Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.

Step 2 of 5 · Federal systems

Prepare the identifiers and access used to file.

This example keeps the government business identifiers, CAGE assessment scope and filing access together. Government accounts are activated through the government systems.

Unique Entity ID

MD8QK4R2XP71

Primary CAGE code

7ML52

CAGE codes in the assessment scope

7ML52

Filing access

Example: the authorized official has verified PIEE and SPRS access for the listed CAGE scope.

Next, identify the controlled information before placing the people, technology, facilities and providers.Next: Scope your assessmentOpen →

Charlie

The gov safe AI guide

Who actually assesses us for Level 2?

Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.

We use Microsoft 365 GCC High. Does Microsoft cover the requirements for us?

Partly. Microsoft's placemat marks most requirements as shared coverage for GCC High, so each one drafts as shared: Microsoft's half goes in your responsibility matrix, and your half (your laptops, your office, your people, and your tenant settings) is still yours to show. Meridian's team confirmed its half on every card.

What can go on a POA&M?

Only 1 point requirements, plus FIPS validated encryption when encryption is in place but not yet validated, and only at a score of 88 or better. Every item has to close within 180 days, and a short list can never ride a POA&M at all, the System Security Plan among them. (32 CFR 170.21)

This is a preview. In the real platform Charlie answers in plain English, cites the rule, and drafts with your team on every screen. Charlie never marks anything MET.

Start free to chat Book a free advisory call