Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Custodia shield
Start free for 30 days, no card
← Back to the workspace

Level 1 · Your records

Your records, sealed and kept.

Level 1 runs on one clock: a self assessment and an affirmation every year, posted by your senior official in the Supplier Performance Risk System (SPRS). Sealed the moment your senior official signs, checked every month, and sealed again whenever something changed. Kept six years from your CMMC Status Date (32 CFR 170.15(c)(2)), downloadable even after a status lapses.

  • What your team does each year: keep the evidence fresh, answer the annual review, and sign the affirmation.
  • What the record vault does: seals your whole record as version 1 the moment your senior official signs, then checks it every month and seals a new version in any month something changed, or whenever you ask. It hashes every file and every evidence artifact, signs the manifest, and chains each version to the one before.
  • What you hand a contracting officer or counsel: the ZIP of the version they ask about. Its README explains how to check every hash with nothing from Custodia.

Seal a version now (FY2026 Annual Affirmation)

Just fixed something and want it on the record today? Seal the whole record as it stands, with one line on why. The monthly check would catch it anyway; this puts your date on it.

What changed, in one line (optional)Seal version 2

FY2026 Annual Affirmation

Signed · 2026-06-19

CMMC Status Date 2026-06-19 (submitted to SPRS). Signed by Raymond T. Cedar, Owner and President.

  • Version 1 · Affirmation signed

    Sealed 2026-06-19 by Raymond T. Cedar, Owner and President · keep until 2032-06-19

    Download ZIPVerify: intact
    What is inside
    • · System Security Plan
    • · Signed affirmation memo
    • · Every evidence file, hashed
    • · Policies and registers
    • · Audit log, append only
    • · Officer review summary
    • · Signed integrity manifest

    Manifest hash 3f9c1a7e52d0…, the first of this level.

“Verify: intact” is a label on this Example. On your real record, Verify recomputes the manifest hash, the signature, and every file and evidence artifact from storage, and says in one line whether anything differs.

Every version is append only: nothing here can be edited or deleted, by you or by Custodia, inside the six year window. Cedar Ridge Machine Works, LLC is an Example, and these hashes are illustrations.

It stays true

The record behind your affirmation, kept whether or not you stay.

Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no cardBook a free advisory call