Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Custodia shield
Start free for 30 days, no card
← Back to the Level 2 workspace

Step 1 of 5 · Your business

First, your business.
Then find your CUI.

Everything here lands on the System Security Plan, all 14 policies, and the SPRS record, so the team only ever says it once. Meridian found its business on SAM.gov and the codes filled in. These are its saved answers.

8 of 8 answered
Rather talk it through? Charlie asks one plain question at a time and fills this page in with you.

1 · Fastest path

Find your business on SAM.gov

Type the legal business name, and the legal name, entity type, Unique Entity ID and CAGE code come in from the SAM registration. No IDs to hunt down.

Found on SAM.gov: Meridian Defense Systems, Inc.

2 · Your company, on paper

The name and codes the government knows you by

Why we ask: this exact information appears on the SSP, every policy, and the SPRS record.

Legal business name
Meridian Defense Systems, Inc.
Entity type
C corporation
Unique Entity ID (SAM.gov)
MD8QK4R2XP71
CAGE code
7ML52
Other CAGE codes (divisions, other locations)
None. The primary CAGE code covers the whole business.
Address
Huntsville, AL 35806

3 · Where CUI lives

Where will your CUI live?

Why we ask: the most consequential decision of the whole journey. It sets which computers, accounts, and people the assessor examines.

A dedicated CUI enclave (chosen)One separate, locked down space that is the only place CUI ever goes: a dedicated computer, a separate cloud space (Microsoft GCC High is a common one), or both, and only the few people who truly need in. The assessment covers just that space.Right for most small businessesMeridian's answer
Our whole company networkCUI can live anywhere your files live today. Every computer, phone, server, account, and person becomes subject to all the requirements, with evidence for each.
Help me decideThe honest choice if you are not certain. Tell Charlie how many people touch CUI and what tools you use, and he suggests a boundary you can defend.
What should we call it?
Meridian CUI Enclave
Where CUI will live
Microsoft 365 GCC High

This name goes on the cover of the System Security Plan, the document the whole assessment revolves around.

4 · Who signs

The Affirming Official

Why we ask: federal rules require one senior person to put their name on your compliance, once after the assessment and every year after. For most small businesses this is the owner. It cannot be your IT vendor or a consultant, and it is never the officer who reviews your work.

Full name
Elena R. Marsh
Title
Chief Executive Officer
Email
emarsh@meridiandefense.example

5 · Your contracts

Which contracts bring you CUI?

Why we ask: your contracts are the legal reason you need Level 2 at all, and the assessor asks which ones are covered. Look for DFARS 252.204-7012 in the clauses section, or ask your prime whether your subcontract flows it down.

Contracts
Example subcontract under a prime's rotary wing avionics test program, with DFARS 252.204-7012 flowed down.
The system and the Affirming Official are set.Next: Federal systemsOpen →

Your team answers once, Charlie helps in plain English, and a credentialed officer reviews it before anything is signed. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no cardBook a free advisory call