Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Step 4 of 5 · Policies & trackers
Write down how you already work
Two chapters. Create the 14 policies, then decide which logs you keep. Drafts are starting points; Adopted is what an assessor can be shown.
Meridian's team drafted all 14 with Charlie from its own answers, adopted each one once every statement was true for the business, and decided every register.
Chapter 1 · The 14 policies
14 of 14 adoptedA baseline is a starting point. It proves checks only after it is adopted, when every statement is true for the business. Everyone with access signs each adopted policy, and those signatures show the team was made aware of the policies (AT.L2-3.2.1).
The awareness record
Security awareness training for the whole team11 people completed the course, and nobody is missing, with a completion date and a score for each.See the training →Chapter 2 · Your registers
19 of 19 decidedThese are the running logs the requirements expect a business to keep. Each one is decided: kept (the team maintains this log), or not applicable with the reason why. The reason is itself honest evidence. Meridian keeps 16 and wrote a reason for 3, all decided by February 27, 2026.
Every configuration change with its reason, security impact call, and approver.
Log lives here
Patched systems, firmware updates, hardware service, and vendor maintenance visits.
Log lives here
Every security incident: detection, actions, containment, and who was told when.
Log lives here
The annual tabletop: scenario, who played, what the plan got wrong, what changed.
Log lives here
Who came, who escorted them, in and out.
Log lives here
Drives wiped, paper shredded, equipment sanitized before it left, with the method.
Log lives here
Every key, badge, and door code: who holds it, when issued, returned, or changed.
Log lives here
Who completed what training and when, including the role and insider threat annexes.
Log lives here
CUI media leaving the facility: carrier, destination, out and back.
Not applicable: No removable media and no paper carry our CUI (confirmed on our assessment scope). Finished deliverables go back to the prime only through its controlled file portal.
The monthly look at the logs: what was checked, what was found, who looked.
Log lives here
Background checks before CUI access, per person.
Log lives here
Each security alert or advisory you looked at, whether it applies to you, and what you did about it.
Log lives here
Your own periodic check that the controls still work, on the frequency your policy sets.
Log lives here
For each person who handles controlled information away from the office, the safeguards in place where they work.
Not applicable: Nobody handles CUI away from the office. The Huntsville engineering area is the only place on our assessment scope, and the engineering workstations stay there.
Every person who left, moved teams, or changed roles, and the day their access was removed. The gap between those two dates is the finding.
Log lives here
Each time you walk the account list or the physical access list and confirm every person on it still belongs there.
Log lives here
Each review of your website, socials, and anywhere else you post, confirming no contract information is sitting in public.
Log lives here
Proof your antivirus definitions are current, and what it did when it caught something.
Log lives here
Every subcontractor that receives controlled information from you, with its CMMC status and unique identifier as checked in SPRS, and when you checked. The flow down (32 CFR 170.23) turns on this list.
Not applicable: We send controlled information to no subcontractor. Our list of controlled files shows it goes out only to the prime.
Your team writes down how it already works, with Charlie drafting alongside, and a credentialed officer reviews it before anything is signed. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.