MENU
The assessor begins the assessment by meeting with the client's stakeholders and learns that multiple subsidiaries exist. In order to perform a complete assessment, the assessor must review documents from multiple entities as multiple, corresponding Commercial and Government Entity (CAGE) codes were provided. Which of the following entities may receive certification as a result of this?
Certification can only be granted to the legal entities that own the CAGE codes under assessment. If multiple CAGE codes are in play (HQ, host, and supporting units), and they are all included in scope, then all entities with corresponding CAGE codes that were assessed can be certified.
Exact Extracts:
CMMC Assessment Guide: ''The CMMC certificate is issued to the legal entity (as identified by the CAGE code(s)) that was assessed.''
''When multiple CAGE codes are presented, all in-scope entities must provide documentation and may be certified if assessed.''
''Certification applies to the OSC legal entity (or entities) within scope, including HQ, host, and supporting units, as applicable.''
Why other options are not correct:
A/B/C: Limit scope to only HQ or subsets, but the requirement is that all entities with provided and in-scope CAGE codes are eligible.
CMMC Assessment Guide -- Level 2, Version 2.13: Certification applicability to CAGE codes and organizational entities (pp. 3--5).