Discuss Cyber AB CMMC-CCP Exam Topic 4 Question 12

The facilities manager for a company has procured a Wi-Fi enabled, mobile application-controlled thermostat for the server room, citing concerns over the inability to remotely gauge and control the temperature of the room. Because the thermostat is connected to the company's FCI network, should it be assessed as part of the CMMC Level 1 Self-Assessment Scope?

ANo, because it is OT

BNo, because it is an loT device

CYes. because it is a restricted IS

DYes, because it is government property

Suggested Answer: C

Step 1: Understanding CMMC Level 1 Self-Assessment Scope

CMMC Level 1applies toFederal Contract Information (FCI)systems.

Any system or device that is connected to an FCI-handling network is within the assessment scopebecause it canintroduce vulnerabilitiesinto the environment.

Step 2: Why the Thermostat is in Scope

TheWi-Fi-enabled thermostat is connected to the FCI network, meaning it haspotential accessto sensitive contract-related data.

PerCMMC Scoping Guidance, this type of device is classified as aRestricted Information System (Restricted IS)---devices that do not store, process, or transmit FCI but areconnected to networks that do.

Restricted IS must be accounted for in the self-assessment scope to ensure they do not compromise security controls.

CMMC Level 1 Scoping Guidance

CMMC Assessment Process (CAP) Guide

Step 3: Why Other Answer Choices Are Incorrect

A . No, because it is OT (Incorrect):

Operational Technology (OT)includesindustrial control systemsbut does not exempt a device from assessmentif it connects to an FCI network.

B . No, because it is an IoT device (Incorrect):

IoT (Internet of Things) devicesthat areconnected to an FCI network must be assessedto ensure they do not create security vulnerabilities.

D . Yes, because it is government property (Incorrect):

Theownershipof the device (government or company) doesnotdetermine its inclusion in the CMMC assessment scope---its network connectivity does.

Final Confirmation of Correct Answer:

The thermostat is part of the CMMC Level 1 Self-Assessment Scope as a Restricted IS.

Thus, the correct answer is:C. Yes, because it is a restricted IS

Get Premium CMMC-CCP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

20 comments · newest first

Marquetta 1 month ago

Yeah, but OT devices usually aren't included in assessments.

Van 1 month ago

I lean towards option C. We can't ignore any connected device.

Annice 2 months ago

Government property? That makes it important to assess.

Kris 2 months ago

I disagree. It's a restricted IS, so it matters for security.

Layla 2 months ago

But it's just an IoT device, right? Doesn't seem critical.

Lashawnda 2 months ago

I think it should be assessed. It's part of the network.

Marvel 2 months ago

I say yes, better safe than sorry with restricted IS!

Bernadine 2 months ago

Wait, is it really considered government property?

Wilbert 3 months ago

Agreed, it’s crucial to monitor server room temps!

Anisha 3 months ago

I think it's just an IoT device, so no need for that.

Barabara 3 months ago

Definitely should be assessed, it's part of the network.

Mari 3 months ago

Yeah, but what if it gets hacked? Better safe than sorry!

Audry 3 months ago

It's OT, so I think it shouldn't count for the assessment.

Jillian 4 months ago

Surprised this is even a question, seems obvious to include it!

Venita 5 months ago

I disagree, it should be assessed since it's on the FCI network.

Dortha 5 months ago

Definitely a no, it's just an IoT device.

Roslyn 6 months ago

I’m confused about whether it being government property matters here. I thought that only applied to certain types of equipment.

Thora 6 months ago

I lean towards option C because it’s connected to the FCI network, which seems like it would make it part of the restricted information systems.

Slyvia 6 months ago

I remember a practice question where we discussed whether OT devices are included in assessments. This feels similar, but I can't recall the specifics.

Eun 6 months ago

I think it might be considered an IoT device, but I'm not entirely sure if that automatically excludes it from the CMMC scope.

Cyber AB CMMC-CCP Exam - Topic 4 Question 12 Discussion