management policy, you notice the contractor uses different security configurations than those recommended by product vendors. The system administrator informs you they do this to meet the minimum configuration baselines required to achieve compliance and align with organizational policy. Based on your understanding of the CMMC Assessment Process, how would you score CM.L2-3.4.2 – Security Configuration Enforcement if the contractor is tracking it in a POA&M?

Answer options

Correct Answer:

Explanation

According to the CMMC Assessment Process (CAP), a practice is scored based on its implementation status at the time of the assessment. A Plan of Action & Milestones (POA&M) is a document used to track planned measures to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. The very existence of a POA&M for a specific practice, such as CM.L2-3.4.2, is an explicit acknowledgment by the organization that the practice is not currently fulfilled. Therefore, during a CMMC assessment, any practice being tracked in a POA&M must be scored as "NOT MET." The organization has a plan to fix it, but it is not fixed at the time of evaluation.

Why Incorrect

B. Need more information to score this practice: The presence of a POA&M for the practice is sufficient and definitive information to assign a "NOT MET" score according to the CMMC Assessment Process.

C. Met: A practice cannot be scored as "Met" if it has a documented deficiency that requires a POA&M for remediation. The two states are mutually exclusive.

D. Not Applicable: This practice, which involves enforcing security configurations, is fundamental to system security and is clearly applicable to an organization managing computer systems and networks.

---

References

1. CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.0.

Reference: Section 4.3, "Scoring," and Section 5.3, "Final Findings." The CAP specifies that for a CMMC Level 2 Certification Assessment, all applicable practices must be scored as "MET." A practice with a POA&M is, by definition, not fully implemented and thus scored as "NOT MET." The POA&M outlines the path to achieving a "MET" status in the future.

2. NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations."

Reference: Section 3.4, "Configuration Management," Requirement 3.4.2. This is the source requirement for CMMC's CM.L2-3.4.2. The discussion section notes that organizations can use various sources for security configuration settings. However, the assessment question hinges on the scoring process, where a POA&M indicates a failure to meet the requirement, regardless of the chosen configuration source.

3. CMMC Model, Version 2.0.

Reference: Domain: Configuration Management (CM), Practice: CM.L2-3.4.2. The model defines the requirement to "Establish and enforce security configuration settings for information technology products employed in organizational systems." The scoring is governed by the CAP, which treats items on a POA&M as "NOT MET."

Question 2 of 35

Keep practicing

Take the free CMMC-CCA practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test