CCA Assessment Planning & Scoping Flashcards

What is the first step a CCA assessor must complete before beginning a CMMC Level 2 assessment?

Answer: Define the assessment scope and boundary

Defining the assessment scope and boundary is the mandatory first step to ensure all relevant systems and data are properly evaluated.

Which document serves as the primary planning artifact for a CMMC assessment?

Answer: Assessment Plan (AP)

The Assessment Plan (AP) is the primary planning artifact that outlines the scope, objectives, schedule, and methodology for a CMMC assessment.

When scoping a CMMC assessment, which type of data determines what systems fall within scope?

Answer: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)

FCI and CUI are the data types that determine which systems, personnel, and processes fall within the CMMC assessment scope.

What is the purpose of a pre-assessment kickoff meeting in CMMC assessment planning?

Answer: To establish ground rules, confirm scope, and align expectations between assessors and the OSC

The kickoff meeting aligns the assessment team and the Organization Seeking Certification (OSC) on scope, logistics, and expectations before fieldwork begins.

Which term describes the boundary within which CMMC requirements must be assessed?

Answer: Assessment boundary

The assessment boundary defines the people, technology, facilities, and external service providers that process, store, or transmit CUI/FCI within scope.

How should a CCA assessor handle a situation where the OSC's scope definition appears to exclude systems that clearly handle CUI?

Answer: Flag the discrepancy and require the scope to be corrected before proceeding

An assessor must require accurate scope definition to ensure all CUI-handling systems are evaluated, as an incomplete scope would invalidate the assessment.