Free CMMC-CCA Web TestEngine Demo

Q45 Single choice

While conducting a CMMC Level 2 Third-Party Assessment of a small defense contractor, an assessor discovers that the contractor's Information Security Policy has no documented change records demonstrating executive approval. The IT director states that they will add change records in the future, but that other evidence exists.

Which documentation is MOST able to demonstrate persistent and habitual adherence to CMMC requirements?

A
Handwritten notes from executive committee meetings discussing implementation
B
Several years' worth of saved emails from the executive team approving policies and directing adherence
C
A notarized letter from the previous CEO stating that they approved information security policies annually
D
Transcribed interviews with new employees discussing their understanding of information security policies

CMMC-CCA Web TestEngine demo