Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
← Back to the SPRS packageView →View →View →View →View →View →View →View →View →View →
Finish · Attest & file
Everything a prime asks for, in one bundle.
When a prime or a contracting officer asks how the company protects contract information, the team sends this. One packet, built from the company's own answers, on its own letterhead.
Self assessment record
Every question asked, the answer given, and each determination with the guide line it answers
System Security Plan
All 17 mapped practices, with narratives and evidence
FCI boundary (SSP § 1.2)
The people, devices, places and vendors in scope, and how contract information arrives and leaves
Signed affirmation memo
Senior Official signature under 32 CFR 170.22
Control inventory
17 of 17 practices marked MET
Determinations sheet
All 59 assessment objectives, one row each, with the evidence filed against it
Evidence inventory
Every artifact on file with where it came from and its review verdict
Officer review summary
Which requirements a credentialed officer reviewed, and when. Advisory, never a certification.
Audit log, append only
Every change to the record, who made it, and when
Integrity manifest
A SHA-256 hash for every file, signed, so anyone can check nothing was altered
Evidence on file · 21 artifacts
- Authorized users roster (Microsoft 365)AC.L1-3.1.1 · Pulled read only from Microsoft 365
- Authorized users roster (Microsoft 365)IA.L1-3.5.1 · Pulled read only from Microsoft 365
- MFA registration report (Microsoft 365)IA.L1-3.5.2 · Pulled read only from Microsoft 365
- Access and session policies (Microsoft 365)IA.L1-3.5.2 · Pulled read only from Microsoft 365
- Access and session policies (Microsoft 365)AC.L1-3.1.20 · Pulled read only from Microsoft 365
- Access Control Policy (Policy Center)AC.L1-3.1.2 · From your Policy Center
- Access Control Policy (Policy Center)AC.L1-3.1.22 · From your Policy Center
- Physical Protection Policy (Policy Center)PE.L1-3.10.1 · From your Policy Center
- Media destruction recordMP.L1-3.8.3 · From your registers
- Visitor logPE.L1-3.10.4 · From your registers
- Key and badge registerPE.L1-3.10.5 · From your registers
- quarterly-access-review-q2.xlsxAC.L1-3.1.1 · Uploaded, checked by Charlie
- admin-accounts-screenshot.pngAC.L1-3.1.2 · Uploaded, checked by Charlie
- website-content-review-q2.pdfAC.L1-3.1.22 · Uploaded, checked by Charlie
- visitor-escort-sign-entry.jpgPE.L1-3.10.3 · Uploaded, checked by Charlie
- office-firewall-rules-export.pdfSC.L1-3.13.1 · Uploaded, checked by Charlie
- guest-wifi-network-separation.pdfSC.L1-3.13.5 · Uploaded, checked by Charlie
- intune-patch-compliance.pngSI.L1-3.14.1 · Uploaded, checked by Charlie
- defender-endpoint-health-report.pdfSI.L1-3.14.2 · Uploaded, checked by Charlie
- defender-definitions-status.pngSI.L1-3.14.4 · Uploaded, checked by Charlie
- defender-scan-history.pngSI.L1-3.14.5 · Uploaded, checked by Charlie
Evidence is retained for six years from the CMMC Status Date, per 32 CFR 170.15(c)(2). This packet is sealed in the record and kept until June 19, 2032.
Your team builds this packet on the platform from its own answers, a credentialed officer reviews it, and it stays current as your record changes. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.