During a CMMC assessment, the Lead Assessor requests evidence from the OSC to support their claim that several access control and authentication practices are inherited from their enterprise-level Identity and Access Management (IAM) system. The OSC claims that their parent company manages the IAM system. Which of the following types of evidence would be the most appropriatefor the OSC to demonstrate these inherited practices?
Submit