Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Level 2 · Team and senior official
Compliance stops being one person's problem.
Meridian Defense Systems, Inc. invited the people who actually do the work. Each seat sees only what its role needs, and only the designated senior official can sign the affirmation.
Current senior official
Elena R. Marsh
Chief Executive Officer
Personally responsible under 32 CFR 170.22 for the CMMC Level 2 affirmation posted in SPRS from this workspace.
What Level 2 asks of the signer today: Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
Who does what
Elena R. Marsh
OwnerChief Executive Officer
Designated senior official, signs the affirmation
Marcus Hale
ManagerDirector of Engineering
Runs the whole journey: company setup, scope, the assessment, deliverables, and the controls.
Jordan Pike
Controls workerNorthstar Managed IT technician
Works the security requirements and evidence only (step 5, the Self Assessment). Sees nothing else.
Outside reviewer
Auditor (read only)The prime's supplier quality reviewer
Read only: controls, evidence, policies, and deliverables. Cannot change or delete anything.
Read only, no Charlie, no remediation hints.
Workspace roles: who sees what
Manager
Runs the whole journey: company setup, scope, the assessment, deliverables, and the controls.
Signing Official
Reviews everything and signs the affirmation. Cannot edit the work.
Controls worker
Works the security requirements and evidence only (step 5, the Self Assessment). Sees nothing else.
Auditor (read only)
Read only: controls, evidence, policies, and deliverables. Cannot change or delete anything.
The workspace owner sets every role, or pre assigns one by email so it applies the moment the person joins. Only the designated senior official can sign the SPRS affirmation, and every designation change is written to the security audit log.
A pro checks it
A credentialed officer reviews every step from outside these seats. The officer advises and never signs; the answers and the affirmation stay your team's.
Bring your team
Your team does it. A pro checks it. It stays true.
Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.