Step 1: Understand the Definitions of Evidence Evaluation CriteriaTheCMMC Assessment Process (CAP) introduces two key criteria for evaluating evidence:
* Adequacy- Does the evidencealign with the practice?
* Sufficiency- Is the evidencecomprehensive enoughin terms ofcoverage across systems, users, and scope?
CAP v1.0 - Section 3.5.4:
"Evidence must be evaluated for bothadequacy(is it the right evidence?) andsufficiency(is there enough of it across all in-scope assets and areas?) to score a practice as MET."
#Step 2: Applying to the ScenarioIn the question, the Lead Assessor is asking the team toverify that evidence is sufficient across:
* Domains
* Practices
* Host Units
* Supporting Organizations
* Enclaves
## This is adirect reference to sufficiency, which evaluates whether thebreadth and depthof evidence is enough to make an informed judgment that the control is truly implemented across theentire assessed environment.
* A. Adequacy# Adequacy refers to therelevanceof the evidence to the specific practice - not itscoverageacross scope.
* B. Capability# Not a term used in evidence validation within CMMC CAP documentation.
* D. Objectivity# While objectivity is important, it refers to theunbiased nature of assessment activities, not to theextent of evidence coverage.
#Why the Other Options Are Incorrect
When an assessor evaluates whether the evidence is broad enough across all necessary systems, units, and enclaves to score a practice as MET, they are evaluatingsufficiency- one of the two core criteria for evidence validity in a CMMC assessment.