Understanding Access Control in CMMC
Access control refers to the process ofgranting or denyingspecific requests to:
Obtain and use information
Access information processing services
Enter specific physical locations
TheAccess Control (AC) domain in CMMCis based onNIST SP 800-171 (3.1 Access Control family)and includes requirements to:
#Implement policies for granting and revoking access.
#Restrict access to authorized personnel only.
#Protect physical and digital assets from unauthorized access.
Since the questionbroadly asks about the process of granting or denying access to information, services, and physical locations, the correct answer isA. Access Control.
Why the Other Answers Are Incorrect
B). Physical access control
#Incorrect.Physical access controlis asubsetof access control that only applies tophysical locations(e.g., keycards, security guards, biometrics). The question includesinformation and services, makinggeneral access controlthe correct choice.
C). Mandatory access control (MAC)
#Incorrect.MAC is a specific type of access controlwhere access is strictly enforced based onsecurity classifications(e.g., Top Secret, Secret, Confidential). The questiondoes not specify MAC, so this is incorrect.
D). Discretionary access control (DAC)
#Incorrect.DAC is another specific type of access control, whereownersof data decide who can access it. The question asksgenerallyabout granting/denying access, makingaccess control (A)the best answer.
CMMC Official References
CMMC 2.0 Model - AC.L2-3.1.1 to AC.L2-3.1.22- Covers access control requirements, includingcontrolling access to information, services, and physical spaces.
NIST SP 800-171 (3.1 - Access Control Family)- Defines the general principles of access control.
Thus,option A (Access Control) is the correct answer, as it best aligns withCMMC access control requirements.

Understanding the CMMC Assessment Process (CAP) Phases
TheCMMC Assessment Process (CAP)consists ofthree primary phases:
Phase 1 - Planning(Pre-assessment activities)
Phase 2 - Conducting the Assessment(Evidence collection and analysis)
Phase 3 - Reporting and Finalizing Results
DuringPhase 3, the Assessment Teamreviews evidenceto confirm if anyLimited Practice Deficiency Correctionshave been successfully implemented.
Scoring Practices in Phase 3
The CAP document specifies that a practice can bescored as METif:
#The deficiency identified in Phase 2 has been fully corrected before final scoring.
#Sufficient evidence is provided to demonstrate compliance with the CMMC requirement.
#The correction is notmerely plannedbutfully implemented and validatedby the assessors.
Since the evidence shows thatdeficiencies have been corrected, the correct score isMET.
Why the Other Answers Are Incorrect
B). POA&M (Plan of Action & Milestones)
#Incorrect. APOA&M (Plan of Action and Milestones)is usedonly when a deficiency remains unresolved.
Since the deficiency is already corrected, this option does not apply.
C). NOT MET
#Incorrect. A practice is scoredNOT METonly if the deficiency hasnotbeen corrected by the end of the assessment.
D). NOT APPLICABLE
#Incorrect. A practice is markedNOT APPLICABLE (N/A)only if it doesnot apply to the organization's environment, which is not the case here.
CMMC Official References
CMMC Assessment Process (CAP) Document- Defines scoring criteria for MET, NOT MET, and POA&M.
Thus,option A (MET) is the correct answer, as the deficiencies have been corrected before final scoring.

Understanding the CMMC Level 2 Assessment Process
When anOrganization Seeking Certification (OSC)engages aCertified Third-Party Assessment Organization (C3PAO)to conduct aCMMC Level 2 Assessment, anAssessment Planis developed to outline the scope, methodology, and logistics of the assessment.
Who Signs Off on the Assessment Plan?
According to theCMMC Assessment Process (CAP) Guide, theAssessment Plan must be formally agreed upon and signed off by:
Lead Assessor- The individual responsible for overseeing the execution of the assessment.
C3PAO (Certified Third-Party Assessment Organization)- The entity conducting the assessment.
Why "C. Lead Assessor and C3PAO" is Correct?
TheLead Assessorensures that theAssessment Plan aligns with CMMC-AB and DoD requirements, including methodology, objectives, and evidence collection.
TheC3PAOprovides organizational approval, confirming that the assessment is conducted according toCMMC-AB rules and contractual agreements.
Why Other Answers Are Incorrect?
A). OSC and Sponsor (Incorrect)
TheOSC (Organization Seeking Certification)is involved in planning but does not sign off on the plan.
Asponsoris not part of the sign-off process in CMMC assessments.
B). OSC and CMMC-AB (Incorrect)
TheOSCdoes not formally approve theAssessment Plan-this responsibility belongs to the assessment team.
TheCMMC-ABdoes not sign off on individualAssessment Plans.
D). C3PAO and Assessment Official (Incorrect)
"Assessment Official" isnot a defined rolein the CMMC assessment process.
TheC3PAOis involved, but it must be theLead Assessorwho signs off, not an unspecified official.
Conclusion
The correct answer isC. Lead Assessor and C3PAO.
TheLead Assessorensures assessment integrity, while theC3PAOprovides official authorization.
References:
CMMC Assessment Process (CAP) Guide
CMMC 2.0 Level 2 Certification Procedures
The Cyber AB Assessment Guidelines

Understanding the Assessment Environment Requirement
During aCMMC Level 2 assessment, assessors requireobjective evidencethat security controls are implementedin the actual operating environmentwhereControlled Unclassified Information (CUI)is handled.
This means thattests or demonstrations must be conducted in the production environment, where the organization's real systems and security controls are in use.
Why Option B (Production) is Correct
Assessment teams need to validate security controls in the actual environment where they are applied, ensuring that security measures are in effect in thereal-world operating conditions.
Option A (Client)is incorrect because "Client" is not a defined assessment environment.
Option C (Development)is incorrect because testing in a development environmentdoes not accurately represent the production security posture.
Option D (Demonstration)is incorrect becausedemonstrations in a separate test environment do not provide valid evidence for CMMC assessments-actual security implementations must be verified in production.
Official CMMC Documentation References
CMMC Assessment Process (CAP) Guide - Section 3.5 (Assessment Methods)
NIST SP 800-171 Assessment Procedures(Verification must occur in the actual system where CUI resides.) Final Verification SinceCMMC assessments require security controls to be validated in the actual production environment, the correct answer isOption B: Production.

1. Understanding the Validation of Findings in CMMC Assessments
Validation of findings is an essential part of theCMMC assessment process, ensuring that observations and preliminary conclusions drawn by the assessment team are accurate, fair, and based on complete evidence.
This process occurs iteratively during theDaily Checkpointsand is fundamental in determining the overall compliance status of theOrganization Seeking Certification (OSC).
2. The Role of Preliminary Findings in the Assessment Process
Preliminary findings arenot finalbut rather a mechanism for ensuring transparency, accuracy, and fairness.
These findings serve several key purposes:
Allows for OSC Input & Clarification: The OSC has an opportunity to review andprovide additional evidencethat may address deficiencies identified by the assessment team.
Prevents Misinterpretations: By allowing the OSC to comment, the assessment team can refine or correct their understanding of the OSC's implementation of CMMC practices.
Supports Fair and Informed Ratings: Before finalizing MET or NOT MET determinations, the assessment team ensures they have considered all relevant evidence.
Encourages a Collaborative Assessment Process: This validation activity fosters open communication between assessors and the OSC, reducing disputes and misunderstandings.
3. Why Answer Choice "A" is Correct
The primary purpose of preliminary findings is to allow theOSC to comment and provide additional evidencebefore final determinations are made.
This aligns withCMMC Assessment Process guidance, which emphasizes iterative validation of findings throughDaily Checkpoints and Final Outbriefdiscussions.
The validation of findings ensures thatOSC responses and supplementary evidence are considered, making the assessment process more accurate and fair.
4. Why Other Answer Choices Are Incorrect
Option
Reason for Elimination
B). It determines whether the OSC will be rated MET or NOT MET on their assessment.
Incorrect: Preliminary findings do not directly determine the final rating. The assessment team reviews all collected evidence before making a final decision.
C). It confirms that the Assessment Team's findings are right and cannot be changed.
Incorrect: Findings arenot finalat the preliminary stage. The OSC has the opportunity to challenge findings by providing new or clarifying evidence.
D). It corroborates the Assessment Team's understanding of the CMMC practices and controls.
Partially Correct but Not the Best Answer: While validation helps refine understanding, itsprimary function is to allow OSC input, making optionA the most accurate choice.
5. Official CMMC References Supporting This Answer
CMMC Assessment Process (CAP) Document:
Section 5.3 - Validation of Findings: "The OSC is given the opportunity to provide additional evidence and comments to clarify or supplement preliminary assessment results." Section 5.4 - Daily Checkpoints: "The assessment team discusses preliminary findings with the OSC, allowing the organization to address concerns in real time." CMMC 2.0 Level 2 Scoping & Assessment Guide:
Confirms that the assessment process includes continuous dialogue with the OSC before final determinations are made.
6. Conclusion
Preliminary findings are acrucial validation stepin CMMC assessments, ensuring that organizations have the opportunity toprovide additional evidence and clarify potential misunderstandings. This iterative process improves accuracy and fairness in determining compliance with CMMC requirements. Therefore, the correct answer is:
A). It allows the OSC to comment and provide additional evidence.