Who is responsible for ensuring that subcontractors have a valid CMMC Certification?
Correct Answer: D
Under DFARS and CMMC requirements, the prime contractor is responsible for ensuring its subcontractors meet the required CMMC level. Neither the DoD, The Cyber AB, nor OUSD A&S directly manages subcontractor certification.
Supporting Extracts from Official Content:
* DFARS 252.204-7021: "The contractor shall ensure that its subcontractors have the appropriate CMMC level certification for the information they will handle." Why Option D is Correct:
* Compliance responsibility flows through the contractor supply chain.
* CMMC-AB (The Cyber AB) accredits assessors but does not police subcontractors.
* OUSD A&S sets policy, not enforcement at contract level.
* DoD agencies only require compliance at award/contract oversight level.
References (Official CMMC v2.0 Content):
* DFARS 252.204-7021.
* CMMC Model v2.0 governance guidance.