During assessment planning, the OSC recommends a person to interview for a certain practice. The person being interviewed MUST be the person who:

During a CMMC assessment, interviews are a primary method for collecting evidence to verify the implementation of a practice. The most appropriate individuals to interview are those with direct, hands-on responsibility for the practice. This includes personnel who initially set up or configured the control (implement), those who execute the practice as part of their regular duties (perform), or those who maintain and troubleshoot the control (support). These individuals can provide the most accurate and detailed information about how a practice is operationalized, which is the focus of the assessment interview.

A. funds that practice.

A person who funds a practice is involved in resource allocation, not the technical implementation or daily execution, and thus cannot provide sufficient detail on how the practice operates.

B. audits that practice.

An auditor's role is to verify, not perform, the practice. While they are a source of evidence, they are not the primary subject to be interviewed about the performance of the practice itself.

C. supports, audits, and performs that practice.

This is incorrect because it is overly restrictive. It is rare for one person to hold all three roles, and in many cases, this would violate the principle of separation of duties.

1. CMMC Assessment Process (CAP) for CMMC Level 2

Version 2.1

The Cyber AB

December 2023.

Section 4.3.2

Evidence: "Interviews are discussions with OSC personnel to obtain an understanding of how a CMMC practice is implemented... The Assessor interviews managers

system administrators

and other individuals with relevant responsibilities." This directly supports interviewing those who implement and support practices.

2. NIST Special Publication 800-171A

Assessing Security Requirements for Controlled Unclassified Information

February 2018.

Section 2.2

Assessment Methods and Objects: The "Interview" method is described as discussions with individuals. Throughout the document

assessment procedures for specific controls consistently direct the assessor to "Interview personnel with [specific responsibilities]" such as implementation

management

or operational roles (e.g.

system administrators

incident response personnel). This aligns with interviewing those who implement

perform

or support the practice.