MENU
The CMMC Level 2 assessment methods include examination and can include:
CMMC Level 2 Assessment MethodsCMMC Level 2 assessments focus on verifying compliance withNIST SP 800-171 requirements. TheCMMC Assessment Process (CAP) Documentspecifies that assessments at this level include:
Examination-- Reviewing documents, mechanisms, and activities.
Interview-- Speaking with personnel to validate implementation.
Testing-- Observing and verifying security controls in action.
What Does 'Examination' Include?According toCMMC Assessment Methodology, examination involves reviewing:
Documents(Policies, procedures, security plans)
Mechanisms(Security controls, authentication systems)
Activities(Backup operations, network monitoring, security training)
Sinceexamination includes reviewing documents, mechanisms, and activities, the correct answer isA.
B . Specific hardware, software, or firmware safeguards employed within a system.Incorrect. While safeguardsmaybe examined, CMMC does not limit examination to only hardware, software, or firmware. The definition is broader.
C . Policies, procedures, security plans, penetration tests, and security requirements.Incorrect. Whilesome of these itemsare examined, penetration tests arenot requiredin a CMMC Level 2 assessment.
D . Observation of system backup operations, exercising a contingency plan, and monitoring network traffic.Incorrect. These activities fall undertesting and interviews, not just examination.
Why the Other Answers Are Incorrect
CMMC Assessment Process (CAP) Document-- Defines 'examination' as reviewingdocuments, mechanisms, and activities.
CMMC Official ReferenceThus,option A (documents, mechanisms, or activities) is the correct answer, as it aligns with CMMC Level 2 assessment methodology.