Cyber AB CMMC CMMC-CCA Question # 12 Topic 2 Discussion

Comprehensive and Detailed in Depth Explanation:

RA.L2-3.11.1, per NIST SP 800-171 and CMMC Level 2, requires periodic risk assessments considering threats (Option A), likelihood and impact (Option B), and external parties (Option C) to ensure accuracy in protecting CUI. However, whether risk can be transferred (Option D) is a mitigation strategy, not a required consideration for assessment accuracy, as it occurs post-assessment. Option D is excluded from RA.L2-3.11.1’s scope, making it the correct answer.

Reference Extract:

NIST SP 800-171, 3.11.1:“Assess risks from threats, likelihood, impact, and external parties periodically.”

CMMC AG Level 2, RA.L2-3.11.1:“Risk assessments focus on threats, impacts, and externalrisks, not transferability.”Resources:https://csrc.nist.gov/pubs/sp/800/171/a/final ;https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf