Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Step 5 of 5 · Self assessment

If you filed today: 110 of 110, the Final Level 2 (Self) path; every requirement MET or not applicable, no plan of action needed.

23 of 110 · AT.L2-3.2.1

123

Role-based Risk Awareness

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

Proven, evidence on file5 pts

This control is ready

The policy names the risks and the rules; the training record shows all 11 people on the People roster completed security awareness training. One interview adds what a program engineer would actually do.

Charlie drafts, your team confirms

Charlie, the gov safe AI guide, drafted this requirement's section of the System Security Plan from the records below and cited the guide. Marcus Hale, Manager, read it and made every finding. Charlie never marks anything MET.

4 questions, each with its method on the record

[a]
security risks associated with organizational activities involving CUI are identified
MET
- ExaminedMarcus Hale, Manager · March 6, 2026
  From your Policy Center
  Security Awareness & Training Policy, adopted
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-06): Examined Security Awareness & Training Policy, adopted (captured 2026-02-02): names the risks of working with CUI here: phishing, sharing a drawing outside the enclave, and opening CUI on a device the company does not manage (Marcus Hale, Manager, 2026-03-06).
[b]
policies, standards, and procedures related to the security of the system are identified
MET
- ExaminedMarcus Hale, Manager · March 6, 2026
  From your Policy Center
  Security Awareness & Training Policy, adopted
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-06): Examined Security Awareness & Training Policy, adopted (captured 2026-02-02): lists by name the policies and procedures managers, system administrators and users must follow (Marcus Hale, Manager, 2026-03-06).
[c]
managers, systems administrators, and users of the system are made aware of the security risks associated with their activities
MET
- ExaminedMarcus Hale, Manager · March 6, 2026
  The training record
  Training records
- InterviewedMarcus Hale, Manager · March 6, 2026
  Asked in person, answer recorded
  Ava Chen, Program engineer
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-06): Examined Training records (captured 2026-02-27): 11 of 11 people on the People roster, managers, system administrators and users, completed security awareness training (Marcus Hale, Manager, 2026-03-06). Interviewed Ava Chen, Program engineer on 2026-03-06 (Marcus Hale, Manager): asked "A prime's drawing lands in your personal email. What do you do?", answered "Leave it closed, tell Marcus, and ask the prime to send it again through the portal.".
[d]
managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system
MET
- ExaminedMarcus Hale, Manager · March 6, 2026
  The training record
  Training records
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-06): Examined Training records (captured 2026-02-27): each completion includes the module on the policies and procedures for that person's role (Marcus Hale, Manager, 2026-03-06).

CMMC Assessment Guide Level 2, v2.13, AT.L2-3.2.1

A credentialed officer reviews every step before the senior official signs, and the officer never signs. The findings, the records and the signature stay Meridian's own.

IA.L2-3.5.3 Multifactor Authentication →PE.L2-3.10.2 Monitor Facility →The sessions →The score →

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

Your team works all 110 requirements on the platform, a credentialed officer reviews every step, and the record stays true all three years. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no card Book a free advisory call

Charlie

The gov safe AI guide

Who actually assesses us for Level 2?

We use Microsoft 365 GCC High. Does Microsoft cover the requirements for us?

Partly. Microsoft's placemat marks most requirements as shared coverage for GCC High, so each one drafts as shared: Microsoft's half goes in your responsibility matrix, and your half (your laptops, your office, your people, and your tenant settings) is still yours to show. Meridian's team confirmed its half on every card.

What can go on a POA&M?

Only 1 point requirements, plus FIPS validated encryption when encryption is in place but not yet validated, and only at a score of 88 or better. Every item has to close within 180 days, and a short list can never ride a POA&M at all, the System Security Plan among them. (32 CFR 170.21)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call