Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Level 2 · Your records

Every year, every version, kept for you.

Three clocks run your Level 2 life. Your self assessment lasts three years. Your affirmation is due every year, posted by your senior official in the Supplier Performance Risk System (SPRS). And every package here is kept six years from the cycle's CMMC Status Date (32 CFR 170.16(c)(4)), downloadable even after a status lapses.

What your team does each year: keep the evidence fresh, let the platform pull again what it can, and log the affirmation when the window opens.
What the record vault does: seals a new version of your whole record when the self assessment is recorded, at every affirmation, at every plan of action closeout, in any month the monthly check finds a change, and whenever you ask. It hashes every file and every evidence artifact, signs the manifest, and chains each version to the one before.
What you hand a contracting officer or counsel: the ZIP of the version they ask about. Its README explains how to check every hash with nothing from Custodia.

How Level 2 is assessed today: Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

Seal a version now (FY2026 Level 2 self assessment)

Just fixed something and want it on the record today? Seal the whole record as it stands, with one line on why. The monthly check would catch it anyway; this puts your date on it.

What changed, in one line (optional)Seal version 5

FY2026 Level 2 self assessment

Current

Recorded 2026-03-11 · CMMC Status Date 2026-07-22 · SPRS score 110

Version 1 · Self assessment recorded
Sealed 2026-03-11 · keep until 2032-03-11
Download ZIPVerify: intact
What is inside
- · The System Security Plan
- · The assessment scope
- · The policies and the registers
- · Findings and method records
- · The score and plan of action as they stood
- · Affirmations on record
- · Every evidence artifact, hashed
- · A signed manifest, chained to the version before
Manifest hash 9b41e07c3a25…, the first of this level.
Version 2 · Affirmation
Sealed 2026-03-11 by Elena R. Marsh, Chief Executive Officer · keep until 2032-03-11
Affirmation at the SPRS filing
Download ZIPVerify: intact
What is inside
- · The System Security Plan
- · The assessment scope
- · The policies and the registers
- · Findings and method records
- · The score and plan of action as they stood
- · Affirmations on record
- · Every evidence artifact, hashed
- · A signed manifest, chained to the version before
Manifest hash 5e8a2d94b17f…, chained to 9b41e07c3a25….
Version 3 · Plan of action closed out
Sealed 2026-07-22 · keep until 2032-07-22
POA&M closeout
Download ZIPVerify: intact
What is inside
- · The System Security Plan
- · The assessment scope
- · The policies and the registers
- · Findings and method records
- · The score and plan of action as they stood
- · Affirmations on record
- · Every evidence artifact, hashed
- · A signed manifest, chained to the version before
Manifest hash c7d2f5a18e60…, chained to 5e8a2d94b17f….
Version 4 · Affirmation
Sealed 2026-07-22 by Elena R. Marsh, Chief Executive Officer · keep until 2032-07-22
Affirmation at the SPRS filing
Download ZIPVerify: intact
What is inside
- · The System Security Plan
- · The assessment scope
- · The policies and the registers
- · Findings and method records
- · The score and plan of action as they stood
- · Affirmations on record
- · Every evidence artifact, hashed
- · A signed manifest, chained to the version before
Manifest hash e03b6c71d4a9…, chained to c7d2f5a18e60….

“Verify: intact” is a label on this Example. On your real record, Verify recomputes the manifest hash, the signature, and every file and evidence artifact from storage, and says in one line whether anything differs.

Every version is append only: nothing here can be edited or deleted, by you or by Custodia, inside the six year window. Meridian Defense Systems, Inc. is an Example, and these hashes are illustrations.

It stays true

The record behind your affirmation, kept whether or not you stay.

Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no card Book a free advisory call

Charlie

The gov safe AI guide

Who actually assesses us for Level 2?

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

We use Microsoft 365 GCC High. Does Microsoft cover the requirements for us?

Partly. Microsoft's placemat marks most requirements as shared coverage for GCC High, so each one drafts as shared: Microsoft's half goes in your responsibility matrix, and your half (your laptops, your office, your people, and your tenant settings) is still yours to show. Meridian's team confirmed its half on every card.

What can go on a POA&M?

Only 1 point requirements, plus FIPS validated encryption when encryption is in place but not yet validated, and only at a score of 88 or better. Every item has to close within 180 days, and a short list can never ride a POA&M at all, the System Security Plan among them. (32 CFR 170.21)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call