A Lead Assessor is planning an assessment and scheduling the test activities. Who MUST perform tests to obtain evidence?

The CMMC assessment methodology requires assessors to gather objective evidence by observing the Organization Seeking Certification (OSC) performing the required practices and processes. The "Test" assessment method involves the assessor witnessing the execution of a practice or process by the OSC's own personnel as part of their normal duties. This approach validates that the control is not only documented but is also implemented and operational within the organization's day-to-day workflow. The assessor's role is to observe and verify, not to perform the test themselves or to direct who from the OSC performs it, other than those normally responsible for the task.

B. Military personnel are not involved in conducting commercial CMMC assessments, and assessors are observers, not active participants in the tests.

C. CMMC assessments are performed by accredited C3PAOs and their certified assessors, not by military personnel assigned to a contract.

D. Using personnel who do not normally perform the work would test the clarity of the procedure, not the operational effectiveness of the control's implementation.

1. CMMC Level 2 Assessment Guide

Version 2.0 (December 2021). U.S. Department of Defense.

Page 10

Section 3.2

Assessment Methods: The guide defines the "Test" method: "The Assessor witnesses the execution of a CMMC practice... The Assessor is not responsible for performing the test on behalf of the OSC." This confirms that the OSC performs the action while the assessor observes.

2. CMMC Assessment Process (CAP) v5.1.1. The Cyber AB.

Section 4.3.3

Conducting the Assessment: This section details the evidence-gathering activities

which include "observing the performance of procedures and processes." This implies that the OSC's personnel are the ones performing these actions for the assessor to observe.