Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Custodia shield
Start free for 30 days, no card
← All 110 requirements

Step 5 of 5 · The sessions

7 sessions, each with the person who can answer

A snapshot from the weeks Meridian Defense Systems, Inc.'s team did the work. Every open question sat in exactly one session, by the shortest honest way to show it, grouped by who can answer rather than by requirement number. Today every session is empty; this is what each one held and how it closed.

0open objectives across the sessions
320already MET or not applicable

If you filed today: 110 of 110, the Final Level 2 (Self) path; every requirement MET or not applicable, no plan of action needed.

Import first, then ask

Your provider showed 74 letters on 45 requirements: 74 confirmed on the record, 0 waiting for your confirmation.

What the provider already showed came first, so the team was only asked for what no pull could show.

  1. 1

    Your provider

    Done

    You, with what Microsoft 365 or Google Workspace already pulled

    Confirm what the pull proved, letter by letter, in your name; fix what a pull withheld and pull again.

    74 letters pulled read only from Microsoft 365 GCC High, 74 confirmed one click at a time, each in the name of the person who confirmed it. Nothing was withheld. See one card · The connection

  2. 2

    With your IT company

    Done

    Whoever holds admin on your systems

    One named screenshot per tool, the tests that need an admin, and the IT company's own row on the scope board.

    Sent by secure link, captures returned. Each one was accepted by the team before it counted.

    • Firewall rule set · lands SC.L2-3.13.1, SC.L2-3.13.6, AC.L2-3.1.14
    • Remote maintenance tool settings · lands MA.L2-3.7.5, MA.L2-3.7.2
    • Backup protection settings · lands MP.L2-3.8.9
    • Encryption and key management · lands SC.L2-3.13.11, SC.L2-3.13.10, MP.L2-3.8.6
    • System use notice · lands AC.L2-3.1.9
  3. 3

    Walk your office

    Done

    Anyone with a phone in the building

    The named photographs, paired with the register or record that completes each letter.

    The walk: 8 photographs

    Each photograph is read as its kind and lands every letter that kind covers. Closes on photographs alone: MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.4, PE.L2-3.10.2, PE.L2-3.10.4. Needs the record too: CM.L2-3.4.5 [a, b, c, e, f, g, h]; MP.L2-3.8.5 [b]; PE.L2-3.10.1 [a]; PE.L2-3.10.3 [a].

    1. 1. The entrance lock or badge reader Filed as Physical control photos; lands PE.L2-3.10.1 [b, d], PE.L2-3.10.2 [a]. Paired with the key and badge register.
    2. 2. The network or server closet lock Filed as Physical control photos; lands PE.L2-3.10.1 [c], PE.L2-3.10.2 [b], CM.L2-3.4.5 [d]. Paired with the key and badge register.
    3. 3. The key or badge cabinet Filed as Physical control photos; lands PE.L2-3.10.1 [b]. Paired with the key and badge register.
    4. 4. The visitor sign in point Filed as Visitor log; lands PE.L2-3.10.3 [b], PE.L2-3.10.4 [a]. Paired with the visitor log.
    5. 5. The locked media cabinet Filed as Physical control photos; lands MP.L2-3.8.1 [a, b, c, d], MP.L2-3.8.2 [a], MP.L2-3.8.5 [a]. Paired with the media transport log.
    6. 6. A marked piece of media Filed as Marked media photographs; lands MP.L2-3.8.4 [a, b]. The photograph is the whole proof: the marking and the limitation on your own media.
    7. 7. The monitored entrance or alarm panel Filed as Physical control photos; lands PE.L2-3.10.2 [c, d]. The photograph is the whole proof of monitoring; the alarm or camera service, if a company runs it, sits on your scope board as a provider.
    8. 8. The workstation area Filed as Physical control photos; lands PE.L2-3.10.1 [d], CM.L2-3.4.5 [d]. The photograph shows the operating environment is behind the lock; the clean desk and screen lock rules are yours to state in the policy.

    See a requirement that closed on the walk

  4. 4

    Your people

    Done

    Whoever runs hiring, departures and training

    Screening, separation, training and signatures, recorded once and credited everywhere they count.

    11 people on the People roster; 11 of them completed the awareness course, each at or above the pass mark. See the card · The training record

  5. 5

    Your documents and records

    Done

    The signing seat, and whoever keeps the registers

    Approve the policies, the plans and the System Security Plan; file the registers the platform keeps for you.

    All 14 policies approved, the registers decided, and the System Security Plan read and approved before the self assessment was recorded on March 11, 2026. The policies

  6. 6

    Try it

    Done

    Whoever holds admin on that system

    Run the test, record what happened, and let the record carry the letter.

    • IR.L2-3.6.3 Incident Response Testing: Ran the incident response tabletop and recorded what happened.
  7. 7

    Read before you affirm

    Done

    The affirming official

    Read every finding as it will be filed, then affirm it (the closing act).

    All 320 findings read as they would be filed, then affirmed by Elena R. Marsh, Chief Executive Officer. See the readiness and the record

110 requirements, 320 objectives. A capture uploaded on any requirement page is read by Charlie, tagged onto every objective it covers and given a freshness clock; a pull from the provider lands the same way. A person on the team makes every finding, under their own name, and a credentialed officer reviews every step.

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

Your team works all 110 requirements on the platform, a credentialed officer reviews every step, and the record stays true all three years. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.

Start free for 30 days, no cardBook a free advisory call