Comprehensive and Detailed in Depth Explanation:

AC.L2-3.1.12 requires OSCs to monitor and control remote access sessions, per NIST SP 800-171 and CMMC Level 2. In a BYOD environment with MDM and VPNs, the CCA must verify the effectiveness of these controls. However, the personal nature of employee devices introduces privacy concerns, limiting the CCA’s ability to directly inspect configurations or logs without consent or legal constraints, as noted in the CAP. This complicates evidence collection compared to company-owned devices.

Option A (simplified evidence collection) overlooks privacy barriers. Option B (VPN security) assumes effectiveness without addressing verification challenges. Option D (employee attestation) is insufficient per CAP, which requires objective evidence. Option C correctly identifies privacy as a key challenge, making it the correct answer.

Reference Extract:

CMMC Assessment Process (CAP) v1.0, Section 4.2:“BYOD environments may limit evidence collection due to privacy concerns associated with personal devices.”

NIST SP 800-171A, AC-3.1.12:“Assessors must verify control of remote access sessions, which may be hindered by device ownership.”Resources:https://cyberab.org/Portals/0/Documents/Process-Documents/CMMC-Assessment-Process-CAP-v1.0.pdf ;https://csrc.nist.gov/pubs/sp/800/171/a/final