Key References for a Lead Assessor in a CMMC Assessment
ALead Assessorconducting aCMMC assessmentmust rely onofficial CMMC guidance documentsto evaluate whether anOrganization Seeking Certification (OSC)meets the required cybersecurity practices.
Most Relevant Reference: CMMC Assessment Guide
TheCMMC Assessment Guideprovidesdetailed descriptionsof eachpractice and processat the specificCMMC level being assessed.
It defines:
✔Theassessment objectivesfor each practice.
✔Therequired evidencefor compliance.
✔Thescoring criteriato determine if a practice isMET or NOT MET.
Why is the Correct Answer "D. Published CMMC Assessment Guide practice descriptions for the desired certification level"?
A. DoD adequate security checklist for covered defense information → Incorrect
TheDoD adequate security checklistis related toDFARS 252.204-7012 compliance, butCMMC assessmentsfollow theCMMC Assessment Guide.
B. CMMC Model Overview as it provides assessment methods and objects → Incorrect
TheCMMC Model Overviewprovideshigh-level guidance, butdoes not contain specific assessment criteria.
C. Safeguarding requirements from FAR Clause 52.204-21 for a Level 2 Assessment → Incorrect
FAR 52.204-21is relevant toCMMC Level 1 (FCI protection), butCMMC Level 2 follows NIST SP 800-171and requiresCMMC Assessment Guidesfor validation.
D. Published CMMC Assessment Guide practice descriptions for the desired certification level → Correct
TheCMMC Assessment Guideis theofficial documentused to determine if anOSC meets the required security practices for certification.
CMMC 2.0 References Supporting This Answer:
CMMC Assessment Process (CAP) Document
Specifies thatLead Assessors must use the CMMC Assessment Guidefor official scoring.
CMMC Assessment Guide for Level 1 & Level 2
Providesdetailed descriptions, assessment methods, and scoring criteriafor each practice.
CMMC-AB Guidance for Certified Third-Party Assessment Organizations (C3PAOs)
Confirms thatCMMC assessments must follow the Assessment Guide, not general DoD security policies.
Final Answer:
✔D. Published CMMC Assessment Guide practice descriptions for the desired certification level.
