Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
AC.L1-3.1.1 · FAR 52.204-21 (b)(1)(i) · NIST SP 800-171 3.1.1
Authorized Access Control
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Only people you've approved can log in to systems that handle government contract information.
Why it matters
If a former employee still has a login, or a vendor has access they no longer need, that's a finding. Primes will ask you to prove you actively manage who has access.
The proof on file
- Authorized users roster (Microsoft 365)Pulled read only from Microsoft 365 · June 10, 2026On file
- quarterly-access-review-q2.xlsxUploaded, checked by Charlie · June 5, 2026Sufficient
Every uploaded file is checked by Charlie the moment it arrives, so a gap is caught on the spot, not at the assessment. Pulls from Microsoft 365 and references to the Policy Center and registers come straight from where they live, so they skip that check.
The narrative on file
Only the five named Cedar Ridge staff who work federal jobs, plus the named High Desert IT Services technician, have accounts in the Federal Programs tenant. Accounts are created in Microsoft Entra ID by the owner, the user roster is pulled read only from Microsoft 365 and reviewed each quarter, and an account is disabled the same day a person leaves. Shop floor machinists without a federal role have no access to this tenant.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Screenshot or export shows the FULL list of authorized users (not a partial view)
- Each user has a Display Name and Username/Email visible
- A Status column (Active / Enabled / Authorized) is visible for every account
- The capture date is visible (system clock in screenshot OR file metadata)
- If using the manual roster: every row signed and dated by the owner
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Microsoft 365, step by step
- 1Go to admin.microsoft.com (Microsoft 365 admin center)
- 2Click Users → Active users
- 3Make sure the visible columns include Display Name, Username, and Status
- 4Take a full-window screenshot
Capture: Screenshot of the Active users list showing every account on your tenant. If you have more than 20 users, also export as CSV and upload both files.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.