Câu 5: CCA: CMMC Certified Assessor

An OSC uses an ESP to provide components of the OSC's CUI processing scope. The OSC has chosen an accredited ESP that is FedRAMP MODERATE authorized. The OSC has a contract with the ESP that requires them to provide security that meets the OSC security requirements. The ESP has given the OSC a copy of its shared responsibility matrix that coincides with the contract terms. When assessing the assets within the assessment scope, which should the assessor MOST carefully review?

1. A. The ESP's FedRAMP MODERATE authorization to ensure that the OSC's CMMC Level 2 requirements are MET, and the shared responsibility matrix to ensure that the shared responsibilities are well defined — đáp án hiện tại
2. B. The ESP's FedRAMP MODERATE authorization to ensure that the OSC's CMMC Level 2 requirements are MET, and the shared responsibility matrix to ensure that the ESP’s responsibilities are well defined
3. C. The contract terms to ensure that the OSC's CMMC Level 2 requirements are in the contract, and the shared responsibility matrix to ensure that the shared responsibilities are well defined
4. D. The contract terms to ensure that the OSC's CMMC Level 2 requirements are in the contract, and the shared responsibility matrix to ensure that the ESP's responsibilities are well defined