OSC Portal

Welcome to the OSC Portal by KNC Strategic Services. Access the official questionnaire designed for defense contractors seeking a firm fixed price proposal for a C3PAO Assessment conducted by an authorized C3PAO.

KNC CMMC Assessment Questionnaire

Enter your information and answers below. We use this information to determine your assessment scope and to prepare a firm-fixed price proposal for your official CMMC Level 2 Assessment.

If you would like to have us sign a Mutual NDA, please download our MNDA here. Fill it out and attach it below.

If you would like to first verify that we are an Authorized C3PAO through the CyberAB, you can look us up on the CMMC marketplace from the CyberAB.

Scoping

Assessment Scope (Enterprise or Enclave)

# of CUI Authorized Users in Scope

# of computers in scope

Do you have a current Network Diagram?

Do you have an Assessment Boundary Diagram?

Do you have a current Data Flow Diagram?

Do you have an Assessment Boundary document that describes your Assessment Scope environment?

Has your Assessment Scope environment been in existence and in use for over 6 months?

If not, was your environment started and went live within the last month?

Do you use Virtual Desktop Infrastructure within your assessment scope?

Do you develop software within your assessment scope?

Documentation

Do you have a completed System Security Plan (SSP)?

Was your SSP updated within the last 12 months?

Does your SSP describe how each Control and each Assessment Objective are met?

Do you have any controls listed as Not Applicable, and if you do, do you have documented explanations as to why they are considered Not Applicable?

Do you have an open Plan of Action & Milestones (POA&M) which outlines a timeline to complete any open remediations?

Do you have formal written policies based on, or covering, all the NIST 800-171/CMMC control families?

Have all your policy documents been reviewed, and updated if needed, within the last 12 months?

Do you have and maintain a current Asset Inventory of all assets that are within your assessment scope?

Have you identified and documented all users (employees, contractors, third party vendors, ESP, and CSP) that are/will be authorized to process, store, or transmit CUI in your assessment scope?

Do you have each asset identified based on the appropriate CMMC Asset Category? (CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, etc.)

Do you have all your documents/evidence organized in a single repository or in a GRC application?

CUI Profile

Do you have an active direct contract with the Department of Defense?

Do you currently store, transmit, or process any Controlled Unclassified Information (CUI) for DoD related contract(s)?

If no, are you a subcontractor for a Prime with a DoD contract?

Do you create CUI on behalf of the government?

ESP and CSP

If you are using a Cloud Service Provider (CSP) to process, store, or transmit CUI, are they authorized as FedRamp Moderate or higher?

If not, are they able to prove FedRamp Moderate Equivalency?

If you are using an External Service Provider (ESP), have they been assessed by an Authorized C3PAO for an official CMMC Level 2 Assessment?

Do you have a Shared Responsibility Matrix for any Cloud Service Provider (CSP) and any External Service Provider (ESP) that you are inheriting any controls from?

Do you have a documented service level agreement for how the External Service Provider (ESP) agrees to meet the requirements according to the Shared Responsibility Matrix?

If no, have they agreed in writing to support your assessment, including participating as needed in the assessment interview week?

Operational

Are you conducting change control board meetings monthly or quarterly to review any changes to your Assessment Scope environment?

Have you implemented an ongoing Cybersecurity Awareness Training program?

Have you implemented FIPS 140-2 or higher validated encryption for all assets that store or transmit unencrypted CUI?

Are you backing up sensitive data that is held within your Assessment Scope to the cloud?

Have you conducted a mock assessment of your Assessment Scope environment?

Do you have any technology implementations, changes, or upgrades in process or planned in the near future?

Have you completed a self-assessment of your environment against the NIST 800-171 controls and posted your score to SPRS and or self-assessment?

Personnel

Have all users who will be authorized to process, store, or transmit CUI completed the DoD Mandatory CUI training program?

Have the CUI authorized users completed training within the last 6 months on Insider Threat?

Do you have employees, and anyone that is authorized to access your Assessment Scope environment, sign an Acceptable Use Policy, or an equivalent policy document?

Do you allow BYOD (Bring Your Own Device) within your assessment scope?

Do you conduct Cybersecurity Awareness Training at least annually?

Do you have remote access users?

If so, do they connect via VPN or other secure method?

Generate a new image Play the audio code

Enter the code from the image

KNC OSC Portal