* Applicable Requirement: CM.L2-3.4.3 - "Track, review, approve/disapprove, and audit changes to organizational systems."
* Why CCB Minutes Are Correct (supports B):
* Change Control Board (CCB) documentation includes impact analyses, approvals, disapprovals, and justification for system changes.
* The CMMC Assessment Guide explicitly identifies CCB minutes and supporting records as primary evidence of compliance with change management practices.
Why Other Options Are Insufficient:
* A (Vendor description): Provides information on the update, but does not show organizational review or approval.
* C (Audit logs): Show when a change occurred, but not whether it was analyzed and approved beforehand.
* D (Incident logs): Reflects results after implementation, but not the review/approval process.
Assessment Guidance Extract (NIST SP 800-171A, CM.L2-3.4.3):
* Objectives include verifying that system changes are:
* Documented,
* Reviewed,
* Approved/disapproved, and
* Audited.
* Evidence such as CCB minutes and approval records directly satisfies these objectives.
References (CCA Official Sources):
* NIST SP 800-171 Rev. 2 - CM.L2-3.4.3 (Change Management)
* NIST SP 800-171A - Assessment Objectives for CM.L2-3.4.3
* CMMC Assessment Guide - Level 2, Version 2.13 - Change Management evidence expectations

* CMMC Levels and Scope:
* Level 1: Protects Federal Contract Information (FCI) under FAR 52.204-21 (17 basic safeguarding requirements).
* Level 2: Protects Controlled Unclassified Information (CUI) under NIST SP 800-171 (110 practices).
* Why C is Correct: The Level 1 self-assessment covers FCI-related practices. Since Level 2 focuses exclusively on CUI environments, FCI-only requirements from the Level 1 self-assessment fall outside the scope of the Level 2 assessment.
* Why Other Options Are Insufficient:
* A (CUI in paper): Still in scope at Level 2 (CUI applies to both digital and physical formats).
* B (FCI within CUI enclave): If FCI is processed within the enclave, it is covered by Level 2.
* D (SCI): Classified information is entirely out of scope of CMMC; however, it is not relevant to Level 1 self-assessment either, making C the more precise choice.
References (CCA Official Sources):
* DoD CMMC Model v2.0 - Scope Differences between Level 1 (FCI) and Level 2 (CUI)
* NIST SP 800-171 Rev. 2 - Focus on CUI
* FAR 52.204-21 - FCI Safeguarding Requirements (Level 1 baseline)

The control PS.L2-3.9.1: Screen Individuals requires that individuals be screened before authorizing access to organizational systems and CUI. Since employees are assigned to work immediately upon hire, before screenings are complete, this practice is NOT MET. Completing screenings within the first week does not satisfy the requirement.
Exact extracts:
* "Screen individuals prior to authorizing access to organizational systems containing CUI."
* "Assessment Objectives ... Determine if: [a] individuals requiring access to CUI are screened before access is granted."
* "It is not sufficient for screening to occur after access has been authorized." Why the other options are incorrect:
* A: Remediation may be possible, but scoring must be NOT MET.
* B: A single practice being NOT MET does not automatically cause assessment failure (depends on aggregate score).
* C: HR responsibility does not excuse failure to complete screening before granting access.
References:
CMMC Assessment Guide - Level 2, PS.L2-3.9.1 "Screen Individuals."
NIST SP 800-171 Rev. 2, 3.9.1.

The Scoping Guidance for Specialized Assets allows exclusion of assets when they are physically and logically isolated from the CMMC assessment boundary and do not process, store, or transmit CUI.
Extract from CMMC Scoping Guidance:
"Specialized Assets may be designated as out-of-scope if they are physically or logically separated from CUI assets, or if they are inherently unable to process, store, or transmit CUI." The camera system in this case does not interact with CUI and is fully isolated, making exclusion appropriate.
Reference: CMMC Scoping Guidance, Specialized Assets Section.

Comprehensive and Detailed In-Depth Explanation:
AC.L2-3.1.11 involves "terminating user sessions after defined conditions." Specifications (documented artifacts like policies and plans-B, C, D) define these conditions and are examinable per NIST SP 800-171A.
Mechanisms (A) are technical implementations, not specifications, and are tested, not examined as documents. The CMMC guide distinguishes between examining policies and testing mechanisms.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), AC.L2-3.1.11: "Examine policies and plans; test termination mechanisms."
* NIST SP 800-171A, 3.1.11: "Specifications include policies, not mechanisms." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf