CMMC-CCA practice question 10 of 35

When assessing an OSC’s compliance with IR requirements, you realize they have deployed a system that tracks incidents, documents details, and…

Choose your answer, then check it against the explanation.

When assessing an OSC’s compliance with IR requirements, you realize they have deployed a system that tracks incidents, documents details, and updates the status throughout the incident response process. Personnel to whom incidents must be reported are identified and designated. While examining their documentation, you come across an incident response template that they use to capture all relevant information and ensure consistency in reporting to the identified authorities and organizational officials. Interviewing the IR team, you learn there is an escalation process that the contractor’s cybersecurity team can use to address more serious incidents. From the scenario, the contractor has met all the required objectives for CMMC practice IR.L2-3.6.2 – Incident Reporting, meaning its implementation of the said practice will be scored MET with a total of 5 points. For how long must the OSC retain the incident records?

Answer options

Correct Answer:

Explanation

The question addresses the retention period for incident records for a Department of Defense (DoD) contractor, which is governed by the Defense Federal Acquisition Regulation Supplement (DFARS). While the scenario describes the implementation of CMMC practice IR.L2-3.6.2, the specific retention requirement flows down from DFARS Clause 252.204-7012. This clause mandates that when a contractor discovers a cyber incident, they must preserve and protect images of affected systems and all relevant monitoring data for at least 90 days from the submission of the incident report. This allows the DoD the opportunity to request the media for forensic analysis or to decline interest.

Why Incorrect

A. 72 hours: This is the maximum timeframe for reporting a cyber incident to the DoD Cyber Crime Center (DC3), not the data retention period.

C. 90 hours: This is an incorrect duration and does not align with any specific requirement in the DFARS clause or CMMC framework for incident handling.

D. 72 days: This is an incorrect duration and does not align with any specific requirement in the DFARS clause or CMMC framework for incident handling.

---

References

1. Defense Federal Acquisition Regulation Supplement (DFARS), Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. (Oct 2016). Section (e), "Media preservation and protection," states: "When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest." (Available at: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.)

2. U.S. Department of Defense, Office of the Chief Information Officer (DoD CIO), Guidance for Implementing Cybersecurity Requirements. This guidance frequently clarifies the obligations under DFARS 252.204-7012, reinforcing that the 90-day preservation requirement is distinct from the 72-hour reporting requirement. The DoD Procurement Toolbox provides resources and FAQs that reiterate this specific timeframe. (Reference: DoD Procurement Toolbox, Cybersecurity FAQs, https://dodprocurementtoolbox.com/faqs/cybersecurity)

3. CMMC Level 2 Assessment Guide, NIST SP 800-171 Rev 2. While the guide for practice IR.L2-3.6.2 (NIST 3.6.2) focuses on the act of reporting, the entire incident response family within CMMC for DoD contractors operates under the legal and contractual obligations set by DFARS 252.204-7012, which includes the 90-day retention rule as a foundational requirement for the overall incident response capability. (Available at: https://dodcio.defense.gov/CMMC/Documentation/)

Question 10 of 35

Keep practicing

Take the free CMMC-CCA practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test