CMMC-CCA practice

Q1 Single choice

You are the Lead Assessor for a CMMC Level 2 assessment. During the assessment, the OSC provides evidence that a practice is inherited from a cloud service provider (CSP). The CSP has a FedRAMP Moderate authorization, and the OSC argues that this should automatically satisfy the practice's requirements.

How should you respond?

A
Accept the FedRAMP authorization as sufficient evidence and score the practice as "MET."
B
Inform the OSC that FedRAMP authorization does not automatically satisfy CMMC requirements and request specific evidence from the CSP demonstrating compliance with the practice's objectives.
C
Reject the evidence outright, as external certifications are not allowed under CMMC.
D
Consult with the Cyber AB to determine if FedRAMP can be accepted as equivalent to CMMC requirements.