Regarding virtual data collection, which of the following actions is the highest priority?

The highest priority in a formal assessment context, such as CMMC, is the comprehensive planning, risk management, and documentation of the methodology. This foundational step ensures that all aspects of the virtual data collection process are considered, structured, and defensible. It involves identifying the specific techniques to be used, proactively assessing the associated risks, defining appropriate mitigations (which include training and encryption), and establishing clear protocols for the management and protection of all sensitive information (CUI, FCI, and OSC proprietary data). This documented plan governs all subsequent activities, ensuring they are performed securely and consistently.

A. Training is a critical mitigation strategy, but it is a component of the overall risk management plan, not the primary overarching action.

C. Scheduling is a logistical and project management task; while important for smooth execution, it is not the highest security or compliance priority.

D. Encryption is a vital technical control for protecting data in transit, but it represents one specific mitigation within the broader, required risk management framework.

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2, Version 1.0, The Cyber AB, December 2022.

Section 2.3, Assessment Plan: This section details the requirement for a comprehensive Assessment Plan before the assessment begins. The plan must document the "detailed plan for the CMMC Assessment," which includes the methodology for evidence collection. A plan for virtual collection would inherently require documenting the techniques, associated risks, and how sensitive data will be protected, aligning directly with option B as the foundational step.

2. The Cyber AB Code of Professional Conduct (CoPC), Version 2.1, The Cyber AB, October 2022.

Principle 2, "Responsibility to the Profession": This principle requires certified professionals to "Perform all professional services and duties...with the due diligence and professional care required to protect the public trust." Formally documenting the virtual collection process, its risks, and mitigations (as described in option B) is a direct fulfillment of this requirement for due diligence and professional care.

3. NIST Special Publication 800-172A, Assessing Enhanced Security Requirements for Controlled Unclassified Information, February 2021.

Section 2.2, Assessment Planning: This document, which informs CMMC assessment methodology, emphasizes that "The first step in any assessment is planning... The assessment plan provides the roadmap for conducting the assessment." This reinforces that planning, which includes identifying methods, risks, and protections, is the highest priority action.