What type of criteria is used to answer the question "Does the Assessment Team have the right evidence?"

The term "sufficiency" in the context of an assessment refers to the measure of the quantity and type of evidence collected. The CMMC Assessment Process (CAP) explicitly requires the Assessment Team to determine if sufficient evidence has been gathered to make a conclusive determination for each assessment objective. This involves ensuring that the evidence is convincing and adequate to support the assessor's findings without needing additional information.

A. Adequacy criteria: While related, "sufficiency" is the more precise and officially used term within the CMMC framework to describe the measure of the quantity of evidence.

B. Objectivity criteria: This pertains to the quality and unbiased nature of the evidence itself, not whether the right amount or type of evidence has been collected.

D. Subjectivity criteria: This is the opposite of a valid assessment principle. Evidence must be objective, factual, and verifiable, not based on personal feelings or opinions.

---

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2

Version 1.0. The Cyber AB. Section 4.3.2

"Evidence Sufficiency

" states: "The Assessment Team determines if sufficient evidence has been collected to make a determination for each assessment objective. Evidence is sufficient when it is convincing enough that a prudent

informed person would agree with the Assessment Team’s determination."

2. U.S. Department of Defense

"CMMC Model 2.0

Level 2 Assessment Guide

" December 2021. Page 10

under "Assessment Process

" states: "The assessor must collect sufficient evidence to support the final determination for each practice." This reinforces that sufficiency is the key criterion for the amount of evidence.