Step 1: Define CUI (Controlled Unclassified Information)
CUI is information thatrequires safeguarding or dissemination controlspursuant to and consistent with applicable law, regulations, and government-wide policies, butis not classifiedunder Executive Order 13526 or the Atomic Energy Act.
#Step 2: Authority over CUI - NARA's Role
NARA - National Archives and Records Administration, specifically theInformation Security Oversight Office (ISOO), is thegovernment-wide executive agentresponsible for implementing the CUI program.
Source:
32 CFR Part 2002 - Controlled Unclassified Information (CUI)
Executive Order 13556 - Controlled Unclassified Information
CUI Registry - https://www.archives.gov/cui
NARA:
Maintains theCUI Registry,
Issuesmarking and handling guidance,
DefinesCUI categoriesand their authority under law or regulation,
Trains and informs Federal agencies and contractors on CUI policy.
#Why the Other Options Are Incorrect
B). NIST
#NIST (National Institute of Standards and Technology) developstechnical standards(e.g., SP 800-171), but it doesnot define or mark CUI. It helps secure CUI once it's identified.
C). CMMC-AB (now Cyber AB)
#The Cyber AB is theCMMC ecosystem's accreditation body, not a government agency, and hasno authority over CUI classification or marking.
D). Department of Homeland Security (DHS)
#While DHS mayhandle and protect CUI internally, it is not the executive agent for the CUI program.
NARAis theofficial U.S. government authorityresponsible for defining, categorizing, and marking CUI via theCUI Registryand associated policies underExecutive Order 13556.

1. Understanding the Role of Assessment Objectives in CMMC 2.0
Theassessment objectivesfor each CMMC practice define thespecific criteriathat an assessor uses to evaluate whether a practice is implemented correctly. These objectives break down each control into measurable components, ensuring a structured and consistent assessment process.
To determine where these objectives are best documented, we need to consider theofficial CMMC documentation sources.
2. Why Answer Choice "D" is Correct - CMMC Assessment Guide Levels 1 and 2 TheCMMC Assessment Guide (Levels 1 & 2)is theprimary documentthat provides:
#The detailedassessment objectivesfor each practice
#A breakdown of the expectedevidence and implementation details
#Step-by-stepassessment criteriafor assessors to verify compliance
Each CMMC practice in the Assessment Guide is aligned with the correspondingNIST SP 800-171 or FAR
52.204-21 control, and the guide specifies:
How to assess compliancewith each practice
What evidenceis required for validation
What stepsan assessor should follow
#Reference from Official CMMC Documentation:
CMMC Assessment Guide - Level 2 (Aligned with NIST SP 800-171)explicitly states:
"Each practice is assessed based on defined assessment objectives to determine if the practice is MET or NOT MET." CMMC Assessment Guide - Level 1 (Aligned with FAR 52.204-21)provides similar objectives tailored for foundational cybersecurity requirements.
Thus,CMMC Assessment Guide Levels 1 & 2 are the BEST sources for assessment objectives.
3. Why Other Answer Choices Are Incorrect
Option
Reason for Elimination
A). CMMC Glossary
#The glossary only defines terminology used in CMMC but does not provide assessment objectives.
B). CMMC Appendices
#The appendices contain supplementary details, but they do not comprehensively list assessment objectives for each practice.
C). CMMC Assessment Process (CAP)
#While the CAP document describes the assessmentworkflow and methodology, it does not outline the specific objectives for each practice.
4. Conclusion
To locate thebest reference for assessment objectives, theCMMC Assessment Guide Levels 1 & 2are the most authoritative and detailed sources. They contain step-by-step assessment criteria, ensuring that practices are evaluated correctly.
#Final Answer:
D). CMMC Assessment Guide Levels 1 and 2

Under DFARS and CMMC requirements, the prime contractor is responsible for ensuring its subcontractors meet the required CMMC level. Neither the DoD, The Cyber AB, nor OUSD A&S directly manages subcontractor certification.
Supporting Extracts from Official Content:
* DFARS 252.204-7021: "The contractor shall ensure that its subcontractors have the appropriate CMMC level certification for the information they will handle." Why Option D is Correct:
* Compliance responsibility flows through the contractor supply chain.
* CMMC-AB (The Cyber AB) accredits assessors but does not police subcontractors.
* OUSD A&S sets policy, not enforcement at contract level.
* DoD agencies only require compliance at award/contract oversight level.
References (Official CMMC v2.0 Content):
* DFARS 252.204-7021.
* CMMC Model v2.0 governance guidance.

During aCMMC assessment, assessors rely on interviews to validate the implementation of cybersecurity practices within anOrganization Seeking Certification (OSC). Ensuringconfidentiality and non- attributionallows employees to speak freely without fear of retaliation or bias, leading to more accurate and candid responses.
Step-by-Step Breakdown:
CMMC Assessment Process and the Role of Interviews
TheCMMC Assessment Guide(Level 2) states thatinterviews are a key methodto verify compliance with security controls.
Employees may hesitate to provide truthful information if they fear negative consequences.
To obtain accurate information, assessors must create an environment where team members feel safe.
Ensuring Non-Attribution for Accurate Responses
DoD Assessment Methodologyhighlights thatinterviewees should remain anonymousin reports.
Non-attribution reduces the risk of OSC leadership influencing responses or retaliating against employees.
Employees are more likely to provideaccurateandhonestdescriptions of their responsibilities when confidentiality is guaranteed.
Why the Other Answer Choices Are Incorrect:
(A) Interview groups of people to get collective answers:
Group interviews may limit honest responses due topeer pressure or management presence.
Employees mayhesitate to contradictsupervisors or peers in a group setting.
(B) Understand that testing is more important than interviews:
While testing (e.g., reviewing logs, configurations, and security settings) is crucial, interviews providecontexton how security practices are implemented and followed.
Interviewscomplementtesting rather than being less important.
(D) Let team members know the questions prior to the assessment:
Advanced notice may allow employees toprepare rehearsed answers, which might not reflect actual practices.
This couldreduce the effectivenessof the interview process.
Final Validation from CMMC Documentation:
TheCMMC Assessment Process Guideand DoDAssessment Methodologyemphasize the importance of confidentiality in interviews to ensure accuracy.Non-attribution protects employees and ensures assessors get honest, unfiltered answers.
Thus, the correct answer is:
C). Ensure confidentiality and non-attribution of team members.

Understanding Access Control in CMMC
Access control refers to the process ofgranting or denyingspecific requests to:
Obtain and use information
Access information processing services
Enter specific physical locations
TheAccess Control (AC) domain in CMMCis based onNIST SP 800-171 (3.1 Access Control family)and includes requirements to:
#Implement policies for granting and revoking access.
#Restrict access to authorized personnel only.
#Protect physical and digital assets from unauthorized access.
Since the questionbroadly asks about the process of granting or denying access to information, services, and physical locations, the correct answer isA. Access Control.
Why the Other Answers Are Incorrect
B). Physical access control
#Incorrect.Physical access controlis asubsetof access control that only applies tophysical locations(e.g., keycards, security guards, biometrics). The question includesinformation and services, makinggeneral access controlthe correct choice.
C). Mandatory access control (MAC)
#Incorrect.MAC is a specific type of access controlwhere access is strictly enforced based onsecurity classifications(e.g., Top Secret, Secret, Confidential). The questiondoes not specify MAC, so this is incorrect.
D). Discretionary access control (DAC)
#Incorrect.DAC is another specific type of access control, whereownersof data decide who can access it. The question asksgenerallyabout granting/denying access, makingaccess control (A)the best answer.
CMMC Official References
CMMC 2.0 Model - AC.L2-3.1.1 to AC.L2-3.1.22- Covers access control requirements, includingcontrolling access to information, services, and physical spaces.
NIST SP 800-171 (3.1 - Access Control Family)- Defines the general principles of access control.
Thus,option A (Access Control) is the correct answer, as it best aligns withCMMC access control requirements.