Certified CMMC Professional (CCP)

During scoping for a CMMC Level 2 assessment, the OSC identifies an isolated test bench computer that performs diagnostics on specialized machinery and has no network connectivity. The bench occasionally prints troubleshooting logs that may include CUI.

How should this test bench be categorized?

A Lead Assessor is ensuring all actions have been completed to conclude a Level 2 Assessment. The final Assessment Results Package has been properly reviewed and is ready to be uploaded.

What other materials is the Lead Assessor responsible for maintaining and protecting?

A CCP is on their first assessment for CMMC Level 2 with an Assessment Team and is reviewing the CMMC Assessment Process to understand their responsibilities.

Which method gathers information from the subject matter experts to facilitate understanding and achieve clarification?

An assessor has been working with an OSC's point of contact to plan and prepare for their upcoming assessment.

What is one of the MOST important things to remember when analyzing requirements for an assessment?

Who is responsible for ensuring that subcontractors have a valid CMMC Certification?

A contractor provides services and data to the DoD. The transactions that occur to handle FCI take place over the contractor's business network, but the work is performed on contractor-owned systems, which must be configured based on government requirements and are used to support a contract.

What type of Specialized Asset are these systems?

A server is used to store FCI with a cloud provider long-term.

What is the server considered?

Which domain has a practice requiring an organization to restrict, disable, or prevent the use of nonessential programs?

While conducting a CMMC Assessment, an individual from the OSC provides documentation to the assessor for review. The documentation states an incident response capability is established and contains information on incident preparation, detection, analysis, containment, recovery, and user response activities.

Which CMMC practice is this documentation attesting to?

A defense contractor needs to share FCI with a subcontractor and sends this data in an email. The email system involved in this process is being used to: