An OSC receives an email with " CUI//SP-PRVCY//FED Only " in the body of the message Which organization ' s website should the OSC go to identify what this marking means?
Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1, Guidelines for Media Sanitation?
The Lead Assessor interviews a network security specialist of an OS
C.
The incident monitoring report for the month shows that no security incidents were reported from OSC ' s external SOC service provider. This is provided as evidence for RA.
L2-3.11.2: Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. Based on this information, the Lead Assessor should conclude that the evidence is:A program manager for a defense contractor saves all FCI data relevant to a contract on a flash drive. Why is the flash drive categorized as an FCI Asset ?
Which phase of the CMMC Assessment Process includes the task to identify, obtain inventory, and verify evidence?
Which authority leads the CMMC direction, standards, best practices, and knowledge framework for how to map the controls and processes across different Levels that range from basic cyber hygiene to advanced cyber practices?
When an OSC requests an assessment by a C3PAO, who selects the Lead Assessor for the assessment?
In performing scoping, what should the assessor ensure that the scope of the assessment covers?
Which method facilitates understanding by analyzing gathered artifacts as evidence?
