CMMC Level 1 practices correspond directly to the basic safeguarding requirements for Federal Contract Information (FCI), which are codified in FAR clause 48 CFR 52.204-21. These 15 requirements form the foundation for Level 1 compliance.
Supporting Extracts from Official Content:
48 CFR 52.204-21: "Contractors shall apply the following 15 basic safeguarding requirements to protect Federal Contract Information (FCI)." CMMC Model v2.0 Overview: "Level 1 corresponds to the 15 basic safeguarding requirements in FAR
52.204-21."
Why Option C is Correct:
FAR 52.204-21 is the source for Level 1 practices.
NIST SP 800-171 applies to CUI and Level 2, not Level 1.
NIST SP 800-171b is the precursor to NIST SP 800-172 (used for Level 3).
DFARS 252.204-7012 covers CUI safeguarding and incident reporting, not Level 1 FCI requirements.
References (Official CMMC v2.0 Content):
FAR 48 CFR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
CMMC Model v2.0, Level 1 Overview.

In theCMMC 2.0 Assessment Process, after theAssessment Final Recommended Findings Brief, theLead Assessor and Assessment Team Membersmustreview the accuracy and validity of the Organization Seeking Certification (OSC)'s updated Plan of Action & Milestones (POA&M) and any accompanying evidence or scheduled collectionswithin180 days.
Relevant CMMC 2.0 Reference:
TheCMMC Assessment Process (CAP)outlines that organizations haveup to 180 daysto address identifieddeficienciesafter their initial assessment.
During this time, the OSC can update itsPOA&M with additional evidenceto demonstrate compliance.
Why is the Correct Answer 180 Days (B)?
A). 90 days # Incorrect
The CMMC CAP does not impose a90-day limiton POA&M updates; instead,180 daysis the standard timeframe.
B). 180 days # Correct
PerCMMC Assessment Process guidelines, theLead Assessor and Teammust review updateswithin 180 days.
C). 270 days # Incorrect
No official CMMC documentation mentions a270-dayreview period.
D). 360 days # Incorrect
The process must be completedfar sooner than 360 daysto maintain compliance.
CMMC 2.0 References Supporting this Answer:
CMMC Assessment Process (CAP) Document
Defines the180-day windowfor the OSC to update itsPOA&M and submit evidencefor review.
CMMC 2.0 Official Guidelines
Specifies that organizations are givenup to 180 daysto remediate deficiencies before reassessment.

Understanding the Role of the Lead Assessor in CMMC Assessments
TheLead Assessoris responsible for managing theAssessment Teamand ensuring that all team members meet the required qualifications as defined by theCMMC Accreditation Body (CMMC-AB)and theCybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) Guide.
Why the Correct Answer is "C. Lead Assessor"?
Lead Assessor's Key Responsibilities (Per CAP Guide)
Verify team member qualificationsto ensure compliance with CMMC-AB guidelines.
Assignappropriate assessment tasksbased on team members' expertise.
Ensure that theassessment is conducted in accordance with CMMC procedures.
Why Not the Other Options?
A). C3PAO (Certified Third-Party Assessor Organization)#Incorrect
AC3PAOis responsible fororganizing assessmentsand ensuring their execution, but itdoes not verify individual team member qualifications-that responsibility belongs to theLead Assessor.
B). CMMC-AB (CMMC Accreditation Body)#Incorrect
TheCMMC-ABestablishestraining and certification requirements, but itdoes not verify individual assessment team members-that responsibility is given to theLead Assessor.
D). CMMC Marketplace#Incorrect
TheCMMC Marketplacelists authorizedC3PAOs, Registered Practitioners (RPs), and Certified Professionals (CCPs)butdoes not verify assessment team qualifications.
Relevant CMMC 2.0 References:
CMMC Assessment Process (CAP) Guide- Defines theLead Assessor's responsibilityfor verifying assessment team qualifications.
CMMC-AB Certification Guide- Specifies that the Lead Assessor must ensure all assessment team members meet CMMC-AB qualification standards.
Final Justification:
Since theLead Assessor is responsible for verifying assessment team member qualifications, the correct answer isC. Lead Assessor.

What Happens in Phase 4 of the CMMC Assessment Process?
Phase 4 of theCMMC Assessment Process (CAP)is theFinal Reporting and Decision Phase. During this phase, theLead Assessormust:
Review all assessment findings
Determine the Organization Seeking Certification's (OSC) eligibility for certification Make a recommendation to the C3PAO (Certified Third-Party Assessment Organization) Key Responsibilities of the Lead Assessor in Phase 4:
Ensure that the OSC hasmet the required practices and processes.
Confirm that anydeficiencieshave been corrected or appropriately documented.
Recommendwhether the OSC is eligible for certificationbased on assessment results.
Since theLead Assessor must determine and recommend the OSC's eligibilityto the C3PAO, the correct answer isB. Eligibility.
Why the Other Answers Are Incorrect
A). Ability
#Incorrect. While assessing an OSC's ability to meet CMMC requirements is part of the process, the final determination in Phase 4 is abouteligibilityfor certification.
C). Capability
#Incorrect. Capability refers to an organization'stechnical and operational readiness. The Lead Assessor is making a recommendation oneligibility, not just capability.
D). Suitability
#Incorrect. Suitability is not a defined term in theCMMC CAP processfor final assessment recommendations.
The correct term iseligibility.
CMMC Official References
CMMC Assessment Process (CAP) Document- Specifies that the Lead Assessor must determine and recommend theeligibilityof the OSC in Phase 4.
CMMC 2.0 Model- Defines the assessment process, including certification decision-making.
Thus,option B (Eligibility) is the correct answer, as per official CMMC guidance.

During aCMMC assessment, organizations must provide evidence to demonstrate compliance with requiredpractices and processes. Assessors evaluate this evidence based on two key criteria:
Adequacy- Does the evidence meet the intent of the security requirement?
Sufficiency- Is there enough evidence to reasonably conclude that the practice/process is effectively implemented?
These principles are outlined in theCMMC Assessment Process Guide, which provides a structured approach for evaluating compliance.
Step-by-Step Breakdown:
#1. Adequacy - Does the evidence fully meet the requirement?
Adequacyrefers to whether the evidence properly demonstrates that the security practice has been implemented as required.
Example: If an organization claims to enforceMulti-Factor Authentication (MFA), an assessor would checksystem configurations, login policies, and user authentication logsto confirm that MFA is actually in use.
#2. Sufficiency - Is there enough evidence to support the claim?
Sufficiencymeans that there isenough supporting evidenceto prove compliance.
Example: If an organization providesonly one screenshot of an MFA login screen, that alone may not besufficient-additional logs, policies, and user records would help strengthen the case.
Why the Other Answer Choices Are Incorrect:
(B) Adequacy and Thoroughness#
Thoroughnessis not a defined metric in CMMC evidence evaluation.
The focus is onwhether the evidence meets the requirement (adequacy)and if there isenough of it (sufficiency).
(C) Sufficiency and Thoroughness#
Thoroughnessis not a recognized term in CMMC compliance validation.
Evidence must beadequate and sufficient, not just thorough.
(D) Sufficiency and Appropriateness#
Appropriatenessis not a CMMC-defined criterion.
Thecorrect terms used in CMMC assessmentsareAdequacy(Does it meet the requirement?) andSufficiency(Is there enough proof?).
Final Validation from CMMC Documentation:
CMMC Assessment Process Guideexplicitly states that evidence must be evaluated based onadequacyandsufficiencyto confirm compliance with security practices.