I85PREP
⌘ K
CMMC CCA study materials
CMMC CCA study resources

CMMC CCA practice questions

One question at a time. Build your CMMC CCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1CMMC Ecosystem, Roles, and Code of Professional Conduct

Which organization is the sole accreditation body authorized to accredit C3PAOs and certify CMMC assessors?

  1. The DoD Chief Information Officer
  2. The National Institute of Standards and Technology
  3. The Defense Industrial Base Cybersecurity Assessment Center
  4. The Cyber AB Correct answer.

Explanation

The Cyber AB is the non-profit accreditation body recognized by DoD to administer the CMMC ecosystem, including accrediting assessment organizations and certifying individuals. NIST develops the underlying standards, while DIBCAC is a government assessment organization.

Question 2CMMC Ecosystem, Roles, and Code of Professional Conduct

A Certified Third-Party Assessment Organization (C3PAO) is an entity authorized by the Cyber AB to do what?

  1. Publish the CMMC model and its associated assessment guides
  2. Approve a contractor's plan of action and milestones
  3. Issue contract awards to certified defense contractors
  4. Conduct CMMC Level 2 certification assessments Correct answer.

Explanation

C3PAOs are organizations accredited by the Cyber AB to plan and perform CMMC Level 2 certification assessments using certified assessors. They do not publish the model, approve remediation plans, or award contracts.

Question 3CMMC Ecosystem, Roles, and Code of Professional Conduct

Which individual credential authorizes a person to conduct CMMC Level 2 certification assessments on behalf of a C3PAO?

  1. Registered Practitioner (RP)
  2. Certified CMMC Professional (CCP)
  3. Certified CMMC Assessor (CCA) Correct answer.
  4. Certified Instructor

Explanation

The CCA credential is the qualification for individuals who perform certification assessments as members of a C3PAO assessment team. Other credentials support advising, registration, or training rather than assessment delivery.

Question 4CMMC Ecosystem, Roles, and Code of Professional Conduct

How often must a contractor complete a CMMC Level 1 self-assessment?

  1. Every two years
  2. Every three years
  3. Only when a contract is awarded
  4. Annually Correct answer.

Explanation

Level 1 requires an annual self-assessment accompanied by a senior official's affirmation of compliance. The triennial cycle applies to third-party certification assessments at higher levels.

Question 5CMMC Ecosystem, Roles, and Code of Professional Conduct

Which CMMC level is assessed by a government-led assessment team rather than by a C3PAO?

  1. Level 2
  2. Level 1
  3. Level 3 Correct answer.
  4. All levels are assessed by C3PAOs

Explanation

Level 3 assessments are conducted by a government assessment team, reflecting the higher sensitivity of the information protected at that level. Levels 1 and 2 use self-assessment or C3PAO assessment depending on the contract requirement.

Question 6CMMC Ecosystem, Roles, and Code of Professional Conduct

CMMC Level 1 practices are designed primarily to protect which category of information?

  1. Controlled Unclassified Information (CUI)
  2. Personally identifiable information only
  3. Classified national security information
  4. Federal Contract Information (FCI) Correct answer.

Explanation

Level 1 safeguards FCI, which is information provided by or generated for the government under a contract that is not intended for public release. Protection of CUI begins at Level 2.

Question 7CMMC Ecosystem, Roles, and Code of Professional Conduct

An assessor learns that a teammate altered evidence to make a practice appear satisfied. What does the Code of Professional Conduct require of the assessor?

  1. Report it through the proper channels Correct answer.
  2. Withdraw silently from the assessment
  3. Raise it only if the client agrees
  4. Keep quiet to preserve team cohesion

Explanation

Certified individuals must report conduct that compromises the integrity of an assessment to the appropriate authority, such as the C3PAO leadership and the Cyber AB. Silence, conditional disclosure, or quiet withdrawal does not meet that obligation.

Question 8CMMC Ecosystem, Roles, and Code of Professional Conduct

Which DoD organization performs CMMC Level 3 assessments?

  1. The CMMC Program Management Office
  2. The Defense Contract Audit Agency
  3. The Cyber AB
  4. DIBCAC Correct answer.

Explanation

The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) conducts the government-led assessments required at Level 3. The Cyber AB handles accreditation and certification of the private assessment workforce.

Question 9CMMC Ecosystem, Roles, and Code of Professional Conduct

Which statement best describes the primary role of a Certified CMMC Professional (CCP)?

  1. Support organizations preparing for an assessment Correct answer.
  2. Lead CMMC Level 2 certification assessments for a C3PAO
  3. Issue final Level 3 certification determinations
  4. Accredit C3PAOs on behalf of the Cyber AB

Explanation

The CCP credential is oriented toward advising and supporting organizations as they prepare for assessments, often within a Registered Provider Organization. Leading certification assessments requires the CCA credential.

Question 10CMMC Ecosystem, Roles, and Code of Professional Conduct

What distinguishes a Registered Provider Organization (RPO) from a C3PAO?

  1. It employs only Certified CMMC Assessors
  2. It provides advisory and preparation services Correct answer.
  3. It is a government office within the Department of Defense
  4. It may issue Level 1 certificates on behalf of the Cyber AB

Explanation

RPOs are registered with the Cyber AB to provide CMMC consulting and preparation services; they do not perform certification assessments. C3PAOs are separately accredited to conduct assessments, and the two roles must remain distinct to preserve independence.

Question 11CMMC Ecosystem, Roles, and Code of Professional Conduct

A CCA is asked to assess an organization that paid the assessor for consulting services two years earlier. What is the most appropriate action?

  1. Accept it if the organization signs a waiver
  2. Accept the engagement because the consulting work is complete
  3. Accept and rely on the earlier consulting documentation
  4. Decline the engagement because of the conflict of interest Correct answer.

Explanation

Prior consulting work for the organization being assessed creates a self-review and familiarity threat to independence. A waiver from the client cannot cure a conflict of interest under the Code of Professional Conduct.

Question 12CMMC Ecosystem, Roles, and Code of Professional Conduct

An assessor is offered a valuable gift by a client during an assessment. How should the assessor respond under the Code of Professional Conduct?

  1. Accept it and disclose it in the final report
  2. Accept it if it is given after the exit briefing
  3. Accept it if its value is disclosed to teammates
  4. Decline it because it may impair independence Correct answer.

Explanation

Assessors must not accept gifts or hospitality that could influence, or appear to influence, their judgment. Disclosure after the fact does not resolve the impairment to objectivity and independence.

Question 13CMMC Ecosystem, Roles, and Code of Professional Conduct

A CCA must protect client CUI and assessment evidence collected during fieldwork. Which principle of the Code of Professional Conduct does this primarily reflect?

  1. Confidentiality Correct answer.
  2. Objectivity
  3. Professionalism
  4. Competence

Explanation

Confidentiality requires certified individuals to safeguard sensitive information, including CUI and assessment artifacts, and to limit disclosure to authorized purposes. The other principles address impartial judgment, skill, and general conduct.

Question 14CMMC Ecosystem, Roles, and Code of Professional Conduct

For contractors required to have a C3PAO assessment at Level 2, how often must the certification assessment be repeated?

  1. Annually
  2. Every five years
  3. Only once, with no repeat
  4. Every three years Correct answer.

Explanation

Level 2 certification assessments follow a triennial cycle, with annual affirmations of continued compliance in the intervening years. Level 1 self-assessments, by contrast, recur annually.

Question 15CMMC Ecosystem, Roles, and Code of Professional Conduct

An assessor holds a significant financial interest in a company that is being assessed. Which requirement is most directly threatened?

  1. Confidentiality
  2. Objectivity and independence Correct answer.
  3. Competence
  4. Continuing education

Explanation

A financial interest creates a self-interest threat that can bias assessment conclusions, undermining objectivity and independence. Competence, confidentiality, and education requirements address different aspects of professional conduct.

Question 16CMMC Ecosystem, Roles, and Code of Professional Conduct

Which entity is responsible for establishing CMMC program policy and requirements within the Department of Defense?

  1. The C3PAO consortium
  2. The CMMC Program Management Office Correct answer.
  3. DIBCAC
  4. The Cyber AB's board of directors and ethics panel

Explanation

The CMMC Program Management Office, housed within DoD, develops and maintains program policy, requirements, and implementation guidance. The Cyber AB administers accreditation and credentialing under that policy framework.

Question 17CMMC Ecosystem, Roles, and Code of Professional Conduct

What must Certified CMMC Assessors do to maintain their credential?

  1. Pass the CCA exam again every year
  2. Meet continuing education requirements of the Cyber AB Correct answer.
  3. Join a Registered Provider Organization
  4. Serve on at least two Level 3 assessments every year

Explanation

Credential maintenance requires ongoing professional development, including continuing education, as specified by the Cyber AB. Annual re-examination, mandated assessment quotas, and RPO membership are not maintenance conditions.

Question 18CMMC Ecosystem, Roles, and Code of Professional Conduct

An assessor's marketing materials claim the assessor is 'authorized to certify Level 2 compliance independently.' Why is this a Code of Professional Conduct concern?

  1. Because it misrepresents the assessor's authority Correct answer.
  2. Because assessors may not work with commercial clients
  3. Because marketing is prohibited for all certified individuals
  4. Because only the DoD CIO can approve marketing language

Explanation

Certified individuals must not misrepresent their qualifications or the nature of CMMC certification. Assessments are team efforts performed through an accredited C3PAO, so an individual cannot certify an organization independently.

Question 19CMMC Ecosystem, Roles, and Code of Professional Conduct

What authority does the Cyber AB have when a certified individual violates the Code of Professional Conduct?

  1. It may refer the matter to a C3PAO for a decision
  2. It may suspend or revoke the credential Correct answer.
  3. None; only the DoD can take action
  4. It may only issue a private warning

Explanation

As the credentialing body, the Cyber AB investigates alleged violations and may impose sanctions, up to and including suspension or revocation of the credential. C3PAOs do not adjudicate code violations.

Question 20CMMC Ecosystem, Roles, and Code of Professional Conduct

Before a CCA can participate in a Level 2 certification assessment, the assessor must be affiliated with which type of entity?

  1. An authorized C3PAO Correct answer.
  2. A federally funded research center
  3. A Registered Provider Organization
  4. A DoD program office

Explanation

Certified CMMC Assessors deliver assessments only as members of an accredited C3PAO's assessment team. Affiliation with a consulting provider or a government office does not authorize assessment work.

Question 21CMMC Ecosystem, Roles, and Code of Professional Conduct

During fieldwork, a CCA finds that a practice the client reported as satisfied has no supporting evidence. The client's executive asks the assessor to 'note it as an observation rather than a finding.' What is the correct course of action?

  1. Omit it to avoid disrupting the client relationship
  2. Defer the decision to the client's IT manager
  3. Record it as not met and report it accurately Correct answer.
  4. Downgrade it because the executive is the senior official

Explanation

Assessment conclusions must reflect the evidence, and a practice lacking evidence cannot be scored as met. Client preference, executive seniority, and relationship concerns cannot override accurate reporting.

Question 22CMMC Ecosystem, Roles, and Code of Professional Conduct

A C3PAO is offered an assessment of a division where the lead assessor's spouse is the compliance director. What is the appropriate response?

  1. Accept, because the spouse does not perform the work being assessed
  2. Decline or replace the assessor to eliminate the conflict Correct answer.
  3. Accept, and have the spouse sign a nondisclosure agreement
  4. Accept, but have the spouse excluded from interview sessions

Explanation

A close family relationship with a leader of the assessed entity creates a familiarity threat that cannot be mitigated by paperwork or interview scheduling. The conflict must be eliminated by declining the engagement or removing the affected assessor.

Question 23CMMC Ecosystem, Roles, and Code of Professional Conduct

An assessor documents three practices not met. The client threatens to complain to the Cyber AB unless the report is changed to a 'conditional pass.' The assessor should:

  1. Withdraw the report and refund the engagement fee
  2. Ask the Cyber AB to arbitrate before issuing
  3. Issue the report with the findings unchanged Correct answer.
  4. Adjust the report to avoid a dispute

Explanation

Findings must be reported as determined by the evidence, and pressure from the assessed organization cannot alter them. Credible threats should be documented and handled through normal oversight channels after the accurate report is issued.

Question 24CMMC Ecosystem, Roles, and Code of Professional Conduct

Which statement about the Cyber AB's oversight of C3PAOs is accurate?

  1. The Cyber AB may suspend or revoke a C3PAO's authorization Correct answer.
  2. C3PAOs are overseen by NIST rather than the Cyber AB
  3. C3PAOs are overseen only by the contractors they assess
  4. C3PAOs self-declare their authorization without external review

Explanation

The Cyber AB accredits C3PAOs and maintains oversight through quality reviews and monitoring, with the ability to suspend or revoke authorization. Accreditation is an external process, and assessed contractors have no oversight role.

Question 25CMMC Ecosystem, Roles, and Code of Professional Conduct

The Code of Professional Conduct applies to a certified assessor's conduct in which circumstances?

  1. Only while physically present at a client site
  2. In all professional activities Correct answer.
  3. Only when named in an assessment report
  4. Only during Level 2 and Level 3 assessments

Explanation

The code governs professional conduct generally, including marketing, client relationships, and interactions outside a specific assessment engagement. Limiting its reach to on-site work or report authorship would leave significant conduct unregulated.

Question 26CMMC Ecosystem, Roles, and Code of Professional Conduct

Which NIST publication is the primary source for the CMMC Level 2 practices?

  1. NIST SP 800-53
  2. NIST SP 800-172
  3. NIST SP 800-171 Correct answer.
  4. NIST Cybersecurity Framework

Explanation

CMMC Level 2 aligns with the 110 security requirements in NIST SP 800-171 for protecting controlled unclassified information. The other publications serve different roles, such as broader federal control catalogs or enhanced Level 3 requirements.

Question 27CMMC Ecosystem, Roles, and Code of Professional Conduct

Which credential is required for an individual to serve as a Certified CMMC Assessor and lead assessment activities?

  1. CCA Correct answer.
  2. RPO
  3. LPP
  4. CCP

Explanation

The Certified CMMC Assessor credential authorizes an individual to conduct CMMC assessments and attest to findings. The CCP is a foundational professional credential, while RPO and LPP refer to organizational roles.

Question 28CMMC Ecosystem, Roles, and Code of Professional Conduct

Which organization serves as the accreditation body for the CMMC ecosystem?

  1. The Cyber AB Correct answer.
  2. National Institute of Standards and Technology
  3. DoD Chief Information Officer
  4. Defense Industrial Base Cybersecurity Assessment Center

Explanation

The Cyber AB is the independent accreditation body recognized by the Department of Defense for the CMMC ecosystem. It authorizes C3PAOs and RPOs and certifies individual CMMC professionals.

Question 29CMMC Ecosystem, Roles, and Code of Professional Conduct

What is the primary purpose of the CMMC Code of Professional Conduct?

  1. Set the fees that C3PAOs may charge clients
  2. Define the practices required at each CMMC level
  3. Establish technical security requirements for contractors
  4. Maintain integrity and public trust in assessments Correct answer.

Explanation

The Code of Professional Conduct establishes ethical expectations for certified individuals so that CMMC assessments remain credible and trustworthy. It does not define technical controls, fees, or practice requirements.

Question 30CMMC Ecosystem, Roles, and Code of Professional Conduct

For a CMMC Level 2 requirement in a prioritized DoD acquisition, which entity conducts the certification assessment?

  1. DIBCAC
  2. The contractor's internal audit team
  3. The Cyber AB assessment staff
  4. An authorized C3PAO Correct answer.

Explanation

Level 2 certification assessments for prioritized acquisitions are performed by an authorized C3PAO. DIBCAC conducts Level 3 assessments, and internal teams do not issue CMMC Level 2 certifications.

Question 31CMMC Ecosystem, Roles, and Code of Professional Conduct

At CMMC Level 1, what must a contractor's senior official do each year after the self-assessment?

  1. Hire a C3PAO to validate the results
  2. Affirm the self-assessment results Correct answer.
  3. Submit all evidence to DIBCAC for review
  4. Publish the results on a public website

Explanation

Level 1 requires an annual self-assessment followed by affirmation by a senior official of the contractor. The affirmation attests that the self-assessment was conducted and the results are accurate.

Question 32CMMC Ecosystem, Roles, and Code of Professional Conduct

A CCA is assigned to assess a technology area outside their current knowledge. According to the Code of Professional Conduct, what is the most appropriate action?

  1. Delegate the conclusion to a CCP
  2. Mark the practices MET by default
  3. Obtain competence or decline the work Correct answer.
  4. Rely entirely on the client's technical staff

Explanation

The competence principle requires assessors to perform only work for which they have the necessary knowledge and skills. If competence cannot be obtained, the assessor should decline or be reassigned rather than issue unsupported conclusions.

Question 33CMMC Ecosystem, Roles, and Code of Professional Conduct

An assessor observes another certified professional falsifying assessment evidence. What does the Code of Professional Conduct require?

  1. Ignore the conduct if the assessment outcome is unaffected
  2. Report the conduct to the Cyber AB Correct answer.
  3. Notify the client only
  4. Confront the person privately and take no further action

Explanation

Certified individuals must act with integrity and report conduct that undermines the CMMC assessment process. Falsifying evidence is a serious violation that must be reported to the accreditation body.

Question 34CMMC Ecosystem, Roles, and Code of Professional Conduct

Which set of assets is included in the scope of a CMMC assessment?

  1. CUI assets and security protection assets Correct answer.
  2. Only assets owned by the senior official
  3. All corporate assets regardless of CUI
  4. Only servers physically located in a data center

Explanation

CMMC assessment scope includes assets that process, store, or transmit CUI as well as security protection assets that protect those CUI assets. It does not automatically include every corporate asset.

Question 35CMMC Ecosystem, Roles, and Code of Professional Conduct

A C3PAO wants to provide remediation consulting to a client immediately after completing its certification assessment. What is the primary concern?

  1. It may compromise independence and objectivity Correct answer.
  2. The client may refuse the recommendations
  3. The Cyber AB charges an additional fee
  4. Consulting is prohibited for all C3PAOs at all times

Explanation

Providing consulting to an organization the C3PAO has assessed can create a conflict of interest and impair independence. The Code requires assessors to avoid relationships that compromise objectivity.

Question 36CMMC Ecosystem, Roles, and Code of Professional Conduct

Which statement accurately describes the Cyber AB's relationship to the Department of Defense?

  1. A NIST program office
  2. A contractor trade association
  3. An independent accreditation body Correct answer.
  4. A field activity staffed entirely by federal employees

Explanation

The Cyber AB operates as an independent accreditation body recognized by DoD for CMMC. It is not a DoD field activity, a NIST office, or a trade association.

Question 37CMMC Ecosystem, Roles, and Code of Professional Conduct

CMMC Level 3 enhanced practices are primarily derived from which source?

  1. NIST Cybersecurity Framework
  2. NIST SP 800-53
  3. NIST SP 800-172 Correct answer.
  4. ISO/IEC 27001

Explanation

Level 3 builds on the Level 2 baseline with selected enhanced requirements from NIST SP 800-172. It is intended for contractors supporting the highest-priority programs.

Question 38CMMC Ecosystem, Roles, and Code of Professional Conduct

After submitting an assessment report, a CCA discovers that a practice marked MET lacked sufficient evidence. What is the most appropriate action?

  1. Wait until the next scheduled assessment to mention it
  2. Notify the C3PAO and the Cyber AB and correct the record Correct answer.
  3. Keep silent because the submitted report is final
  4. Revise the client's system security plan without telling anyone

Explanation

Integrity requires assessors to correct inaccurate findings and disclose the issue to the responsible parties. A submitted report does not remove the obligation to address material errors.

Question 39CMMC Ecosystem, Roles, and Code of Professional Conduct

An assessor's confidentiality obligation regarding client CUI and assessment evidence ends when?

  1. When fieldwork begins
  2. When the final report is submitted
  3. When the client pays the invoice
  4. It continues after the engagement ends Correct answer.

Explanation

Confidentiality is not limited to the active assessment period; it continues after the engagement. Assessors must protect client information and evidence unless disclosure is authorized or legally required.

Question 40CMMC Ecosystem, Roles, and Code of Professional Conduct

How many domains make up the CMMC Level 2 practice set?

  1. 14 Correct answer.
  2. 12
  3. 20
  4. 17

Explanation

The CMMC Level 2 practice set is organized into 14 domains aligned with NIST SP 800-171. These domains group the 110 practices into related security areas.

Question 41CMMC Assessment Process (CAP) Planning and Scoping

The CMMC Assessment Process (CAP) organizes a C3PAO Level 2 certification engagement into how many phases?

  1. Five
  2. Six
  3. Three
  4. Four Correct answer.

Explanation

The CAP defines four sequential phases: Planning and Scoping, Assessment, Reporting, and Post-Assessment/Closeout activities. Each phase has defined inputs, activities, and outputs that the C3PAO must complete.

Question 42CMMC Assessment Process (CAP) Planning and Scoping

What is the primary purpose of the planning and scoping phase of a CMMC Level 2 assessment?

  1. To collect and validate evidence against each objective
  2. To issue the final assessment report and POA&M
  3. To define and document what will be assessed Correct answer.
  4. To remediate deficiencies identified during the assessment

Explanation

Planning and scoping establishes the assessment boundary, asset inventory, schedule, team, and evidence requests before any evidence is evaluated. Evidence collection and validation occur later, in the assessment phase.

Question 43CMMC Assessment Process (CAP) Planning and Scoping

At CMMC Level 2, assets are grouped into how many scoping categories?

  1. Two
  2. Four
  3. Five Correct answer.
  4. Three

Explanation

Level 2 scoping uses five asset categories: CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets. Each category carries different assessment expectations.

Question 44CMMC Assessment Process (CAP) Planning and Scoping

Who is responsible for defining the CMMC assessment scope that the C3PAO later validates?

  1. The C3PAO assessor alone
  2. The organization seeking certification (OSC) Correct answer.
  3. The Cyber AB
  4. The DoD DIBCAC

Explanation

The OSC defines its own assessment scope using the applicable scoping guidance, documenting the boundary, asset inventory, and external service providers. The C3PAO validates that scope during planning before accepting it for the assessment.

Question 45CMMC Assessment Process (CAP) Planning and Scoping

Which asset category includes systems that process, store, or transmit CUI?

  1. CUI assets Correct answer.
  2. Contractor risk managed assets
  3. Specialized assets
  4. Security protection assets

Explanation

CUI assets are those that process, store, or transmit controlled unclassified information and therefore must be assessed against the full set of Level 2 requirements. The other categories describe assets with different relationships to CUI.

Question 46CMMC Assessment Process (CAP) Planning and Scoping

An organization's SIEM platform and central log server do not handle CUI, but they enforce security requirements for the systems that do. How are they categorized at Level 2?

  1. Security protection assets Correct answer.
  2. Out-of-scope assets
  3. CUI assets
  4. Contractor risk managed assets

Explanation

Security protection assets are systems that provide security functions protecting CUI assets even though they do not process, store, or transmit CUI themselves. They remain in scope because their failure would undermine protections for CUI.

Question 47CMMC Assessment Process (CAP) Planning and Scoping

A file server can technically reach the CUI enclave, but the OSC has configured it to block all CUI and does not intend it to handle CUI. How should it be scoped?

  1. A specialized asset that is assessed only for physical protection requirements
  2. Out of scope, with no documentation required
  3. A contractor risk managed asset, documented but not assessed Correct answer.
  4. A CUI asset that must meet all 110 requirements

Explanation

Contractor risk managed assets can technically handle CUI but are not intended to, and the OSC must demonstrate safeguards that prevent CUI from being processed, stored, or transmitted on them. They must be documented in the scope, but they are not assessed against the full Level 2 requirement set.

Question 48CMMC Assessment Process (CAP) Planning and Scoping

Which condition must hold for an asset to be excluded from the Level 2 assessment scope?

  1. It is used only by senior executives and their assistants
  2. It does not process, store, or transmit CUI Correct answer.
  3. It is owned by a third-party service provider
  4. It runs an operating system the vendor no longer patches

Explanation

Out-of-scope assets must be unable to process, store, or transmit CUI, and the OSC must also show that the asset is separated from the CUI environment so CUI cannot reach it. Exclusion must be documented and justified in the scoping artifacts.

Question 49CMMC Assessment Process (CAP) Planning and Scoping

A managed service provider hosts log collection for the OSC's CUI environment under contract. How is the provider treated in scoping?

  1. As an external service provider within the assessment boundary Correct answer.
  2. As a specialized asset requiring no evidence
  3. As a contractor risk managed asset
  4. As fully out of scope because it is a separate legal entity

Explanation

An external service provider delivering security services that protect CUI falls within the assessment boundary, and the OSC remains accountable for the requirements the provider implements. The provider's responsibilities and evidence must be identified during scoping.

Question 50CMMC Assessment Process (CAP) Planning and Scoping

How can a cloud service provider's infrastructure help satisfy CMMC Level 2 requirements for the OSC?

  1. The CSP's FedRAMP Moderate authorization covers the CSP-responsible requirements Correct answer.
  2. The CSP must be assessed by the C3PAO during every assessment
  3. Cloud hosting is always out of scope at Level 2
  4. The OSC must obtain a waiver from the Cyber AB

Explanation

CMMC scoping guidance allows a cloud provider's FedRAMP Moderate authorization to be treated as satisfying the requirements the provider is responsible for. The OSC inherits those protections but must still implement and evidence its own customer-responsibility requirements.