During a CMMC assessment, the Assessment Team observes that the OSC is not enforcing practice objective CM.L2-3.4.5[d] – physical access restrictions…

According to the CMMC assessment methodology, a practice is scored as ‘MET’ only if all of its corresponding assessment objectives are satisfied. In this scenario, the Assessment Team has confirmed that practice objective CM.L2-3.4.5[d] is not fulfilled. Therefore, regardless of the Organization Seeking Certification's (OSC) intent to remediate the issue, the Certified CMMC Assessor (CCA) must accurately score the entire practice as ‘NOT MET’ based on the evidence observed during the assessment. The OSC's plan to correct the deficiency is a separate process, such as a Plan of Action and Milestones (POA&M), which is initiated as a result of the ‘NOT MET’ finding.

A. The CCA's role is to assess and report findings, not to agree to or manage the OSC's remediation plan. The 'NOT MET' finding must be recorded first.

B. A single practice deficiency is a standard assessment finding and does not warrant reporting the OSC to the Cyber AB. This is not a breach of conduct.

D. CMMC scoring does not allow for partial credit. If any single objective for a practice is not satisfied, the entire practice is deemed ‘NOT MET’.

1. U.S. Department of Defense, CMMC Level 2 Assessment Guide (Version 2.0, December 2021): In the "How to Use This Guide" section, under "Determination," it states, "If the assessor determines that the evidence satisfies all of the assessment objectives for the practice, then the practice is satisfied." This directly implies that if not all objectives are met, the practice is not satisfied. (Page 6)

2. U.S. Department of Defense, CMMC Assessment Process (CAP) for CMMC Level 2 (Version 2.1, June 2022): Section 4.3, "Conduct Assessment," outlines the process of gathering objective evidence to determine if practices are met. The scoring methodology, inherited from foundational NIST SP 800-171 assessment procedures, is binary ('MET' or 'NOT MET') for each practice based on the fulfillment of all its components. A 'NOT MET' finding is the prerequisite for a practice to be placed on a POA&M. (Section 4.3, Pages 19-21)

3. NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information: The CMMC assessment methodology is based on this NIST standard. It specifies that all determination statements (analogous to CMMC assessment objectives) associated with a requirement must be satisfied for the requirement to be met. (Section 2.2, "Assessment Procedure Structure," Page 5)