Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Step 4 of 5 · Policies & trackers
All 8 policies, drafted with you from your answers.
Saving the business profile at step 1 started a draft of every one of these from how the company actually runs. The team read them, made them true for the shop, and enforced them. Then the team decided each tracker, keep it or record why it does not apply, and the 17 safeguards unlocked.
Your policies
8 of 8 on file · 8 enforcedWho can get into systems with contract information, what they may do there, and how public information is controlled.
Backs 4 of your 17 mapped practices.
Every person gets their own account, and every account proves who is behind it.
Backs 2 of your 17 mapped practices.
How drives, devices, and paper with contract information are sanitized or destroyed before disposal or reuse.
Backs 1 of your 17 mapped practices.
Locks, escorts, visitor logs, and who may enter the spaces where contract work happens.
Backs 4 of your 17 mapped practices.
The boundary: firewalls, separation of public systems, and how the network is defended.
Backs 2 of your 17 mapped practices.
Patching flaws, antivirus everywhere, and keeping protection current.
Backs 4 of your 17 mapped practices.
The rules of behavior everyone signs: company systems, contract information, and personal use.
Signed by everyone with access.
How long you keep the proof behind your affirmation, where it lives, and who can produce it. Six years from the day you file.
Your records duty: six years from the day you file.
Your trackers
7 of 7 decidedThe logs the assessment guide names for Level 1. A log only counts by adding entries over time, so the ones that apply start now. If one genuinely does not apply, the team says why, and that reason stays on the record.
Evidences PE.L1-3.10.3 and PE.L1-3.10.4 (escorts and physical access logs). Backs 2 safeguards.
Evidences PE.L1-3.10.5 (physical access devices controlled). Backs 1 safeguard.
Evidences MP.L1-3.8.3 (media sanitized before disposal or reuse). Backs 1 safeguard.
Evidences AC.L1-3.1.1 (accounts stay limited to authorized users). Backs 1 safeguard.
Evidences AC.L1-3.1.1 and PE.L1-3.10.1 (account and physical access reviews). Backs 2 safeguards.
Evidences AC.L1-3.1.22 (publicly accessible information reviewed). Backs 1 safeguard.
Evidences SI.L1-3.14.4 and SI.L1-3.14.5 (protection updated, scans run). Backs 2 safeguards.
What this changes
The next step starts with the written rules and the living records in place. The team assesses each safeguard against the evidence it actually needs, rather than trying to rebuild the history at the end.
Your team keeps the policies and the logs current on the platform, a credentialed officer reviews them, and the program stays true after the first affirmation. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.