Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Step 5 of 5 · Self assessment

Every one of the 110 requirements, worked by Meridian's own team.

These are the security requirements that protect the CUI inside the scope. Meridian Defense Systems, Inc. answered all 320 questions under them, one letter at a time, with the proof behind each. Charlie drafts and cites; a person on the team confirms every finding, and a credentialed officer reviews every step.

If you filed today: 110 of 110, the Final Level 2 (Self) path; every requirement MET or not applicable, no plan of action needed.

Import first, then ask

Your provider showed 74 letters on 45 requirements: 74 confirmed on the record, 0 waiting for your confirmation.

Microsoft 365 GCC High is connected read only. Each pulled letter waited for one click on the session board, recorded in the name of the person who confirmed it. Nothing turned MET on its own. See the connection · Open the sessions

All 110 resolved · Your score is ready

Every requirement has a finding. Time for the honest number.

The score page shows the number out of 110, the plan of action Meridian used on the way, and the day it closed out.

See the score →

Done

109

In progress

Still open

Doesn't apply

To do

Open a finished card

IA.L2-3.5.3Multifactor Authentication4 letters · open the card →PE.L2-3.10.2Monitor Facility4 letters · open the card →AT.L2-3.2.1Role-based Risk Awareness4 letters · open the card →

Browse by topic

The 14 topics of NIST SP 800-171, in the order of the official Assessment Guide, with the plain name first.

ACWho can get inAccess Control22/22 resolved

AC.L2-3.1.1Authorized Access Control5 ptsDone
AC.L2-3.1.2Transaction & Function Control5 ptsDone
AC.L2-3.1.3Control CUI Flow1 ptDone
AC.L2-3.1.4Separation Of Duties1 ptDone
AC.L2-3.1.5Least Privilege3 ptsDone
AC.L2-3.1.6Non-privileged Account Use1 ptDone
AC.L2-3.1.7Privileged Functions1 ptDone
AC.L2-3.1.8Unsuccessful Logon Attempts1 ptDone
AC.L2-3.1.9Privacy & Security Notices1 ptDone
AC.L2-3.1.10Session Lock1 ptDone
AC.L2-3.1.11Session Termination1 ptDone
AC.L2-3.1.12Control Remote Access5 ptsDone
AC.L2-3.1.13Remote Access Confidentiality5 ptsDone
AC.L2-3.1.14Remote Access Routing1 ptDone
AC.L2-3.1.15Privileged Remote Access1 ptDone
AC.L2-3.1.16Wireless Access Authorization5 ptsDone
AC.L2-3.1.17Wireless Access Protection5 ptsDone
AC.L2-3.1.18Mobile Device Connection5 ptsDone
AC.L2-3.1.19Encrypt CUI On Mobile3 ptsDone
AC.L2-3.1.20External Connections1 ptDone
AC.L2-3.1.21Portable Storage Use1 ptDone
AC.L2-3.1.22Control Public Information1 ptDone

ATTraining your peopleAwareness & Training3/3 resolved

AT.L2-3.2.1Role-based Risk Awareness5 ptsOpen the finished card →Done
AT.L2-3.2.2Role-based Training5 ptsDone
AT.L2-3.2.3Insider Threat Awareness1 ptDone

AUKeeping the logsAudit & Accountability9/9 resolved

AU.L2-3.3.1System Auditing5 ptsDone
AU.L2-3.3.2User Accountability3 ptsDone
AU.L2-3.3.3Event Review1 ptDone
AU.L2-3.3.4Audit Failure Alerting1 ptDone
AU.L2-3.3.5Audit Correlation5 ptsDone
AU.L2-3.3.6Reduction & Reporting1 ptDone
AU.L2-3.3.7Authoritative Time Source1 ptDone
AU.L2-3.3.8Audit Protection1 ptDone
AU.L2-3.3.9Audit Management1 ptDone

CMControlling changeConfiguration Management9/9 resolved

CM.L2-3.4.1System Baselining5 ptsDone
CM.L2-3.4.2Security Configuration Enforcement5 ptsDone
CM.L2-3.4.3System Change Management1 ptDone
CM.L2-3.4.4Security Impact Analysis1 ptDone
CM.L2-3.4.5Access Restrictions For Change5 ptsDone
CM.L2-3.4.6Least Functionality5 ptsDone
CM.L2-3.4.7Nonessential Functionality5 ptsDone
CM.L2-3.4.8Application Execution Policy5 ptsDone
CM.L2-3.4.9User-installed Software1 ptDone

IAProving who they areIdentification & Authentication11/11 resolved

IA.L2-3.5.1Identification5 ptsDone
IA.L2-3.5.2Authentication5 ptsDone
IA.L2-3.5.3Multifactor Authentication5 ptsOpen the finished card →Done
IA.L2-3.5.4Replay-resistant Authentication1 ptDone
IA.L2-3.5.5Identifier Reuse1 ptDone
IA.L2-3.5.6Identifier Handling1 ptDone
IA.L2-3.5.7Password Complexity1 ptDone
IA.L2-3.5.8Password Reuse1 ptDone
IA.L2-3.5.9Temporary Passwords1 ptDone
IA.L2-3.5.10Cryptographically-protected Passwords5 ptsDone
IA.L2-3.5.11Obscure Feedback1 ptDone

IRWhen things go wrongIncident Response3/3 resolved

IR.L2-3.6.1Incident Handling5 ptsDone
IR.L2-3.6.2Incident Reporting5 ptsDone
IR.L2-3.6.3Incident Response Testing1 ptDone

MAFixing things safelyMaintenance6/6 resolved

MA.L2-3.7.1Perform Maintenance3 ptsDone
MA.L2-3.7.2System Maintenance Control5 ptsDone
MA.L2-3.7.3Equipment Sanitization1 ptDone
MA.L2-3.7.4Media Inspection3 ptsDone
MA.L2-3.7.5Nonlocal Maintenance5 ptsDone
MA.L2-3.7.6Maintenance Personnel1 ptDone

MPHandling media safelyMedia Protection9/9 resolved

MP.L2-3.8.1Media Protection3 ptsDone
MP.L2-3.8.2Media Access3 ptsDone
MP.L2-3.8.3Media Disposal5 ptsDone
MP.L2-3.8.4Media Markings1 ptDone
MP.L2-3.8.5Media Accountability1 ptDone
MP.L2-3.8.6Portable Storage Encryption1 ptDone
MP.L2-3.8.7Removeable Media5 ptsDone
MP.L2-3.8.8Shared Media3 ptsDone
MP.L2-3.8.9Protect Backups1 ptDone

PSTrusting your peoplePersonnel Security2/2 resolved

PS.L2-3.9.1Screen Individuals3 ptsDone
PS.L2-3.9.2Personnel Actions5 ptsDone

PEProtecting your workspacePhysical Protection6/6 resolved

PE.L2-3.10.1Limit Physical Access5 ptsDone
PE.L2-3.10.2Monitor Facility5 ptsOpen the finished card →Done
PE.L2-3.10.3Escort Visitors1 ptDone
PE.L2-3.10.4Physical Access Logs1 ptDone
PE.L2-3.10.5Manage Physical Access1 ptDone
PE.L2-3.10.6Alternative Work Sites1 ptDone

RAKnowing your weaknessesRisk Assessment3/3 resolved

RA.L2-3.11.1Risk Assessments3 ptsDone
RA.L2-3.11.2Vulnerability Scan5 ptsDone
RA.L2-3.11.3Vulnerability Remediation1 ptDone

CAChecking your own workSecurity Assessment4/4 resolved

CA.L2-3.12.1Security Control Assessment5 ptsDone
CA.L2-3.12.2Operational Plan Of Action3 ptsDone
CA.L2-3.12.3Security Control Monitoring5 ptsDone
CA.L2-3.12.4System Security PlanDone

SCProtecting your networkSystem & Communications Protection16/16 resolved

SC.L2-3.13.1Boundary Protection5 ptsDone
SC.L2-3.13.2Security Engineering5 ptsDone
SC.L2-3.13.3Role Separation1 ptDone
SC.L2-3.13.4Shared Resource Control1 ptDone
SC.L2-3.13.5Public-access System Separation5 ptsDoes not apply, from the confirmed step 3 fact “No publicly accessible system we run”: No publicly accessible system component is inside our assessment scope. Our website is hosted by a third party with no account or network shared with the system that holds our controlled information, and our cloud tenant exposes nothing to the public.Doesn't apply
SC.L2-3.13.6Network Communication By Exception5 ptsDone
SC.L2-3.13.7Split Tunneling1 ptDone
SC.L2-3.13.8Data In Transit3 ptsDone
SC.L2-3.13.9Connections Termination1 ptDone
SC.L2-3.13.10Key Management1 ptDone
SC.L2-3.13.11CUI Encryption5 ptsDone
SC.L2-3.13.12Collaborative Device Control1 ptDone
SC.L2-3.13.13Mobile Code1 ptDone
SC.L2-3.13.14Voice Over Internet Protocol1 ptDone
SC.L2-3.13.15Communications Authenticity5 ptsDone
SC.L2-3.13.16Data At Rest1 ptDone

SIKeeping systems healthySystem & Information Integrity7/7 resolved

SI.L2-3.14.1Flaw Remediation5 ptsDone
SI.L2-3.14.2Malicious Code Protection5 ptsDone
SI.L2-3.14.3Security Alerts & Advisories5 ptsDone
SI.L2-3.14.4Update Malicious Code Protection5 ptsDone
SI.L2-3.14.5System & File Scanning3 ptsDone
SI.L2-3.14.6Monitor Communications For Attacks5 ptsDone
SI.L2-3.14.7Identify Unauthorized Use3 ptsDone

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

Your team works all 110 requirements on the platform, a credentialed officer reviews every step, and the record stays true all three years. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no card Book a free advisory call

Charlie

The gov safe AI guide

Who actually assesses us for Level 2?

We use Microsoft 365 GCC High. Does Microsoft cover the requirements for us?

Partly. Microsoft's placemat marks most requirements as shared coverage for GCC High, so each one drafts as shared: Microsoft's half goes in your responsibility matrix, and your half (your laptops, your office, your people, and your tenant settings) is still yours to show. Meridian's team confirmed its half on every card.

What can go on a POA&M?

Only 1 point requirements, plus FIPS validated encryption when encryption is in place but not yet validated, and only at a score of 88 or better. Every item has to close within 180 days, and a short list can never ride a POA&M at all, the System Security Plan among them. (32 CFR 170.21)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call