Step 1: Understand the Definitions of Evidence Evaluation Criteria
TheCMMC Assessment Process (CAP)introduces two key criteria for evaluating evidence:
Adequacy– Does the evidencealign with the practice?
Sufficiency– Is the evidencecomprehensive enoughin terms ofcoverage across systems, users, and scope?
CAP v1.0 – Section 3.5.4:
“Evidence must be evaluated for bothadequacy(is it the right evidence?) andsufficiency(is there enough of it across all in-scope assets and areas?) to score a practice as MET.”
✅Step 2: Applying to the Scenario
In the question, the Lead Assessor is asking the team toverify that evidence is sufficient across:
Domains
Practices
Host Units
Supporting Organizations
Enclaves
➡️This is adirect reference to sufficiency, which evaluates whether thebreadth and depthof evidence is enough to make an informed judgment that the control is truly implemented across theentire assessed environment.
❌Why the Other Options Are Incorrect
A. Adequacy
✘Adequacy refers to therelevanceof the evidence to the specific practice — not itscoverageacross scope.
B. Capability
✘Not a term used in evidence validation within CMMC CAP documentation.
D. Objectivity
✘While objectivity is important, it refers to theunbiased nature of assessment activities, not to theextent of evidence coverage.
When an assessor evaluates whether the evidence is broad enough across all necessary systems, units, and enclaves to score a practice as MET, they are evaluatingsufficiency— one of the two core criteria for evidence validity in a CMMC assessment.
