Câu 13: CCA: CMMC Certified Assessor

An OSC is a wholly owned subsidiary of a large conglomerate (parent organization). The OSC and the parent organization use ID badges (PKI cards) that contain a PKI certificate and radio frequency identification (RFID) tag that is used for building and system access (including ones used to process, transmit or store CUI). However, the parent organization does not make any decisions on how the OSC runs its security program or any other decisions of significant importance. The large conglomerate runs a machine that is used to activate the badges for itself and the OSC. It is isolated in a locked room and has no network connectivity to the OSC. The badge activation system is:

1. A. in-scope because the parent organization acts as a Supporting Organization/Units to the OSC by providing PKI cards.
2. B. out-of-scope because the OSC is the one that assigns the appropriate access to a particular PKI card.
3. C. in-scope because the OSC is part of the large conglomerate and thus any CMMC requirements of the OSC are imputed onto the large conglomerate.
4. D. out-of-scope because the badge activation machine is physically and logically isolated from the OSC and it is under the control of the parent organization. — đáp án hiện tại