Understanding "Adequate Evidence" in the CMMC Assessment ProcessIn aCMMC assessment,adequate evidencerefers to the proof required to demonstrate that a specific cybersecurity practice has been implemented correctly. Evidence can come from:
Artifacts(e.g., security policies, system configurations, logs).
Interview responses(e.g., verbal confirmation from personnel about their responsibilities).
Demonstrations(e.g., showing how a security control is implemented in real time).
Testing(e.g., verifying technical security mechanisms such as multi-factor authentication).
Thegoalof evidence collection is to determinewhether a CMMC practice is met—not just whether the organization operates within the assessment scope.
A. Verify, based on an assessment and organizational scope → Incorrect
Theassessment scopedefineswhat is evaluated, but adequacy of evidence is based oncompliance with specific CMMC practices.
B. Verify, based on an assessment and organizational practice → Incorrect
CMMC assessments focus on cybersecurity practices defined in the CMMC framework, not just general organizational practices.
C. Determine if a given artifact, interview response, demonstration, or test meets the CMMC scope → Incorrect
Thescopedefines the assessment boundaries, but theassessment team's job is to confirm whether CMMC practices are satisfied.
D. Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice → Correct
TheCMMC assessment process focuses on ensuring that required practices are implemented, making this the correct answer.
Why is the Correct Answer "Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice" (D)?
CMMC Assessment Process (CAP) Document
Defines "adequate evidence" asproof that a CMMC practice has been correctly implemented.
CMMC 2.0 Assessment Criteria
Specifies that evidence must beevaluated against specific cybersecurity practices.
NIST SP 800-171A (Assessment Procedures for NIST SP 800-171)
Provides guidance on evaluating artifacts, interviews, demonstrations, and testing to confirm compliance with required practices.
CMMC 2.0 References Supporting this Answer:
Final Answer:✔D. Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice.
