CMMC-CCA Exam Dumps | While examining the customer responsibility matrix submitted by the OSC for one of its Cloud Service

<< Prev Question Next Question >>

Question 6/62

While examining the customer responsibility matrix submitted by the OSC for one of its Cloud Service Providers (CSPs), the Assessor notes that the matrix was substantially completed by the OSC's RPO. In fact, there is a statement from the RPO that the CSP has met the requirements for FedRAMP MODERATE.
In order to accept that this CSP is qualified to perform some of the practices on behalf of the OSC, what should occur?

A. The CSP must have its service certified for FedRAMP by a certified C3PAO.

B. The OSC should provide the contract documents for the CSP specifying that it must meet NIST SP 800-
171 practices.

C. The OSC must be able to demonstrate that the CSP is providing its services in a manner that complies with CMMC Level 2.

D. There must be other evidence that an independent firm has confirmed the security controls meeting FedRAMP MODERATE are in place.

Question 6/62

LEAVE A REPLY

Download PDF File