Discuss Cyber AB CMMC-CCA Exam Topic 4 Question 10

During an assessment, the OSC was found to have implemented 68% of CMMC practice SC.L2-3.13.11 -- CUI Encryption. However, the OSC Assessment Official cited issues with the vendor for not fully implementing the practice. Nonetheless, it has been listed in their POA&M. Which of the following is true regarding the use of a POA&M during a CMMC assessment?

AA POA&M addressing unimplemented security requirements is not a substitute for a completed CMMC practice

BA POA&M can be used as evidence of full implementation for any unimplemented CMMC practices

CIf a practice is listed in the POA&M, it is considered fully implemented during the assessment

DAssessors are required to accept any POA&M as evidence of implementation for partially implemented practices

Suggested Answer: A

Comprehensive and Detailed In-Depth Explanatio n:

SC.L2-3.13.11 (5-point practice) requires full implementation for certification. Per CAP, a POA&M documents deficiencies but isn't a substitute for completion (A). Options B, C, and D contradict CMMC rules, as partial implementation or POA&M listing doesn't equate to Met status, especially for 5-point practices ineligible for POA&M deferral.

Extract from Official CMMC Documentation:

CMMC Assessment Guide Level 2 (v2.0), SC.L2-3.13.11: 'Full implementation required.'

CAP v5.6.1: 'POA&M not a substitute for Met status.'

Resources:

https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf

Get Premium CMMC-CCA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Catarina 1 month ago

No way, C is misleading. Just being on a POA&M doesn’t mean it’s done.

Allene 1 month ago

I’m leaning towards B. A POA&M should show intent, right?

Glenna 2 months ago

Agreed, A makes the most sense. It’s about real security, not just paperwork.

Lawana 2 months ago

I think A is correct. A POA&M can't replace actual implementation.

Keneth 2 months ago

C is definitely wrong. Just being on a POA&M doesn’t mean it's done.

Louvenia 2 months ago

I feel like B is misleading. A POA&M shows intent, not completion.

Bok 2 months ago

Agreed, A makes sense. Evidence needs to be concrete.

Flo 2 months ago

I think A is correct. A POA&M can't replace actual implementation.

Lemuel 3 months ago

C is definitely wrong. Just being on the POA&M doesn’t mean it’s done.

Shanice 3 months ago

B sounds tempting, but it’s misleading. POA&M is not full evidence.

Stephaine 3 months ago

Agreed, A makes sense. You need to show full compliance.

Felton 3 months ago

I think A is correct. A POA&M can't replace actual implementation.

Delisa 3 months ago

No way, a POA&M can't count as full implementation!

Coral 4 months ago

I think assessors should consider POA&Ms more.

Jin 5 months ago

Wait, so they can't just rely on the POA&M? That's surprising!

Oliva 5 months ago

Totally agree, it’s just a plan, not proof.

Antonio 5 months ago

A POA&M isn't a substitute for actual implementation.

Gearldine 6 months ago

No way, a POA&M can't count as full implementation!

Reiko 6 months ago

I think assessors should consider POA&Ms more.

Vince 6 months ago

Wait, so they can't just rely on the POA&M? That's surprising!

Ben 6 months ago

Totally agree, it’s just a plan, not proof.

Crista 6 months ago

A POA&M isn't a substitute for actual implementation.

Elmer 6 months ago

I recall that assessors have to be strict about what counts as evidence, so D seems wrong too. A must be the answer!

Sharen 7 months ago

I practiced a similar question, and I believe C is definitely incorrect because just being on the POA&M doesn't mean it's implemented.

Tyra 7 months ago

I'm a bit unsure, but I think B sounds tempting since it mentions evidence, but I feel like that's not how it works.

Jutta 7 months ago

I remember that a POA&M can't replace actual implementation, so I think A is the right choice.

Cyber AB CMMC-CCA Exam - Topic 4 Question 10 Discussion