Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Level 2 · Connectors

Proof pulled read only, confirmed by your team.

Connect a system once and the platform pulls its settings evidence and keeps it fresh. It reads configuration only, never your files, your mail, or any controlled data. Meridian Defense Systems, Inc. connected Microsoft 365 on February 20, 2026.

Microsoft 365

Read onlyConnected

Entra ID, Intune and Microsoft 365 admin. A Global Administrator granted read only consent once; there is no ongoing sign in after that.

Cloud: GCC High
Tenant: meridiandefense.onmicrosoft.us
Connected: February 20, 2026 by Carla Reyes
Freshness: Checked daily, last check today

GCC High connects through Custodia's Azure Government app, the government app registration GCC High and DoD tenants use. The same areas pull, and the tenant's own licenses decide what each one returns.

Pulls switched on

Level 2 requirements

Letters they can carry

today

Last check

Example tenant. Nothing on this page is a real Microsoft 365 account.

What it pulls, read only

12 pulls, each mapped to the Level 2 letters it can carry.

Authorized users roster

Fresh copy every 30 days

Can carry

AC.L2-3.1.1 [a,b,d]
IA.L2-3.5.1 [a,b]
IA.L2-3.5.6 [b]

Multi factor authentication (MFA) registration report

Fresh copy every 90 days

Can carry

IA.L2-3.5.2 [a]
IA.L2-3.5.3 [a,c,d]

Access and session policies

Fresh copy every 90 days

Can carry

AC.L2-3.1.1 [f]
IA.L2-3.5.2 [c]
AC.L2-3.1.20 [c,d]
AC.L2-3.1.11 [a,b]
SC.L2-3.13.9 [a,c]
AC.L2-3.1.12 [a,c]
AC.L2-3.1.15 [c,d]
AC.L2-3.1.18 [b]
IA.L2-3.5.3 [c,d]
IA.L2-3.5.4 [a]
MA.L2-3.7.5 [a,b]

Privileged role assignments

Fresh copy every 90 days

Can carry

AC.L2-3.1.5 [a,b,d]
AC.L2-3.1.2 [b]
AC.L2-3.1.4 [c]
AC.L2-3.1.6 [b]
AC.L2-3.1.7 [a,b,c]
AT.L2-3.2.2 [b]
AU.L2-3.3.8 [a,d]
AU.L2-3.3.9 [b]
CM.L2-3.4.5 [h]
IA.L2-3.5.3 [a]
SC.L2-3.13.3 [c]

Groups and their members

Fresh copy every 90 days

Can carry

AC.L2-3.1.2 [b]
AC.L2-3.1.4 [c]

Password and lockout settings

Fresh copy every 90 days

Can carry

AC.L2-3.1.8 [a,b]
IA.L2-3.5.7 [a,c]
IA.L2-3.5.8 [b]

Audit logging activity

Fresh copy every 30 days

Can carry

AU.L2-3.3.1 [c,d]
AU.L2-3.3.2 [b]
AC.L2-3.1.7 [d]
AU.L2-3.3.7 [a]
CM.L2-3.4.3 [d]

Sign in activity

Fresh copy every 30 days

Can carry

AU.L2-3.3.1 [c,d]
AU.L2-3.3.2 [b]
IA.L2-3.5.2 [a]
IA.L2-3.5.3 [c,d]
AC.L2-3.1.8 [b]
AC.L2-3.1.20 [d]
SI.L2-3.14.7 [b]

Guest, external collaboration and app consent settings

Fresh copy every 90 days

Can carry

AC.L2-3.1.20 [e,f]
CM.L2-3.4.9 [b]

Endpoint antivirus state

Fresh copy every 30 days

Can carry

SI.L2-3.14.2 [b]
SI.L2-3.14.4 [a]
SI.L2-3.14.5 [b,c]

Device compliance policies

Fresh copy every 90 days

Can carry

AC.L2-3.1.10 [a,b,c]
AC.L2-3.1.19 [b]
CM.L2-3.4.2 [b]
SC.L2-3.13.16 [a]

Device configuration profiles

Fresh copy every 90 days

Can carry

AC.L2-3.1.10 [a,b,c]
AC.L2-3.1.19 [b]
AC.L2-3.1.21 [c]
CM.L2-3.4.2 [b]
CM.L2-3.4.6 [b]
CM.L2-3.4.7 [f,i]
MP.L2-3.8.7 [a]
MP.L2-3.8.8 [a]
SC.L2-3.13.16 [a]
SI.L2-3.14.1 [e]
SI.L2-3.14.5 [a]

Your team stays in charge

Your team confirms every letter. A withheld pull blocks MET until a dated statement says why.

A pull carries a letter only when what it returns shows the setting in place. When it does not, the pull is still filed, as a finding to fix, and the letter is withheld. Fix it and pull again, or record a dated statement in your own name that says why the pull is wrong. A credentialed officer reviews every step and never signs.

Year round, cycle after cycle

Connected evidence keeps watching all year.

Checked daily

The platform checks the currency of every enabled area's evidence automatically each day, so no one has to remember to click sync.

Refreshed on schedule

Each evidence kind carries a freshness window, 30 days for rosters, devices, and activity, 90 for security policies and settings. When it lapses, the next daily check pulls a fresh copy. One live copy per kind, never a pile of stale duplicates.

Drift flagged

Every fresh pull is compared with the last copy. If a setting changed, the old copy is retired as superseded and a drift flag opens on the mapped control. Anything going stale lands on your compliance calendar and in your email digest.

What this connector can never see

Stated before you connect. These stay in your Registers, Policy Center, and manual capture, with the same freshness tracking:

· Physical security, visitor logs, facility access
· Policies, procedures, training records
· Paper media and media disposal
· On premises network gear, firewalls, VLANs
· Anything outside this Microsoft 365 tenant
· File contents, mail contents, or any controlled data

Google Workspace

Ready to connect

Runs on Google Workspace instead? It connects here the same way, read only, and your team confirms what it brings in.

Connect your own

Connected proof stays fresh. Your team stays in charge of every answer.

Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no card Book a free advisory call

Charlie

The gov safe AI guide

Who actually assesses us for Level 2?

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

We use Microsoft 365 GCC High. Does Microsoft cover the requirements for us?

Partly. Microsoft's placemat marks most requirements as shared coverage for GCC High, so each one drafts as shared: Microsoft's half goes in your responsibility matrix, and your half (your laptops, your office, your people, and your tenant settings) is still yours to show. Meridian's team confirmed its half on every card.

What can go on a POA&M?

Only 1 point requirements, plus FIPS validated encryption when encryption is in place but not yet validated, and only at a score of 88 or better. Every item has to close within 180 days, and a short list can never ride a POA&M at all, the System Security Plan among them. (32 CFR 170.21)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call