CMMC emphasizes formal, documented processes. While identifying the gap is crucial, changes to controlled documents like an incident response plan must follow the organization’s established change management or plan maintenance procedures. This ensures consistency, approval, and traceability, aligning with the maturity model’s focus on institutionalized processes.

The core issue is the violation of a fundamental security practice mandated by CMMC: protecting stored authentication secrets. Storing plaintext passwords, especially in a script file, creates a severe vulnerability. While other options may represent procedural issues, the clearest and most direct violation of a specific CMMC practice (like those in the Access Control family) is the failure to protect credentials.

CMMC requires organizations to execute their incident response plan in the event of a suspected incident. The first step should always be to activate and follow the documented, approved procedures. This ensures a consistent, measured response, proper evidence handling, and clear roles. While the actions in other options (like gathering info or checking for CUI) are likely steps *within* that plan, the foundational CMMC practice is to follow the institutionalized process.

The core security objective of account audits is to enforce the principle of least privilege and reduce the attack surface. Stale accounts (e.g., for departed employees) or accounts with excessive privileges are common vectors for misuse or attack. Regular reviews to find and fix these issues directly support CMMC practices related to account management and access enforcement.

CMMC requires protection of CUI during transmission. A password on a file does not guarantee the file is encrypted in transit (between servers) or at rest on the commercial service’s servers. Furthermore, access should be controlled more robustly. The proposal lacks assured encryption and strong access controls, which are key requirements for protecting CUI outside organizational boundaries.

“Deny by default” (or whitelisting) is a fundamental secure configuration practice. It means the firewall starts by blocking all traffic, and only explicitly defined exceptions (the specific ports/protocols needed for the business function) are allowed. This minimizes the attack surface. The other options represent ‘allow by default’ or reactive approaches, which are less secure.

The practice area of System and Information Integrity (SI) specifically includes requirements to identify, report, and correct system flaws in a timely manner. This encompasses installing security patches and updates. The inability to enforce patch installation on remote assets indicates a failure in the processes and tools required to maintain system integrity, which is at the heart of the SI family of practices.

A risk assessment is a snapshot of risks at a point in time. Its true value is in informing security decisions. If it’s not updated, it becomes obsolete and no longer reflects real-world threats (like new vulnerabilities) or changes to the organization (like new systems handling CUI). Regular reviews ensure that security controls and resources are aligned with the *current* most significant risks.

While CMMC doesn’t prescribe a specific number of days, the requirement is to provide enough time to support investigation and response. A 30-day window may not allow investigators to go back far enough to find the initial point of compromise in a slow, low-and-slow attack. Retention periods must be justified by the organization’s operational needs and incident response requirements.

CMMC emphasizes formal, documented processes. While identifying the gap is crucial, changes to controlled documents like an incident response plan must follow the organization’s established change management or plan maintenance procedures. This ensures consistency, approval, and traceability, aligning with the maturity model’s focus on institutionalized processes.0