11.3 Assessment Objectives, Evidence Sufficiency & Limited Correction

11.3 Assessment Objectives, Evidence Sufficiency & Limited Correction

A CMMC Level 2 assessment evaluates requirements through their assessment objectives. Objectives translate a broad statement into observable determinations. Workpapers must show why the evidence satisfies—or fails to satisfy—each applicable objective.

Objectives and binary requirement results

Suppose an account-lockout requirement has objectives to define the number of invalid attempts and to enforce lockout until an authorized release or time period. A policy showing “five attempts” may satisfy evidence for the defined parameter. If testing shows the account remains usable after ten invalid attempts, the enforcement objective is not satisfied. The requirement is therefore NOT MET.

There is no half credit because one objective passed. The full one-, three-, or five-point value assigned by the DoD scoring methodology is deducted for the unmet requirement, subject to the methodology's dependency rules. Assessment objectives are not separate scored controls.

An objective can be N/A only when the governing requirement, approved scope, and factual environment support it. “The OSC did not provide evidence” means not demonstrated, not N/A.

Adequate and sufficient evidence

Evidence is adequate when it is suitable and relevant to the objective. It is sufficient when its amount, quality, coverage, and consistency support the conclusion at the required confidence. Consider:

• Authenticity: Is the artifact actually from the assessed environment, or an editable template or vendor brochure?
• Currency: Does it represent the assessment period and current implementation?
• Scope: Does it cover the in-scope system, location, provider, and access path?
• Operation: Does it show implementation, not only intent?
• Focused coverage: Does the sample address relevant variation and risk?
• Consistency: Do policies, configurations, interviews, logs, and observed behavior agree?
• Traceability: Can QA connect the source and result to the objective?

Contradictory evidence is resolved, not averaged. An interview that claims monthly reviews conflicts with logs showing the last review six months ago. The team follows the discrepancy to a defensible result.

No universal Rule of Two

NIST SP 800-171A offers Examine, Interview, and Test procedures. Corroboration across methods can strengthen confidence, especially when one source only describes intent. But CAP 2.0 does not contain a blanket Rule of Two requiring at least two methods or two artifacts for every objective.

A narrow objective may be demonstrated by one authoritative, direct test with traceable results. A complex process may require several artifacts, interviews, and tests. Counting two weak sources does not create sufficiency. Select procedures and depth from the objective, scope, focused sample, and risk of an erroneous conclusion.

This correction also changes exam strategy: answers that mechanically demand two methods are wrong unless the question's facts independently make corroboration necessary.

Focused sampling and inheritance

Sampling should include meaningful variation—different platforms, sites, roles, privileged paths, or provider responsibilities—without claiming statistical representativeness. Document why items were selected and what conclusion the sample can support.

Inherited or shared services require evidence for both provider and customer responsibilities. A cloud authorization may support provider controls within its boundary; the OSC still proves configuration, identity, data handling, and other customer duties. An ESP's policy is not automatically evidence that the OSC uses the service as described.

Limited practice deficiency correction

CAP permits limited correction during the assessment only under defined constraints. It is not a general cure period and must not turn the assessor into a consultant. A qualifying deficiency is corrected by the OSC within the permitted assessment process, then fully re-evaluated and documented by the assessment team.

The team preserves the initial observation, the correction, the evidence used for re-evaluation, and the final determination. If the change is broad, creates new risk, cannot be fully assessed, alters scope materially, or falls outside the allowed conditions, it should not be treated as a limited correction merely to protect the schedule.

A screen-lock value changed from 25 to the OSC-defined compliant value may be a candidate only if CAP conditions are satisfied and the team can fully verify effective application across the relevant focused sample. A missing enterprise identity architecture is not a minor parameter correction.

Traceability record

A strong evidence entry includes: requirement and objective identifier; method; assessment object; artifact or observation identifier; date; owner or interviewee; system, location, and sample; result; conflict or limitation; assessor conclusion; and protection or hash reference. Avoid storing raw CUI in a system that is not authorized for it.

The OSC hashes and retains evidence according to CAP and applicable requirements; do not claim that a C3PAO computes SHA-256 for every artifact. CAP refers to a NIST-approved hashing algorithm and assigns the OSC a six-year retention duty for assessment artifacts.

Quality test

Before marking MET, ask whether another qualified reviewer could reach the same conclusion from the recorded evidence. Before NOT MET, identify the exact unsatisfied objective and contradiction or gap. Before N/A, cite the factual and source basis. This discipline is more reliable than any slogan about the number of artifacts.