๐๐๐๐ ๐๐ฌ๐ฌ๐๐ฌ๐ฌ๐ฆ๐๐ง๐ญ ๐๐ฉ๐จ๐ญ ๐๐ก๐๐๐ค๐ฌ
“๐๐ง ๐ค๐ฐ๐ฏ๐ต๐ณ๐ข๐ค๐ต๐ฐ๐ณ’๐ด ๐ณ๐ช๐ด๐ฌ-๐ฃ๐ข๐ด๐ฆ๐ฅ ๐ด๐ฆ๐ค๐ถ๐ณ๐ช๐ต๐บ ๐ฑ๐ฐ๐ญ๐ช๐ค๐ช๐ฆ๐ด, ๐ฑ๐ณ๐ฐ๐ค๐ฆ๐ฅ๐ถ๐ณ๐ฆ๐ด, ๐ข๐ฏ๐ฅ ๐ฑ๐ณ๐ข๐ค๐ต๐ช๐ค๐ฆ๐ด ๐ฅ๐ฐ๐ค๐ถ๐ฎ๐ฆ๐ฏ๐ต๐ข๐ต๐ช๐ฐ๐ฏ ๐ฐ๐ณ ๐ฐ๐ต๐ฉ๐ฆ๐ณ ๐ง๐ช๐ฏ๐ฅ๐ช๐ฏ๐จ๐ด ๐ณ๐ข๐ช๐ด๐ฆ ๐ฒ๐ถ๐ฆ๐ด๐ต๐ช๐ฐ๐ฏ๐ด ๐ข๐ฃ๐ฐ๐ถ๐ต ๐ต๐ฉ๐ฆ๐ด๐ฆ ๐ข๐ด๐ด๐ฆ๐ต๐ด, ๐ต๐ฉ๐ฆ ๐ข๐ด๐ด๐ฆ๐ด๐ด๐ฐ๐ณ ๐ค๐ข๐ฏ ๐ค๐ฐ๐ฏ๐ฅ๐ถ๐ค๐ต ๐ข ๐ญ๐ช๐ฎ๐ช๐ต๐ฆ๐ฅ ๐ด๐ฑ๐ฐ๐ต ๐ค๐ฉ๐ฆ๐ค๐ฌ ๐ต๐ฐ ๐ช๐ฅ๐ฆ๐ฏ๐ต๐ช๐ง๐บ ๐ณ๐ช๐ด๐ฌ๐ด. ๐๐ฉ๐ฆ ๐ญ๐ช๐ฎ๐ช๐ต๐ฆ๐ฅ ๐ด๐ฑ๐ฐ๐ต ๐ค๐ฉ๐ฆ๐ค๐ฌ(๐ด) ๐ด๐ฉ๐ข๐ญ๐ญ ๐ฏ๐ฐ๐ต ๐ฎ๐ข๐ต๐ฆ๐ณ๐ช๐ข๐ญ๐ญ๐บ ๐ช๐ฏ๐ค๐ณ๐ฆ๐ข๐ด๐ฆ ๐ต๐ฉ๐ฆ ๐ข๐ด๐ด๐ฆ๐ด๐ด๐ฎ๐ฆ๐ฏ๐ต ๐ฅ๐ถ๐ณ๐ข๐ต๐ช๐ฐ๐ฏ ๐ฏ๐ฐ๐ณ ๐ต๐ฉ๐ฆ ๐ข๐ด๐ด๐ฆ๐ด๐ด๐ฎ๐ฆ๐ฏ๐ต ๐ค๐ฐ๐ด๐ต. ๐๐ฉ๐ฆ ๐ญ๐ช๐ฎ๐ช๐ต๐ฆ๐ฅ ๐ด๐ฑ๐ฐ๐ต ๐ค๐ฉ๐ฆ๐ค๐ฌ(๐ด) ๐ธ๐ช๐ญ๐ญ ๐ฃ๐ฆ ๐ธ๐ช๐ต๐ฉ๐ช๐ฏ ๐ต๐ฉ๐ฆ ๐ฅ๐ฆ๐ง๐ช๐ฏ๐ฆ๐ฅ ๐๐ด๐ด๐ฆ๐ด๐ด๐ฎ๐ฆ๐ฏ๐ต ๐๐ค๐ฐ๐ฑ๐ฆ.” – CMMC Scoping Guide for Level 2
๐๐ก๐๐ญ ๐๐ซ๐ ๐๐ฉ๐จ๐ญ ๐๐ก๐๐๐ค๐ฌ ๐๐จ๐ซ? – ๐๐๐ซ๐ข๐๐ฒ ๐ฌ๐๐จ๐ฉ๐ข๐ง๐ ๐๐จ๐ฎ๐ง๐๐๐ซ๐ข๐๐ฌ
In my opinion, spot checks are meant to be used to confirm that a company’s proposed scoping is accurate.
During planning, the Lead Assessor should identify spot checks (tests) against suspected or common boundary failures (the risks).
A test could include asking users if they send CUI via email (if email is Contractor Risk Managed Asset / Out of Scope).
Another test could be trying to copy data out of a VDI session (if endpoints are Contractor Risk Managed Asset / Out of Scope).
Spot checks should be performed early in the assessment. If a spot check fails, the Lead Assessor may revise the asset categorization identified during scoping. If asset categorization changes during assessment, it is a Big Deal, and the C3PAO Quality Manager should be informed as soon as possible..
๐๐ญ๐ก๐๐ซ ๐ข๐ง๐ญ๐๐ซ๐ฉ๐ซ๐๐ญ๐๐ญ๐ข๐จ๐ง – ๐๐ง๐ฌ๐ฎ๐ซ๐ ๐๐๐ ๐๐๐๐ฎ๐ซ๐๐ญ๐ ๐๐จ๐ซ ๐๐๐๐
Another possible interpretation is that the assessor would spot check Contractor Risk Managed Assets to ensure that the security described in the System Security Plan is actually being performed for them. If this is correct, then it implies that CRMA are supposed to be fully documented regarding their performance or nonperformance of security controls in the System Security Plan.
I think there is a decent chance this interpretation is what the DoD intended, but I don’t see the purpose of doing this because it wouldn’t change the assessment result if they fail a spot check, except maybe NOT MET on the SSP? The DoD’s official guidance says that CRMA aren’t required to have any specific security applied.
๐๐ญ๐ก๐๐ซ ๐ข๐ง๐ญ๐๐ซ๐ฉ๐ซ๐๐ญ๐๐ญ๐ข๐จ๐ง – ๐๐๐ง๐ข๐ญ๐ฒ ๐๐ก๐๐๐ค ๐๐๐๐ ๐๐จ๐ง๐ญ๐ซ๐จ๐ฅ๐ฌ
I have talked to other people who interpret this scoping guidance as the assessor critiquing the security implementations for Contractor Risk Managed Assets and whether applied controls are appropriate for those assets. For example, the assessor might randomly decide that CRMA need to have storage at rest encryption. Then what?
This interpretation makes the least sense to me.
What do you think?