Comprehensive and Detailed in Depth Explanation:
The CAP requires specific evidence from third parties for inherited practices (Option B). Options A, C, and D do not follow CAP evidence rules.
Extract from Official Document (CAP v1.0):
* Section 2.2 - Conduct Assessment (pg. 25):"Request detailed evidence from third-party providers to verify inherited practice objectives." References:
CMMC Assessment Process (CAP) v1.0, Section 2.2.

Comprehensive and Detailed in Depth Explanation:
The CAP requires the Lead Assessor to ensure evidence fully demonstrates compliance with CMMC practices. The SSP's omission of privileged account management procedures indicates an evidence gap for practices like AC.L2-3.1.3 (Control Access). Option A (accepting) ignores this gap, risking an inaccurate assessment. Option B (explaining but accepting) is not actionable per CAP, as assessors cannot coach. Option C (marking "Not Met") is premature without seeking additional evidence. Option D aligns with CAP's guidance to request further evidence to address deficiencies.
Extract from Official Document (CAP v1.0):
* Section 2.2 - Conduct Assessment (pg. 25):"If evidence does not fully demonstrate compliance with a practice, the Lead Assessor shall request additional evidence from the OSC to address the gap." References:
CMMC Assessment Process (CAP) v1.0, Section 2.2.

Comprehensive and Detailed in Depth Explanation:
The CMMC Code of Professional Conduct (CoPC) prohibits harassment and discrimination in all interactions related to CMMC roles, including post-assessment social events. The observing CCA must act professionally and ethically. Option A (reporting to Cyber AB) escalates prematurely without attempting internal resolution, which the CoPC encourages first. Option C (ignoring) fails to address a potential violation, breaching the CCA's duty to uphold the CoPC. Option D (public confrontation) risks unprofessional escalation. Option B (discreet reminder) aligns with CoPC's emphasis on addressing violations internally and professionally, allowing the offending CCA to correct their behavior while maintaining team integrity.
Extract from Official Document (CoPC):
* Paragraph 3.6(2) - Lawful and Ethical Practices (pg. 8):"Refrain from harassment ordiscrimination, sexual or otherwise, in all interactions with individuals encountered in connection with activities related to your role in the CMMC ecosystem."
* Paragraph 4.1(1)(a) - Violation Reporting (pg. 10):"Attempt to rectify the violation with the individual or entity in question prior to reporting." References:
CMMC Code of Professional Conduct, Paragraphs 3.6(2) and 4.1(1)(a).

Comprehensive and Detailed In-Depth Explanation:
SC.L2-3.13.11 - CUI Encryption requires "FIPS-validated cryptography for CUI." TheNIST Cryptographic Module Validation Program (CMVP)(A) provides current validation status for modules, per the CMMC guide. FedRAMP (B) is for cloud services, CSRC (C) is a general resource, and FIPS 140-2 docs (D) are static, not live statuses.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), SC.L2-3.13.11: "Verify FIPS status via NIST CMVP."
* NIST SP 800-171A, 3.13.11: "Refer to CMVP for validation."
Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf

CMMC Level 2 requires that audit logs be reviewed and updated at least weekly to detect anomalies and potential security incidents. A vendor providing only monthly summaries does not meet the requirement. The assessor must resolve this issue to confirm compliance.
Exact Extracts (official CMMC Assessor/Study documents):
* AU.L2-3.3.7: "Review and update logged events, as well as the audit log, at least weekly."
* AU.L2-3.3.6: "Review and analyze information system audit records for indications of inappropriate or unusual activity and report findings."
* CMMC Level 2 Assessment Guide emphasizes: "Organizations must demonstrate procedures to review audit logs at least weekly, even when external vendors perform this function."
* NIST SP 800-171A states: "The frequency of review must be sufficient to detect anomalies in a timely manner... at least weekly is required." Why other options are not correct:
* A: Report generation capability is not the compliance issue; frequency of review is.
* B: Using a common authoritative time source (AU.L2-3.3.7) is important, but the deficiency here is frequency of log review, not time source.
* D: Third-party involvement is permitted if the OSC maintains control and ensures requirements (frequency, integrity, protection of CUI) are met.
References (official CCA/CMMC documents):
* CMMC Assessment Guide - Level 2, Version 2.13: Practices AU.L2-3.3.6 and AU.L2-3.3.7 (pp. 56-
60).
* NIST SP 800-171A, Audit and Accountability objectives.