Câu 3: CCA: CMMC Certified Assessor

Does CMMC Level 2 require that a Cloud Service Provider (CSP) hold a FedRAMP HIGH authorization hosted in a government community cloud (GCC)?

1. A. No. The CSP can obtain a FedRAMP MODERATE equivalency. — đáp án hiện tại
2. B. Yes. FedRAMP HIGH authorization demonstrates the CSP compliance with NIST SP 800-53 and SP 800-171 control requirements.
3. C. Yes. FedRAMP HIGH is required for CUI data controls due to the sensitive nature of the Defense Industrial Base systems.
4. D. No. The CSP must hold a FedRAMP MODERATE authorization.