Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
AC.L1-3.1.2 · FAR 52.204-21 (b)(1)(ii) · NIST SP 800-171 3.1.2
Transaction & Function Control
Limit information system access to the types of transactions and functions that authorized users are permitted to execute
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Even authorized users shouldn't have more access than their job requires, a bookkeeper shouldn't be able to change IT settings.
Why it matters
Admin sprawl is the most common finding. If a bookkeeper or intern is a Global Admin or has root, expect questions. Least-privilege role assignment, documented, is what primes want to see.
The proof on file
- Access Control Policy (Policy Center)From your Policy Center · May 20, 2026On file
- admin-accounts-screenshot.pngUploaded, checked by Charlie · June 5, 2026Sufficient
Every uploaded file is checked by Charlie the moment it arrives, so a gap is caught on the spot, not at the assessment. Pulls from Microsoft 365 and references to the Policy Center and registers come straight from where they live, so they skip that check.
The narrative on file
Access follows least privilege. Estimators can open and edit quotes and drawings; the office admin can read but not change them. Only the owner and the named High Desert IT Services technician hold admin rights in Microsoft 365, each through a separate named admin account used only for administration and protected by multi factor authentication. Roles are documented in the access list kept in SharePoint and reviewed each quarter.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Every user with admin/elevated privileges is visible by name
- The role assigned to each admin is visible (Global Admin, Super Admin, root, etc.)
- At least one screenshot of a standard user showing they have NO admin role
- For the role matrix: every system covered, business justification per row, owner signature
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Microsoft 365, step by step
- 1Go to admin.microsoft.com → Users → Active users
- 2Filter by Roles = any admin role (Global Admin, Billing Admin, User Admin, etc.)
- 3Screenshot the filtered list showing every admin-level account
- 4Separately, screenshot a regular (non-admin) user's role page to show baseline
Capture: Two screenshots: (1) admin role assignments, (2) a standard user showing no elevated roles.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.