Certified Cybersecurity Maturity Model Certification (CMMC) Professional (CCP) Practice Exam

Which statement defines a "Not MET" practice?

1. Evidence supports the practice's eligibility

2. Assessor provides statements explaining non-conformance

3. Documentation is required only from the contractor

4. All objectives have been satisfied

The correct answer is: Assessor provides statements explaining non-conformance

The definition of a "Not MET" practice specifically revolves around situations where a practice does not fully meet the required standards for compliance. In this context, the statement indicating that an assessor provides statements explaining non-conformance is accurate because it illustrates the assessor's role in identifying and documenting any deficiencies related to cybersecurity practices. When a practice is deemed "Not MET," it is because there are shortcomings that prevent it from being fully compliant with the established criteria. The need for detailed feedback from the assessor about why the practice is not conforming is crucial in helping organizations understand the gaps in their cybersecurity posture. This information can guide them in taking corrective actions and improving their security measures to eventually meet compliance requirements. The other options do not align with the definition of a "Not MET" practice. For instance, evidence supporting the practice's eligibility or documentation being required only from the contractor does not directly relate to non-compliance. Additionally, stating that all objectives have been satisfied contradicts the very essence of being "Not MET," as it implies full compliance rather than a failure to meet certain practices.