Cedar Ridge Machine Works, LLC
CMMC Level 1 Self Assessment · FAR 52.204-21
- Cycle
- FY2026 Annual Affirmation
- Status
- attested
- SAM UEI
- CR7MHK9QX2P4
- CAGE code
- 9KX41
- Entity type
- LLC
- NAICS codes
- 332710, 332721
- Generated
- June 19, 2026
- Approved
- 2026-06-15
- Affirmed
- 6/19/2026
1. System description and scope
Cedar Ridge Machine Works keeps its Federal Contract Information (FCI) in one Microsoft 365 Business Premium tenant, which it calls the Cedar Ridge Federal Programs enclave. Covered assets are twelve managed Windows 11 workstations, one shop floor estimating PC, the company file share in SharePoint Online, and Exchange Online mail. Quoting, drawings, and purchase orders tied to federal work live only in this tenant. The production CNC machines on the shop floor hold no FCI and are on a separate network with no inbound internet access.
External Service Provider responsibilities
A requirement may be satisfied by an External Service Provider, and it is considered MET only when adequate evidence of that is on Cedar Ridge Machine Works, LLC's own file (CMMC Assessment Guide L1 v2.13). The providers below hold responsibilities inside this scope:
- Microsoft 365
Responsibilities documented: Microsoft 365 shared responsibility, Microsoft Service Trust Portal
- High Desert IT Services
Responsibilities documented: High Desert IT Services managed services agreement, section 4
2. Senior official affirmation
Raymond T. Cedar, Owner and President affirmed on June 19, 2026 that the information in this plan is accurate and that Cedar Ridge Machine Works, LLC implements all 15 CMMC Level 1 basic safeguarding requirements (FAR 52.204-21(b)(1)(i)-(b)(1)(xv); 59 NIST SP 800-171A assessment objectives) as described.
3. Implementation of the 15 safeguarding requirements
For each requirement, the narrative below describes how Cedar Ridge Machine Works, LLC implements the practice, with supporting evidence on file.
AC · Access Control
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)
Only the five named Cedar Ridge staff who work federal jobs, plus the named High Desert IT Services technician, have accounts in the Federal Programs tenant. Accounts are created in Microsoft Entra ID by the owner, the user roster is pulled read only from Microsoft 365 and reviewed each quarter, and an account is disabled the same day a person leaves. Shop floor machinists without a federal role have no access to this tenant.
- Authorized users roster (Microsoft 365) (6/10/2026)
- quarterly-access-review-q2.xlsx (6/5/2026)
Authorized users are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Processes acting on behalf of authorized users are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Devices (and other systems) authorized to connect are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
System access is limited to authorized users. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
System access is limited to processes acting on behalf of authorized users. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
System access is limited to authorized devices (including other systems). Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Limit information system access to the types of transactions and functions that authorized users are permitted to execute
Access follows least privilege. Estimators can open and edit quotes and drawings; the office admin can read but not change them. Only the owner and the named High Desert IT Services technician hold admin rights in Microsoft 365, each through a separate named admin account used only for administration and protected by multi factor authentication. Roles are documented in the access list kept in SharePoint and reviewed each quarter.
- Access Control Policy (Policy Center) (5/20/2026)
- admin-accounts-screenshot.png (6/5/2026)
The transactions and functions authorized users are permitted to execute are defined. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
System access is limited to those defined transactions and functions. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Verify and control/limit connections to and use of external information systems
There are no public terminals or shared logins. The one shop floor estimating PC signs in with the same managed accounts and connects to the tenant over the company VPN only. The only outside connection is High Desert IT Services' remote support, which signs in through its named admin account under the same access and session policies as staff. No other external system connects into the Federal Programs tenant.
- Access and session policies (Microsoft 365) (6/10/2026)
Connections to external systems are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
The use of external systems is identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Connections to external systems are verified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
The use of external systems is verified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Connections to external systems are controlled / limited. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
The use of external systems is controlled / limited. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Control information posted or processed on publicly accessible information systems
Cedar Ridge has no public website posting area and no social accounts that publish federal work. The owner reviews the company site quarterly to confirm no drawings, quotes, or contract details are ever posted publicly.
- Access Control Policy (Policy Center) (5/20/2026)
- website-content-review-q2.pdf (6/3/2026)
Individuals authorized to post or process information on publicly accessible systems are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Procedures to ensure FCI is not posted or processed on publicly accessible systems are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
A review process exists prior to posting public content. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Public content is reviewed to ensure it does not include FCI. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Mechanisms exist to remove and address improper posting of FCI. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
IA · Identification & Authentication
Identify information system users, processes acting on behalf of users, or devices
Every user has a unique named account in Microsoft Entra ID. Shared or generic logins are not permitted. Devices are enrolled in Intune and identified by the company before they are allowed to connect.
- Authorized users roster (Microsoft 365) (6/10/2026)
System users are identified (unique IDs). Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Processes acting on behalf of users are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Devices accessing the system are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems
All accounts require a password meeting the company policy plus multi factor authentication through Microsoft Authenticator. MFA is enforced by an access policy for every user in the tenant, and the MFA registration report and the access policies are pulled read only from Microsoft 365.
- MFA registration report (Microsoft 365) (6/10/2026)
- Access and session policies (Microsoft 365) (6/10/2026)
Each user's identity is authenticated before system access. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Each process acting on behalf of a user is authenticated before access. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Each device accessing the system is authenticated before access. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
MP · Media Protection
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse
Old drives and USB media are wiped or physically destroyed before disposal, logged on the media destruction record. Paper drawings and travelers tied to federal jobs are shredded on site. No federal media leaves the building intact.
- Media destruction record (5/28/2026)
Media containing FCI is sanitized or destroyed before disposal. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Media containing FCI is sanitized before being released for reuse. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
PE · Physical Protection
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals
The office and server closet are locked, and only the owner and office admin hold keys. Workstations are in the controlled office area, not the open shop floor. The visitor policy keeps non employees out of areas where FCI is worked.
- Physical Protection Policy (Policy Center) (5/20/2026)
Authorized individuals allowed physical access are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Physical access to systems is limited to authorized individuals. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Physical access to equipment is limited to authorized individuals. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Physical access to operating environments is limited to authorized individuals. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Escort visitors and monitor visitor activity
Visitors sign in at the front office and are escorted at all times while inside. The escort requirement is posted at the entry and recorded in the visitor log kept at the front desk.
- visitor-escort-sign-entry.jpg (6/2/2026)
Visitors are escorted. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Visitor activity is monitored. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Maintain audit logs of physical access
The visitor log at the front desk records the name, company, date, time in, time out, and host for every visitor. The owner reviews it monthly and retains it as an audit record.
- Visitor log (6/2/2026)
Audit logs of physical access are maintained. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Control and manage physical access devices
Physical keys are issued only to the owner and office admin and are tracked on the key and badge register. The alarm code is changed when anyone with access leaves. Building access devices are limited to the two named staff.
- Key and badge register (6/2/2026)
Physical access devices are identified (keys, fobs, badges). Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Physical access devices are controlled. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Physical access devices are managed (issued, revoked, inventoried). Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
SC · System & Communications Protection
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems
The Federal Programs tenant sits behind Microsoft 365 boundary protection, and the office network is protected by a managed firewall. The shop floor CNC network is separated from the office network and has no inbound internet path. Remote access is only through the company VPN.
- office-firewall-rules-export.pdf (6/8/2026)
The external system boundary is defined. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Key internal system boundaries are defined. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Communications are monitored at the external boundary. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Communications are monitored at key internal boundaries. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Communications are controlled at the external boundary. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Communications are controlled at key internal boundaries. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Communications are protected at the external boundary. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Communications are protected at key internal boundaries. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
The office guest Wi Fi is a separate network with no route to the Federal Programs systems. Publicly reachable services are not hosted on the internal network; the company website is hosted externally and holds no FCI.
- guest-wifi-network-separation.pdf (6/8/2026)
Publicly accessible system components are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Publicly accessible subnetworks are physically or logically separated from internal networks. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
SI · System & Information Integrity
Identify, report, and correct information and information system flaws in a timely manner
Microsoft Defender and Windows Update for Business keep every managed workstation patched and current. Intune reports patch status, and the owner reviews the compliance dashboard weekly to confirm all covered devices are up to date.
- intune-patch-compliance.png (6/10/2026)
The time within which to identify system flaws is specified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
System flaws are identified within that time frame. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
The time within which to report system flaws is specified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
System flaws are reported within that time frame. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
The time within which to correct system flaws is specified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
System flaws are corrected within that time frame. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test
Provide protection from malicious code at appropriate locations within organizational information systems
Microsoft Defender Antivirus runs on every managed workstation with real time protection on and enforced by Intune policy. The endpoint protection report on file shows all covered devices reporting healthy.
- defender-endpoint-health-report.pdf (6/10/2026)
Designated locations for malicious-code protection are identified. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Protection from malicious code at those locations is provided. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Update malicious code protection mechanisms when new releases are available
Defender definitions update automatically through Microsoft, so signatures stay current without manual work. The Intune report confirms every device has current protection updates.
- defender-definitions-status.png (6/10/2026)
Malicious-code protection mechanisms are updated when new releases are available. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
Real time and scheduled scans run on every managed workstation, and downloads and email attachments are scanned as they arrive. Scan results feed the Defender dashboard the owner reviews weekly.
- defender-scan-history.png (6/10/2026)
The frequency for malicious-code scans is defined. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: examine
Malicious-code scans are performed at that frequency. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: interview
Real-time scans of files from external sources are performed on download / open / execute. Confirmed by the Cedar Ridge team during the annual self assessment and recorded in the System Security Plan.
Method: test