Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Step 5 of 5 · The score

Your honest number

This is the score an assessor would compute from Meridian Defense Systems, Inc.'s own findings. It was not always 110: the self assessment recorded 106, 4 gaps rode a plan of action, and the team closed every one inside the 180 day window.

110 / 110

109 done · 0 still open · 1 don't apply

110 of 110. Final Level 2 path: no POA&M needed.

If you filed today: 110 of 110, the Final Level 2 (Self) path; every requirement MET or not applicable, no plan of action needed.

How it got here

Recorded Conditional at 106 on March 11, 2026; every item closed and posted July 22, 2026.

On the day of recording the findings read 105 done, 4 still open, 1 don't apply. A score of 106 meets the 88 minimum and every gap was POA&M eligible, so the Conditional path opened, with every item due to close by September 7, 2026 (32 CFR 170.21). The closeout self assessment recorded 110, which is Final Level 2 (Self). The three year clock still runs from the Conditional date.

The plan of action, closed out (4)

Each item carried a plan and a target date inside the 180 day window. None of them was one of the 6 requirements that can never ride a POA&M.

AC.L2-3.1.3 Control CUI Flow

1 ptClosed

A data loss prevention rule that blocks external sharing of files labeled CUI in the GCC High tenant.

Target date: June 30, 2026
Closed on: June 18, 2026

AT.L2-3.2.3 Insider Threat Awareness

1 ptClosed

Insider threat awareness added to the annual training, completed by everyone on the People roster.

Target date: May 29, 2026
Closed on: May 6, 2026

AU.L2-3.3.3 Event Review

1 ptClosed

A monthly audit log review, with the first two reviews recorded and dated.

Target date: July 31, 2026
Closed on: July 8, 2026

CM.L2-3.4.3 System Change Management

1 ptClosed

A change log register, with every change to the enclave approved before release.

Target date: June 15, 2026
Closed on: June 2, 2026

Next is attest and file: the readiness checks, the affirmation by Elena R. Marsh, and the SPRS record.

See the readiness and the record →How the team gathered the proof →

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

Your team works all 110 requirements on the platform, a credentialed officer reviews every step, and the record stays true all three years. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no card Book a free advisory call

Charlie

The gov safe AI guide

Who actually assesses us for Level 2?

We use Microsoft 365 GCC High. Does Microsoft cover the requirements for us?

Partly. Microsoft's placemat marks most requirements as shared coverage for GCC High, so each one drafts as shared: Microsoft's half goes in your responsibility matrix, and your half (your laptops, your office, your people, and your tenant settings) is still yours to show. Meridian's team confirmed its half on every card.

What can go on a POA&M?

Only 1 point requirements, plus FIPS validated encryption when encryption is in place but not yet validated, and only at a score of 88 or better. Every item has to close within 180 days, and a short list can never ride a POA&M at all, the System Security Plan among them. (32 CFR 170.21)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call