Câu 25: CCA: CMMC Certified Assessor

An OSC has a testing laboratory. The lab has several pieces of equipment, including a workstation that is used to analyze test information collected from the test equipment. All equipment is on the same VLAN that is part of the certification assessment. The OSC claims that the workstation is part of the test equipment (because of the specialized program it runs) and thus only needs to be assessed under its risk-based information security policies, procedures, and practices. However, the OSC states that the data analysis output is CUI. What is the assessor's BEST response?

1. A. Agree with the OSC but perform a limited spot check of the system, not increasing the assessment cost or duration.
2. B. Agree with the OSC and determine if it is managed using the contractor's risk-based information security policies, procedures, and practices.
3. C. Disagree with the OSC and include the workstation in the full assessment. — đáp án hiện tại
4. D. Disagree with the OSC and score practice CA.L2-3.12.4: System Security Plan as being NOT MET.