CCA Evidence Collection & Documentation Flashcards
6 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CCA Evidence Collection & Documentation flashcards as text
What must a CCA assessor do if an OSC provides documentation that appears to have been created specifically for the assessment rather than representing actual operations?
Answer: Flag the concern, seek corroborating evidence through interviews and system observations, and document the discrepancy
Assessors must seek corroborating evidence to determine if controls are genuinely implemented; documentation that appears created solely for the assessment requires additional verification through technical testing and interviews.
In CMMC assessment documentation, what is a 'corrective action plan'?
Answer: A documented plan for addressing 'Not Met' findings that may allow conditional progress toward certification
A corrective action plan outlines the specific steps and timeline an OSC will take to remediate 'Not Met' findings, which may be relevant to conditional certification pathways.
How long must C3PAOs retain CMMC assessment records?
Answer: 6 years from the date of assessment completion
CMMC requirements specify that C3PAOs must retain assessment records for a minimum of 6 years from the assessment completion date to support audits and reviews.
What does it mean when a CMMC assessor assigns a practice determination of 'Not Applicable' (NA)?
Answer: The practice is not relevant to the OSC's assessed environment based on the scoped system boundary
A 'Not Applicable' determination means the practice's requirements genuinely do not apply to the OSC's environment as scoped (e.g., a mobile device practice when no mobile devices are in scope).
Which of the following best describes the Final Assessment Report in the CMMC assessment lifecycle?
Answer: The authoritative record of all findings, determinations, and the overall CMMC Level achievement submitted to the CMMC-AB
The Final Assessment Report is the authoritative deliverable documenting all practice determinations, findings, and the overall CMMC Level achievement that is submitted to the CMMC-AB.
What is the assessor's responsibility when reviewing an OSC's incident response documentation during a CMMC assessment?
Answer: To assess whether the documentation addresses CMMC incident response practice requirements and that personnel know how to execute the plan
Assessors must verify that incident response documentation satisfies CMMC practice requirements and that staff are trained to execute the plan, combining examination of documents with interviews of personnel.