Understanding Who Must Perform Tests in a CMMC Assessment
During aCMMC Level 2 Assessment, assessorsmust observe operational activities and security practicesto verify compliance. This process involves:
✔Testing security controls and proceduresas part of the assessment.
✔Observation of standard work practicesto ensure controls are properly implemented.
✔Using operational personnel (OSC employees) who regularly perform the taskto ensure realistic assessment conditions.
Who Performs Tests?
Operational personnel (OSC employees) must conduct the actual work while assessors observe.
Certified CMMC Professionals (CCPs) or Lead Assessorsoversee and document the testing process.
Why is the Correct Answer "A" (OSC personnel who normally perform that work as the CCP observes)?
A. OSC personnel who normally perform that work as the CCP observes → Correct
CMMC assessments require actual users (OSC personnel) to perform their regular duties while assessors observeto verify security practices.
B. Military personnel and the CCP and/or Lead Assessor to test the adequacy of the written procedure(s) → Incorrect
Military personnel are not responsible for testing contractor security controls.
Assessors observe and evaluate but do not perform testing themselves.
C. Military personnel assigned to the contractor for that contract to ensure the confidentiality of the CUI → Incorrect
Military personnel do not perform the testing.
The contractor (OSC) is responsible for implementing and demonstrating security controls.
D. OSC personnel who do not ordinarily perform that work to evaluate the accuracy of the written procedure(s) → Incorrect
Personnel unfamiliar with the job should not be used for testing.
Theassessment must reflect real-world conditions, so theactual employees who perform the work must demonstrate the process.
CMMC 2.0 References Supporting This Answer:
CMMC Assessment Process (CAP) Document
Specifies thatassessments must observe real operational activities to determine compliance.
CMMC-AB Assessment Methodology
Requirestesting of security controls in a realistic operational environment, meaning actual OSC personnel must perform the tasks.
NIST SP 800-171A (Assessment Procedures for NIST SP 800-171)
Specifies thatinterviews and observations should be conducted with personnel who regularly perform the work.
