- Examination reviews artifacts, interviews explore understanding and practice, and tests observe behavior.
- The method must fit the objective and the environment being evaluated.
- A learning demonstration does not independently establish an official assessment result.
Learning objectives
This lesson introduces three assessment methods and shows how they can complement one another. You will learn to identify what a document review can reveal, what a conversation can clarify and what an appropriately designed test can demonstrate. You will practice selecting methods for one fictional safeguard instead of assuming every requirement is answered by the same screenshot.
Use synthetic records and an authorized training environment. The lesson does not authorize tests against real systems or replace the applicable assessment procedures. Its purpose is to improve the questions you ask and the conclusions you draw from different kinds of evidence.
- Distinguish the purpose of examine, interview and test.
- Connect a method to a specific assessment question.
- Explain the limitations of a single observation.
Understand the three methods
Examination involves reviewing relevant artifacts, such as policies, procedures, settings or records. An interview uses discussion with appropriate people to understand responsibilities and operation. A test observes or exercises behavior under defined conditions. NIST SP 800-171A describes these assessment methods; the applicable CMMC procedures determine how they are used in a real assessment.
The cited 2018 assessment publication has been superseded by NIST, while CMMC's incorporation and current requirements need separate verification. Do not automatically substitute the newest publication for the applicable baseline. For this lesson, focus on the reasoning common to the methods: each offers a way to investigate a question, and each has limits that the reviewer must understand.
Choose the method after identifying the objective
Start by stating what you need to determine. If the question concerns whether an authorization process is defined, a procedure may be relevant. If the question concerns who performs a step, a discussion with the responsible person can clarify the arrangement. If the question concerns an application's behavior, an authorized test may provide useful observation. Avoid choosing the easiest artifact first and pretending it answers every question.
Methods can corroborate or contradict each other. A procedure might describe one workflow while an interview reveals that staff use another. A test might show that a supposedly restricted action is available. A contradiction is a reason to investigate the facts and scope, not to discard the inconvenient evidence or coach a participant into repeating the document's wording.
Worked example: checking a read-only role
In a hypothetical training workspace, a reviewer should be able to read a report but should not be able to edit it. The learner examines the role description and relevant settings. The learner interviews the workspace owner about how the role is assigned and maintained. In an authorized test environment with synthetic content, a test account then attempts the permitted reading action and the restricted editing action.
The test unexpectedly allows editing. The learner does not declare the entire organization failed, because the exercise covers a limited scenario. The learner records the observed result, identifies the tested environment and compares the configuration with the intended role. The inconsistency needs investigation. The combined methods produced a useful finding because they connected the stated rule, operational explanation and actual behavior.
Practice a method plan
Choose an invented safeguard and write a narrow question about it. Identify one artifact to examine, one appropriate role to interview and one safe behavior to test if testing is relevant. State what each method could reveal and one limitation. Include the environment, expected result and authorized boundaries of any proposed test. If you cannot define a safe test, leave it as a discussion question for the responsible reviewer.
Ask a colleague whether your selected methods actually address the question. A training record may be easy to obtain but irrelevant to a technical permission setting. An administrator's explanation may be informative without proving a historical action occurred. Good method selection starts with the objective and uses evidence proportionately rather than producing a standard bundle regardless of the issue.
Self-check and answer
A fictional employee can accurately recite the access-removal procedure during an interview. Does that establish that the last departing contractor's access was removed as required? Identify the additional kind of evidence that could address the historical question.
Answer: the interview demonstrates knowledge of the procedure, not completion of that particular action. Relevant approval or removal records, current access information and an appropriate investigation of the event could help address what occurred. The exact evidence depends on the objective and environment. The lesson is to distinguish understanding, records and observed behavior, then draw a conclusion only as broad as the combined evidence supports.
Sources & further learning
Use primary sources and the current requirements relevant to your situation. This guide is a learning resource, not a contract-specific or assessment determination.
Learn what evidence can support—and what it cannot
Build on this guide with a connected concept, then explain how the two ideas fit together.
Continue learningWhen the concept becomes a practical question
After practicing the concept, explore whether CMMC Pulsar fits your team’s readiness organization and evidence workflow.
Explore CMMC PulsarSelf-checks are educational reflection activities. They do not confer a credential, demonstrate compliance, or establish certification. Read our editorial approach.