https://cmmcwiki.org/index.php?action=history&feed=atom&title=LLMResponse_PS.L2-3.9.2.c 2026-04-20T07:11:36Z Revision history for this page on the wiki MediaWiki 1.43.8 https://cmmcwiki.org/index.php?title=LLMResponse_PS.L2-3.9.2.c&diff=1416&oldid=prev 2025-04-03T02:53:45Z

<p>Created page with &quot;For the assessment objective &quot;[c] the system is protected during and after personnel transfer actions,&quot; I&#039;ll rank the evidence types and prioritize assessment approaches based on the CMMC Level 2 guidance provided. == Evidence Types Ranking for Assessment Objective [c] == 1. **Artifacts (I1)** - Highest priority - System logs showing access modifications during/after transfers - Records of access rights adjustments for transferred personnel - Documentation of...&quot;</p> <p><b>New page</b></p><div>For the assessment objective &quot;[c] the system is protected during and after personnel transfer actions,&quot; I&#039;ll rank the evidence types and prioritize assessment approaches based on the CMMC Level 2 guidance provided.<br /> <br /> == Evidence Types Ranking for Assessment Objective [c] ==<br /> <br /> 1. **Artifacts (I1)** - Highest priority<br /> - System logs showing access modifications during/after transfers<br /> - Records of access rights adjustments for transferred personnel<br /> - Documentation of continued protection measures<br /> - These artifacts directly demonstrate protection maintained during transitions<br /> <br /> 2. **Test (I4)** - High priority<br /> - Demonstrations of protection mechanisms during simulated transfers<br /> - Verification of continued security during role changes<br /> - Testing of access control mechanisms during transitions<br /> - This proves the effectiveness of protection measures<br /> <br /> 3. **Documents (I2)** - Medium priority<br /> - Transfer procedures specifying protection requirements<br /> - Access control matrices showing appropriate changes<br /> - System security plans addressing personnel transitions<br /> - These establish the framework but don&#039;t prove implementation<br /> <br /> 4. **Physical Review (I3)** - Medium to lower priority<br /> - Observation of physical security measures during transfers<br /> - Verification of physical access control updates<br /> - This can be important if CUI is physically accessible<br /> <br /> == Assessment Approaches Prioritization ==<br /> <br /> 1. **Test (C3)** - Highest priority<br /> - Testing organizational processes for personnel transfer<br /> - Verifying mechanisms supporting transfer notifications<br /> - Testing access modification procedures<br /> - This directly demonstrates system protection during transitions<br /> - Focus on objects in D3: &quot;organizational processes for personnel transfer; mechanisms supporting transfer notifications&quot;<br /> <br /> 2. **Examine (C1)** - Secondary priority<br /> - Reviewing records of personnel transfer actions<br /> - Examining access control adjustments<br /> - Verifying protection measures remained in place<br /> - These provide evidence of consistent implementation<br /> <br /> 3. **Interview (C2)** - Tertiary but still important priority<br /> - Interviews with system administrators handling transfers<br /> - Discussions with security personnel about transfer protections<br /> - Conversations with recently transferred employees<br /> - These validate understanding and implementation of requirements<br /> <br /> == Recommendation for Objective [c] ==<br /> <br /> I recommend you:<br /> <br /> 1. First perform tests of the protection mechanisms during simulated transfer scenarios<br /> 2. Examine records of past transfers to verify systems remained protected<br /> 3. Interview both technical staff and transferred employees to validate protection measures<br /> <br /> Since objective [c] focuses on whether &quot;the system is protected during and after personnel transfer actions,&quot; your strongest evidence will come from demonstrations that protection measures remain effective during transitions and aren&#039;t compromised during personnel changes.<br /> <br /> For this objective, you&#039;ll want to specifically verify that:<br /> - Access rights are appropriately modified rather than simply terminated<br /> - Information remains accessible to authorized personnel during transitions<br /> - Protection mechanisms continue functioning without interruption<br /> - New roles receive appropriate access in a secure manner</div>

David