Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Step 5 of 5 · Self assessment

If you filed today: 110 of 110, the Final Level 2 (Self) path; every requirement MET or not applicable, no plan of action needed.

46 of 110 · IA.L2-3.5.3

1234567891011

Multifactor Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

Proven, evidence on file5 ptsPartial credit possible, see your score

This control is ready

Three of the four letters rest on what Microsoft 365 GCC High already showed, confirmed one by one in Marcus Hale's name. The fourth, local sign in, has no pull, so the IT company ran the test.

Charlie drafts, your team confirms

Charlie, the gov safe AI guide, drafted this requirement's section of the System Security Plan from the records below and cited the guide. Marcus Hale, Manager, read it and made every finding. Charlie never marks anything MET.

4 questions, each with its method on the record

[a]
privileged accounts are identified
MET
- ExaminedMarcus Hale, Manager · March 3, 2026
  Pulled read only from Microsoft 365 GCC High
  Multi factor authentication (MFA) registration report · Privileged role assignments
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-04): Examined Multi factor authentication (MFA) registration report and Privileged role assignments (captured 2026-03-02): every account holding an administrator role in the tenant, each one named, each registered for a second factor (Marcus Hale, Manager, 2026-03-03).
[b]
multifactor authentication is implemented for local access to privileged accounts
MET
- TestedJordan Pike, Controls worker · March 4, 2026
  A test the IT company ran, with its screenshot on file
  Local administrator sign in on an engineering workstation
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-04): Tested "Sign in at an engineering workstation with a privileged account" on 2026-03-04 (Jordan Pike, Controls worker): expected "a second factor is required before the session opens", observed "the workstation asked for the enrolled device and its PIN before the administrator session opened", as expected, proof the local sign in screenshot.
[c]
multifactor authentication is implemented for network access to privileged accounts
MET
- ExaminedMarcus Hale, Manager · March 3, 2026
  Pulled read only from Microsoft 365 GCC High
  Multi factor authentication (MFA) registration report · Access and session policies · Sign in activity
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-04): Examined Multi factor authentication (MFA) registration report and Access and session policies and Sign in activity (captured 2026-03-02): an enabled policy requires a second factor for every administrator role at every network sign in, and the sign in log shows it applied (Marcus Hale, Manager, 2026-03-03).
[d]
multifactor authentication is implemented for network access to non-privileged accounts
MET
- ExaminedMarcus Hale, Manager · March 3, 2026
  Pulled read only from Microsoft 365 GCC High
  Multi factor authentication (MFA) registration report · Access and session policies · Sign in activity
The line in the System Security Plan
MET (finding by Marcus Hale, Manager, 2026-03-04): Examined Multi factor authentication (MFA) registration report and Access and session policies and Sign in activity (captured 2026-03-02): an enabled policy requires a second factor for every user at every network sign in, and every enabled user is registered (Marcus Hale, Manager, 2026-03-03).

CMMC Assessment Guide Level 2, v2.13, IA.L2-3.5.3

A credentialed officer reviews every step before the senior official signs, and the officer never signs. The findings, the records and the signature stay Meridian's own.

PE.L2-3.10.2 Monitor Facility →AT.L2-3.2.1 Role-based Risk Awareness →The sessions →The score →

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

Your team works all 110 requirements on the platform, a credentialed officer reviews every step, and the record stays true all three years. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no card Book a free advisory call

Charlie

The gov safe AI guide

Who actually assesses us for Level 2?

We use Microsoft 365 GCC High. Does Microsoft cover the requirements for us?

Partly. Microsoft's placemat marks most requirements as shared coverage for GCC High, so each one drafts as shared: Microsoft's half goes in your responsibility matrix, and your half (your laptops, your office, your people, and your tenant settings) is still yours to show. Meridian's team confirmed its half on every card.

What can go on a POA&M?

Only 1 point requirements, plus FIPS validated encryption when encryption is in place but not yet validated, and only at a score of 88 or better. Every item has to close within 180 days, and a short list can never ride a POA&M at all, the System Security Plan among them. (32 CFR 170.21)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call