Certified CMMC Professional (CCP) — Question 12

A Lead Assessor has been assigned to a CMMC Assessment. During the assessment, one of the assessors approaches with a signed policy. There is one signatory, and that person has since left the company. Subsequently, another person was hired into that position but has not signed the document. Is this document valid?

Answer options

• A. The signatory is the authority to implement and enforce the policy, and since that person is no longer with the company, the policy is not valid.
• B. More research on the company policy of creating, implementing, and enforcing policies is needed. If the company has a policy identifying the authority as with the position or person, then the policy is valid.
• C. The signatory does not validate or invalidate the policy. For the purpose of this assessment, ensuring that the policy is current and is being implemented by the individuals who are performing the work is sufficient.
• D. The authority to implement and enforce lies with the position, not the person. As long as that position’s authority and responsibilities have not been removed from implementing that domain, it is still a valid policy.

Correct answer: D

Explanation

The correct answer is D because the authority to enforce policies is based on the position rather than the individual who previously held it. Even though the original signatory has left, as long as the new hire occupies that role and the responsibilities are unchanged, the policy is still valid. Options A and B misinterpret the continuity of authority, while C overlooks the importance of the role in policy enforcement.