Confidently Practice Online with Free CMMC-CCA Exam Cram

A software development company is applying for a CMMC Level 2 assessment. As the Lead Assessor, you request access to the company?s System Security Plan (SSP) as part of the initial objective evidence for validating the scope. Which of the following is true about the software development companys obligations in honoring the request?

A medium-sized company that develops software components for DoD's military applications has a dedicated IT team responsible for maintaining its infrastructure and systems. They have retained your services to assess their compliance with CMMC requirements for certification so they can continue offering services to the DoD. Recently, the contractor experienced several security incidents where unauthorized changes were made to their systems, resulting in potential data breaches and system instability. Upon investigation, it was discovered that some IT team members were using unauthorized tools and techniques for system maintenance, and there was a lack of proper controls and oversight over the maintenance processes. Which measures should the contractor implement to comply with CMMC practice MA.L2-3.7.2-System Maintenance Control?

Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings. Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC?s preparedness and readiness for a CMMC assessment.Where would you document the OSC's readiness to proceed to the second phase of the CMMC Assessment Process (CAP)?

An aerospace company stores backups of their design schematics (containing CUI) on a cloud service provider (CSP). The company enforces access controls through the CSP's interface, restricting access to authorized personnel only. However, the company has no formal policy requiring data encryption at rest within the CSP environment. Data stored on the CSP's infrastructure is segregated, with CUI stored on a separate cluster from other data types. The CSP is authorized at a FedRAMP Moderate baseline, and the OSC regularly monitors access to backups. The CSP provides alerts for any suspicious activity that is detected. Has the OSC taken sufficient measures to meet the requirements of CMMC practice MP.L2.3.8.9-Protect Backups? If not, what measures can they take to address the weaknesses?

As a Lead Assessor, you are in contact with the OSC Assessment Official. The Assessment Official has submitted a document that outlines the scope of your assessment engagement. You expect to find all the following elements on the Assessment Scope document, EXCEPT?