An Assessment Team is reviewing a practice that is documented and being checked monthly. When reviewing the logs, the practice is only being…

For a CMMC practice to be assessed as "MET," the evidence gathered must be sufficient and consistent across all applicable assessment methods (Examine, Interview, and Test). In this scenario, there is a direct conflict between the objective evidence obtained from the 'Examine' method (logs show quarterly activity) and the testimonial evidence from the 'Interview' method (staff claim monthly activity). This inconsistency means the evidence is not sufficient to verify that the practice is implemented as required. Therefore, the practice would be assessed as "NOT MET."

A. This is a true statement but not the root cause for the assessment failure. The reason the work is considered "not being done as stated" is the conflict in evidence found via the required assessment methods.

B. This is factually incorrect. The objective evidence (logs) clearly shows the practice is not being performed as documented in the procedure (monthly).

D. Interviews provide testimonial evidence, which is insufficient on its own. CMMC assessments require corroboration with objective evidence from 'Examine' or 'Test' methods to verify a practice is met.

---

1. U.S. Department of Defense

Office of the Under Secretary of Defense for Acquisition & Sustainment. (2021

December). CMMC Model 2.0

CMMC Assessment Guide – Level 2.

Section 2.2

Assessment Methods (Page 9): "The assessment methods are Examine

Interview

and Test... The assessment team determines if a practice is MET only if the required evidence is sufficient to support the implementation of the practice."

Section 2.3

Practice Determinations (Page 10): "The assessment team makes a determination for each practice based on the assessment findings. The assessment team determines that a practice is MET only if the assessment evidence is sufficient to support the full implementation of the practice." The conflict between logs and interviews makes the evidence insufficient.

2. Carnegie Mellon University

Software Engineering Institute. (2010). Standard CMMI Appraisal Method for Process Improvement (SCAMPI) A

Version 1.3: Method Definition Document. CMU/SEI-2011-HB-001.

Section 2.4.2

Corroboration (Page 31): While a CMMI document

its principles are foundational to CMMC assessments. It states

"The team should ensure that the data are corroborated by at least one other source (e.g.

another person

a document) or type (e.g.

an interview

a document)... Lack of corroboration for a weakness finding may indicate that the weakness does not exist." In this case

the interview claim lacks corroboration and is actively contradicted by objective evidence.