Free CMMC-CCA Web TestEngine Demo

Q21 Single choice

A company has a CUI enclave for handling all CUI processed, stored, and transmitted through the organization. While interviewing the IT manager, the CCA asks how assets that can, but are not intended to, handle CUI are identified. The IT manager refers to the CUI system's network diagram (which includes these assets) as well as the asset inventory (which lists these assets as Contractor Risk Managed Assets).

Which other artifact MUST also mention these assets?

A
The identification and authentication policy should show how these assets are identified.
B
The physical protection policy should list these assets as being part of the physical environment of the organization.
C
The awareness and training program should include these assets so they are covered for all employees.
D
The SSP should show these assets are managed using the company's risk-based security policies, procedures, and practices.

CMMC-CCA Web TestEngine demo