ACertified Third-Party Assessor Organization (C3PAO)is responsible for conductingCMMC Level 2 Assessments. Before the assessment begins, the C3PAO must develop anAssessment Plan, which includes several key elements.
The part of the plan that captures:
#Names of interviewees
#Facilities to be utilized
#Estimated costs
#Assessment schedule
falls under the"Identify Resources and Schedule"section of the plan.
Step-by-Step Breakdown:
#1. Identify Resources and Schedule
This section of theCMMC Assessment Planoutlines:
Thepersonnelinvolved (e.g., interviewees, assessors).
Thelocationswhere the assessment will take place.
Thetimeline and scheduling details.
Theestimated costsassociated with the assessment.
This ensures that all necessaryresourcesare allocated and that the assessment proceeds as planned.
#2. Why the Other Answer Choices Are Incorrect:
(B) Select Assessment Team Members#
This section focuses onchoosing the assessorswho will conduct the evaluation, not listing interviewees and facilities.
(C) Identify and Manage Assessment Risks#
This part of the plandocuments risks(e.g., scheduling conflicts, data access issues), but it doesnot outline names, facilities, or costs.
(D) Select and Develop the Evidence Collection Approach#
This step defineshowevidence will be gathered (e.g., document reviews, interviews, system testing) but doesnot focus on logistics.
Final Validation from CMMC Documentation:
TheCMMC Assessment Process Guidestates thatresource identification and schedulingare essential for organizing the assessment. Since this sectioncaptures interviewees, facilities, costs, and the schedule, the correct answer is:
#A. Identify resources and schedule.

When a company usesthird-party IT providersto manage their infrastructure, these organizations are classified asExternal Service Providers (ESPs)underCMMC scoping guidelines.
Step-by-Step Breakdown:
#1. What is an ESP?
External Service Providers (ESPs)arethird-party organizationsthat:
ProvideIT services, cloud hosting, and managed security solutions.
Process, store, or transmit FCI or CUIon behalf of a contractor.
Mustmeet the same security requirementsas the OSC if they handle FCI or CUI.
If a company relies ona hosting provider to manage IT infrastructure, that provider is anESPunderCMMC scoping guidelines.
#2. Why the Other Answer Choices Are Incorrect:
(B) People#
Incorrect:ESPs areorganizations, not individual people.
(C) Facilities#
Incorrect:Facilities refer tophysical locationslike office buildings or data centers, not third-partyservice providers.
(D) Technology#
Incorrect:While ESPs provide technology services, the correct term forthird-party IT providersunder CMMC isESPs, not just "Technology." Final Validation from CMMC Documentation:
TheCMMC Level 1 Scoping GuidedefinesExternal Service Providers (ESPs)asthird-party organizations that manage IT infrastructure and security services.
Thus, the correct answer is:
#A. ESPs (External Service Providers).

Understanding CMMC 2.0 Incident Response Practices
TheIncident Response (IR) domaininCMMC 2.0 Level 2aligns withNIST SP 800-171, Section 3.6, which defines requirements forestablishing and maintaining an incident response capability.
Why "A. IR.L2-3.6.1: Incident Handling" is Correct?
The documentation provideddescribes an incident response capability that includes preparation, detection, analysis, containment, recovery, and user response activities.
IR.L2-3.6.1specifically requires organizations toestablish an incident handling processcovering:
Preparation
Detection & Analysis
Containment
Eradication & Recovery
Post-Incident Response
Why Other Answers Are Incorrect?
B). IR.L2-3.6.2: Incident Reporting (Incorrect)
Incident reporting focuses on reporting incidents to external parties (e.g., DoD, DIBNet),which isnot what the provided documentation describes.
C). IR.L2-3.6.3: Incident Response Testing (Incorrect)
Incident response testing ensures that the response process is regularly tested and evaluated,which isnot the primary focus of the documentation provided.
D). IR.L2-3.6.4: Incident Spillage (Incorrect)
Incident spillage specifically refers to CUI exposure or handling unauthorized CUI incidents,which isnot the scenario described.
Conclusion
The correct answer isA. IR.L2-3.6.1: Incident Handling, as the documentationattests to the establishment of an incident response capability.
References:
CMMC 2.0 Level 2 Practices (NIST SP 800-171, Section 3.6)
CMMC Assessment Process (CAP) Guide

According to the CMMC Assessment Process (CAP), specifically during the Phase 3: Conduct Assessment (Evidence Collection and Verification), the Assessment Team must evaluate all collected artifacts, interview notes, and test results against two primary dimensions: Adequacy and Sufficiency.
Adequacy (The "Right" Evidence): This criterion focuses on the quality, relevance, and validity of the evidence. It addresses whether the evidence actually maps to the specific CMMC practice being assessed and whether it is authoritative (e.g., signed, current, and from a trusted source). If an assessor asks, "Is this theright piece of information to prove this practice is met?" they are testing for Adequacy.
Sufficiency (The "Enough" Evidence): This criterion focuses on the quantity and scope of the evidence. It addresses whether the Assessment Team has collected enough data points (across the required number of assets and using the required methods of Examine, Interview, and Test) to reach a confident conclusion. If an assessor asks, "Do I haveenoughexamples of this practice in action across the entire enclave?" they are testing for Sufficiency.
Why other options are incorrect:
B and D (Objectivity/Subjectivity): While assessors must remain objective, these are not the formal "criteria" used to categorize the evidence collection quality within the CAP framework.
C (Sufficiency): As noted above, Sufficiency is about theamountof evidence, not whether it is thecorrect type (the "right" evidence).
Reference Documents:
CMMC Assessment Process (CAP) v1.0: Section 3.4, "Collect and Verify Evidence," which explicitly defines the requirement for evidence to be both adequate and sufficient.
CMMC Level 2 Assessment Guide: Guidance on the application of the Examine, Interview, and Test (E-I-T) methods to ensure evidence quality.
NIST SP 800-171A: The foundation for CMMC assessment procedures, which emphasizes the need for relevant (adequate) evidence to support findings.

Understanding Federal Contract Information (FCI)
Federal Contract Information (FCI) is defined by48 CFR 52.204-21(Basic Safeguarding of Covered Contractor Information Systems). FCI refers to information that:
Is NOT intended for public release.
Is provided by or generated for the government under a contract.
Is necessary to develop or deliver a product or service to the government.
Excludes publicly available government information(such as information on public websites).
Excludes simple transactional information(e.g., necessary to process payments).
In the context ofCMMC 2.0, organizations thatprocess, store, or transmit FCImust meetCMMC Level 1 (Foundational), which requires implementing17 basic safeguarding practicesoutlined inFAR 52.204-21.
Why is the Correct Answer FCI (D)?
A). CDI (Controlled Defense Information)# Incorrect
This term was used inDFARS 252.204-7012but has been replaced byCUI (Controlled Unclassified Information)in CMMC discussions.
B). CTI (Cyber Threat Intelligence)# Incorrect
This refers to intelligence on cyber threats, tactics, and indicators, not contractual data.
C). CUI (Controlled Unclassified Information)# Incorrect
CUI is sensitive information requiring additional safeguarding but is a separate category from FCI.
D). FCI (Federal Contract Information)#Correct
The definition of FCI explicitly matches the description given in the question.
CMMC 2.0 References Supporting this Answer:
FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems) Defines FCI and the required safeguards.
Establishes17 cybersecurity practicesfor FCI protection.
CMMC 2.0 Framework
Level 1 (Foundational)is required for contractors handlingFCI.
Ensures compliance withbasic safeguarding requirementsoutlined inFAR 52.204-21.
NIST SP 800-171 and DFARS 252.204-7012
FCI doesnotrequire compliance withNIST SP 800-171, butCUI does.