A CCP is part of a CMMC Assessment Team interviewing a subject-matter expert on Access Control (AC) within an OSC. During the interview process, what…

A core principle of the CMMC assessment process is to establish an environment of trust where personnel from the Organization Seeking Certification (OSC) can provide honest and complete information. The CCP must ensure that information shared by interviewees is treated as confidential and non-attributable. This means the information will be protected from unauthorized disclosure and will not be used to assign personal blame or cause reprisal against the individual. The focus is on objectively evaluating the organization's implementation of CMMC practices, not on the performance of specific individuals. This assurance is critical for gathering sufficient and credible evidence.

A. Group interviews are a logistical option for efficiency but are not a requirement; one-on-one interviews are often more effective for gathering sensitive or detailed information.

B. The final report includes analyzed findings and conclusions based on evidence, not the raw recordings or verbatim transcripts of interviews.

D. While the CCP must map evidence to specific practices, this is an internal assessment team activity, not the primary assurance given to the interviewee about the nature of the information exchange.

1. The Cyber AB

Code of Professional Conduct

Version 2.2 (June 28

2023):

Section 3.0

Confidentiality: "CMMC Professionals shall not disclose any confidential or proprietary information related to professional services or activities without proper and specific authority from the Cyber AB and the client

or unless required by law." This directly supports the principle of confidentiality during all assessment activities

including interviews.

2. ISO/IEC 19011:2018

Guidelines for auditing management systems: This international standard

which provides the foundation for professional auditing practices like those used in CMMC

emphasizes key principles for ensuring effective and reliable audits.

Clause 4

Principles of auditing: This clause lists "Confidentiality – security of information" as a fundamental principle of auditing. It also describes the "evidence-based approach

" where findings are based on verifiable evidence. The practice of non-attribution supports the collection of unbiased evidence by removing fear of personal consequences for the interviewee.

3. Carnegie Mellon University

Software Engineering Institute

Preparing for a CMMC Assessment (Webinar

May 2021):

In discussions on assessment conduct

instructors emphasize that assessors are there to "collect evidence of institutionalized processes

" not to find fault with individuals. The process is described as "non-attributable

" meaning the evidence is tied to the process or control

not the person who provided the information. This fosters the open communication necessary for a successful assessment.