Q26
Single choice
An OSC is planning to have a C3PAO perform a CMMC Level 2 assessment. When validating the OSC's proposed assessment scope, you realize they use an ESP for various cybersecurity services.
What action must you, as a CCA, take regarding the ESP?