Question for anyone who's been through a CMMC assessment — for 3.6.3 (testing the IR capability), what did…
Oluwafemi A. — Cloud Security Engineer & Lead Architect - AWS Security, HIPAA-Compliant Systems, Applied AI
Question for anyone who's been through a CMMC assessment — for 3.6.3 (testing the IR capability), what did you actually submit as evidence, and did it hold up? Curious whether a tabletop alone is enough or whether assessors want a formal after-action artifact with participants, timestamps, and decisions recorded. Mostly interested in what got pushed back on, since that's harder to find written down.
2 reactions · 0 comments