Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Step 1 of 5 · Your business

Who you are, and who signs.

Entered one time, and every deliverable fills itself in from here. No forms to repeat, no data to retype. Saving this profile also started drafts of all 8 Level 1 policies from these answers, ready for the team to tailor at step 4.

Who affirms for Cedar Ridge Machine Works, LLC

Every year a senior official from inside the company affirms compliance in SPRS. Nothing is signed here; the platform just needs to know who that is so the paperwork carries the right name.

Raymond T. Cedar, Owner and President

raymond@cedarridgemachine.com · the senior official who signs and posts the affirmation in SPRS

4 quick questions about your setup

4 of 4 answered

These decide which steps apply, and they pre fill the scope so step 3 starts half built before the team confirms each row.

Which best describes your setup?

An office with your own networkA shop or office with your own internet router, maybe a shared file server.

Where do your email and files mostly live?

Microsoft 365

How does your team log in?

Each person logs in on their own computer

Does any of your federal work involve CUI?

No, just regular contract informationPurchase orders, emails, invoices. Nothing marked CUI or CDI.

Your company details

Legal name: Cedar Ridge Machine Works, LLC
Entity type: LLC
What you do: Machine shops & precision machining
Customers: DoD agencies, Prime contractors
Team size: 11 to 25 (14 people)
Systems in scope: Cedar Ridge Machine Works keeps its Federal Contract Information (FCI) in one Microsoft 365 Business Premium tenant, which it calls the Cedar Ridge Federal Programs enclave. Covered assets are twelve managed Windows 11 workstations, one shop floor estimating PC, the company file share in SharePoint Online, and Exchange Online mail. Quoting, drawings, and purchase orders tied to federal work live only in this tenant. The production CNC machines on the shop floor hold no FCI and are on a separate network with no inbound internet access.
Your federal enclave: Cedar Ridge Federal Programs

Brand your deliverables

The contact details below put the System Security Plan, the affirmation memo, and the bid ready packet on the company's own letterhead. None of it is required by CMMC; blank fields simply do not appear.

Website: cedarridgemachine.com
Phone: (541) 555-0142
Email: contracts@cedarridgemachine.com
Address: 1420 Wilson Avenue, Suite 3, Bend, OR 97701

Your team sets the business up once, and every step and document carries it from there. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no card Book a free advisory call

Charlie

The gov safe AI guide

Does my shop need Level 1 or Level 2?

FCI only usually means Level 1, and CUI usually means Level 2. The clause in your solicitation or flow down sets it. Cedar Ridge handles FCI only, so Level 1. (FAR 52.204-21, 32 CFR 170)

How do we show that only the right people get in?

Connect Microsoft 365 and your user roster and your access and session policies come in read only for AC.L1-3.1.1, IA.L1-3.5.1 and AC.L1-3.1.20. Your team confirms each answer, and I draft the narrative with you and cite FAR 52.204-21(b)(1)(i).

Who signs? Does the officer sign for us?

Your senior official signs the affirmation and posts it in SPRS. A credentialed officer reviews every step before that and never signs for you. (32 CFR 170.22)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call