Question 61
During a CMMC Level 2 assessment, an OSC receives a Conditional Certification with several practices placed on a Plan of Action and Milestones (POA&M). After implementing corrective actions, the OSC requests the Assessment Team to conduct a POA&M Close-Out Assessment. Which of the following is the correct action for the Team's Lead Assessor during the POA&M Close-Out Assessment?
Question 62
A CMMC assessment for an OSC finds it has fully implemented 87 out of 110 practices. Unfortunately, the Assessment Team determines that the POA&M Closeout Assessment option cannot be used. Consequently, the OSC will not be recommended for certification. However, the OSC Assessment Official humbly requests the Lead Assessor to adjust the findings to allow for POA&M closeout and mark a five-point practice as implemented. How should the Lead Assessor respond?
Question 63
The OSC has contracted a C3PAO to perform a CMMC assessment. During Phase 1, the C3PAO discovers that the OSC does not have a Commercial and Government Entity (CAGE) code. The OSC's Assessment Official argues that they have never needed one before and asks what they should do. What should the Lead Assessor tell the OSC Assessment Official?
Question 64
An aerospace company bids on a DoD contract that requires CMMC Level 2 compliance. The company has multiple divisions, but only the Manufacturing Division will work on the project. The Manufacturing Division has its own IT infrastructure and security policies, but it relies on thecompany's centralized IT department for some administrative tasks. Which unit will be assessed for CMMC Level 2 compliance?
Question 65
While conducting an assessment, an assessor is determining if privileged accounts are used for non-privileged functions. While interviewing a user with a privileged account, the assessor should ask if the person interviewed: