In the context of a CMMC Level 2 Assessment, assessors must evaluate the " Institutionalization " of practices, which includes the review of Policies. The validity of a policy document depends on the Organization Seeking Certification (OSC) ' s internal governance and administrative procedures.

Internal Governance (The " Why " ): CMMC does not dictate exactlyhowa company must authorize its policies (e.g., whether a signature must be refreshed immediately upon a personnel change). Instead, the assessor must verify if the document is considered " active " and " authoritative " by the OSC’s own standards.

The Role of the Assessor: As per the CMMC Assessment Process (CAP) and CCP training materials, an assessor cannot unilaterally declare a policy invalid simply because a signatory has left. The assessor must perform " more research " (typically through Interviews or examining Supplemental Documents) to determine the OSC ' s internal rules for policy management.

If the OSC ' s " Policy on Policies " states that a signature is tied to the individual, the document may be expired.

If the OSC ' s rules state that the authority is tied to the role/position (which is common in most corporate governance), the policy remains in effect until it is formally rescinded or updated.

Distinction from other options:

Option A is too restrictive; it assumes a universal rule that doesn ' t exist in the CMMC framework.

Option C is incorrect because a signatory (or formal approval)isoften what gives a policy its " authoritative " status in an audit; ignoring it would be a failure of the Examine method.

Option D is a common business assumption, but an assessor must verify this via the OSC ' s own procedures rather than assuming it is true for every company.

Reference Documents:

CMMC Assessment Process (CAP) v1.0: Section on " Examine " methods and evaluating evidence integrity.

NIST SP 800-171A: Discussion on " Organizational Policies " as assessment objects and the requirement for policies to be " established and maintained. "

CMMC Level 2 Assessment Guide: Clarifies that policies must be " formally documented " and " representative of organizational requirements. "