Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Step 5 of 5 · Self Assessment
CMMC Level 1 · FY2026
Senior Official · Raymond T. Cedar
The federal info
is locked down.
The team at Cedar Ridge Machine Works, LLC answered all 17 safeguarding mapped practices that protect its Federal Contract Information in plain English, filed the proof behind each one, and confirmed each one MET. A credentialed officer reviewed every answer.
Signed and current.
Your senior official posted the affirmation in SPRS. The bid ready packet bundles the SSP, the signed affirmation and the evidence, ready for any prime or contracting officer.
Evidence freshness at a glance.
Stale connectors mean stale evidence. If a prime asks for proof that sign in protection is still on, the answer should come from data pulled this week, not last quarter.
- Microsoft 365Fresh
Checked daily · cedarridgemachine.onmicrosoft.com
- Google WorkspaceNot connected
Cedar Ridge runs on Microsoft 365, so there is nothing to connect here.
The 17 mapped
practices.
Every requirement is MET, confirmed by the team with the proof on file. Click any one to see how it was answered.
Who can get in
Access Control- AC.L1-3.1.1Authorized Access Control[FCI Data]MET
FAR 52.204-21 (b)(1)(i)·NIST 800-171 r2 3.1.1
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)
Policy enforcedLog startedConnector evidence
- AC.L1-3.1.2Transaction & Function Control[FCI Data]MET
FAR 52.204-21 (b)(1)(ii)·NIST 800-171 r2 3.1.2
Limit information system access to the types of transactions and functions that authorized users are permitted to execute
Policy enforced
- AC.L1-3.1.20External Connections[FCI Data]MET
FAR 52.204-21 (b)(1)(iii)·NIST 800-171 r2 3.1.20
Verify and control/limit connections to and use of external information systems
Policy enforcedConnector evidence
- AC.L1-3.1.22Control Public Information[FCI Data]MET
FAR 52.204-21 (b)(1)(iv)·NIST 800-171 r2 3.1.22
Control information posted or processed on publicly accessible information systems
Policy enforcedLog started
Proving who they are
Identification and Authentication- IA.L1-3.5.1Identification[FCI Data]MET
FAR 52.204-21 (b)(1)(v)·NIST 800-171 r2 3.5.1
Identify information system users, processes acting on behalf of users, or devices
Policy enforcedConnector evidence
- IA.L1-3.5.2Authentication[FCI Data]MET
FAR 52.204-21 (b)(1)(vi)·NIST 800-171 r2 3.5.2
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems
Policy enforcedConnector evidence
Handling media safely
Media Protection- MP.L1-3.8.3Media Disposal[FCI Data]MET
FAR 52.204-21 (b)(1)(vii)·NIST 800-171 r2 3.8.3
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse
Policy enforcedLog started
Protecting your workspace
Physical Protection- PE.L1-3.10.1Limit Physical Access[FCI Data]MET
FAR 52.204-21 (b)(1)(viii)·NIST 800-171 r2 3.10.1
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals
Policy enforcedLog started
- PE.L1-3.10.3Escort Visitors[FCI Data]MET
FAR 52.204-21 (b)(1)(ix), escort clause·NIST 800-171 r2 3.10.3
Escort visitors and monitor visitor activity
Policy enforcedLog started
- PE.L1-3.10.4Physical Access Logs[FCI Data]MET
FAR 52.204-21 (b)(1)(ix), audit log clause·NIST 800-171 r2 3.10.4
Maintain audit logs of physical access
Policy enforcedLog started
- PE.L1-3.10.5Manage Physical Access[FCI Data]MET
FAR 52.204-21 (b)(1)(ix), access device clause·NIST 800-171 r2 3.10.5
Control and manage physical access devices
Policy enforcedLog started
Protecting your network
System and Communications Protection- SC.L1-3.13.1Boundary Protection[FCI Data]MET
FAR 52.204-21 (b)(1)(x)·NIST 800-171 r2 3.13.1
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems
Policy enforced
- SC.L1-3.13.5Public-Access System Separation[FCI Data]MET
FAR 52.204-21 (b)(1)(xi)·NIST 800-171 r2 3.13.5
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
Policy enforced
Keeping systems healthy
System and Information Integrity- SI.L1-3.14.1Flaw Remediation[FCI Data]MET
FAR 52.204-21 (b)(1)(xii)·NIST 800-171 r2 3.14.1
Identify, report, and correct information and information system flaws in a timely manner
Policy enforced
- SI.L1-3.14.2Malicious Code Protection[FCI Data]MET
FAR 52.204-21 (b)(1)(xiii)·NIST 800-171 r2 3.14.2
Provide protection from malicious code at appropriate locations within organizational information systems
Policy enforced
- SI.L1-3.14.4Update Malicious Code Protection[FCI Data]MET
FAR 52.204-21 (b)(1)(xiv)·NIST 800-171 r2 3.14.4
Update malicious code protection mechanisms when new releases are available
Policy enforcedLog started
- SI.L1-3.14.5System & File Scanning[FCI Data]MET
FAR 52.204-21 (b)(1)(xv)·NIST 800-171 r2 3.14.5
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
Policy enforcedLog started
Your team answers every requirement in plain English, Charlie drafts with them, and a credentialed officer reviews every answer before your senior official signs. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.