Worked Example · NIST SP 800-171 Rev 2
What a finished assessment looks like
This is the shape of the record behind Sanctir's October 2026 score of 110 out of 110 and its CMMC Level 2 (Self) affirmation: every requirement, how it is met, where the evidence lives, and the decisions we had to justify in writing. Identifiers, account names and our private rule lists are removed. Use it to see what “done” means before you start.
Score summary
110
of 110
CMMC Level 2 (Self) · Final
- 110requirements met
- 0not met
- 0open POA&M items
- 0points deducted
The assessment record
- Standard
- NIST SP 800-171 Revision 2, 110 requirements in 14 families
- Method
- DoD Assessment Methodology v1.2.1, Basic (self) assessment
- CMMC status
- Level 2 (Self), final; no conditional items
- Scope
- One Microsoft 365 tenant and two managed Windows laptops
- Posted
- SPRS, October 2026, with SSP version and date
- Affirmation
- Annual by a senior official; full reassessment every three years
How the number is built
Every assessment starts at 110. Each requirement not fully met deducts 1, 3 or 5 points according to its weight in the DoD methodology, so the lowest possible score is −203. There is no partial credit, except for multifactor authentication (3.5.3) and FIPS-validated encryption (3.13.11).
A score of 88 or more can earn a conditional Level 2 status, with eligible 1-point items on a POA&M that must close within 180 days. Reaching final status means every one of the 110 requirements is met. The System Security Plan (3.12.4) can never go on a POA&M: without it there is no assessment.
Documented decisions
Justifications we had to write down
A requirement met in an unusual way is still met. An assessor will ask why, though, and the answer has to be in the SSP before the question is asked. These are the eight that applied to this configuration.
J1 · 3.5.7–3.5.9
Password rules in a passwordless tenant
No one signs in with a password, so the password requirements are met by removing passwords, not by managing them. The few that remain are the per-device local administrator, which is random, rotated and unique, and a one-time, expiring Temporary Access Pass at enrollment. The SSP says so in those words and points to the authentication-methods policy that proves it.
J2 · 3.1.4
Separation of duties in a very small company
When one person may hold every role, duties cannot be split between people. They are split between identities and time instead: a separate admin account, roles that must be activated with a reason and that expire, and an immutable record of every privileged action, reviewed on a schedule. The SSP names the residual risk and the compensating controls.
J3 · 3.1.16–3.1.17
No organizational wireless network
There is no company Wi-Fi to authorize or encrypt. The laptops use whatever network they are on, so the requirement is met at the device: wireless behavior set by policy, and every packet authenticated and encrypted inside a locked tunnel before it leaves.
J4 · 3.1.22, 3.13.5
Nothing public inside the boundary
The public website is a static site hosted entirely outside the boundary and never holds CUI. There is no public-facing component to put in a separate subnetwork, and a single named person approves anything posted publicly.
J5 · 3.10.x
Inherited physical protection
Physical protection of the datacenters that hold the data is inherited from the cloud providers, as shown in their own assessment reports. The SSP's responsibility matrix records which part of each physical requirement is ours (the work area, the devices and the keys) and which part is theirs.
J6 · DFARS 7012
Which cloud the CUI may live in
DFARS 252.204-7012 requires FedRAMP Moderate-equivalent security for a cloud service that stores covered defense information. The SSP records the boundary decision explicitly: the commercial tenant versus a government cloud (GCC High). The question is settled with the contracting officer before any CUI is accepted, never assumed.
J7 · 3.4.2, 3.11.2
When the official scanner cannot run
With application control enforced, DISA's SCAP Compliance Checker will not run unless its signer is allowed. The baseline was scored with an evaluator that reads DISA's own benchmark without installing anything, and the record states which tool produced which result.
J8 · 3.3.3, 3.3.5
Every alert exclusion is measured
Each exclusion in an alert rule was added after a week of measuring what the rule matched, and is recorded with that measurement. The method is published; the exclusion list itself is not, because it is a map of what we chose not to watch.
Requirement by requirement
All 110 requirements, met
For each requirement: the requirement as NIST states it, how this configuration meets it, and where the evidence lives. Document IDs refer to the template library; component names refer to folders and files in the public repository. In your own SSP, each evidence entry should name a specific policy object, file or register row.
3.1 Access Control
22 of 22 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.1.1 Met | Limit system access to authorized users, processes acting on behalf of users, and devices. | Only named Entra ID accounts can sign in. Conditional Access admits a session only from an Intune-managed, compliant device with a phishing-resistant security key; anything else is refused. | POL-003 · Conditional Access · INV-012 |
| 3.1.2 Met | Limit system access to the types of transactions and functions that authorized users are permitted to execute. | Access is granted by role-based groups. Standard users hold no local or tenant admin rights; administrative roles exist only as time-bound PIM eligibility on a separate account. | POL-003 · Entra roles · PIM |
| 3.1.3 Met | Control the flow of CUI in accordance with approved authorizations. | CUI lives only in labelled tenant locations. Sensitivity labels and DLP govern where it may be shared, and the network gateway blocks consumer storage, file-transfer and unapproved AI services. | POL-003 · Purview · STD-021 |
| 3.1.4 Met | Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | Day-to-day and administrative identities are separate accounts. Privileged roles activate through PIM with a written reason and expire; every privileged action lands in an archive no administrator can alter, and is reviewed. See justification J2. | POL-003 · PIM · PRO-005 |
| 3.1.5 Met | Employ the principle of least privilege, including for specific security functions and privileged accounts. | No standing administrator rights anywhere. Roles are eligible, scoped and time-limited; the local administrator password is unique per device and rotated by LAPS. | POL-003 · PIM · LAPS |
| 3.1.6 Met | Use non-privileged accounts or roles when accessing nonsecurity functions. | E-mail, browsing and documents are done as a standard user. The admin account has no mailbox and is used only in admin portals after PIM activation. | POL-003 |
| 3.1.7 Met | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | Standard users cannot elevate on any device. Privilege use is written to the Windows Security log and the Entra audit log, streamed to Sentinel, and alerted by the privilege-escalation rule. | Settings catalog · ref-privesc |
| 3.1.8 Met | Limit unsuccessful logon attempts. | A device account-lockout threshold is enforced by policy; Entra smart lockout protects cloud sign-in. | Password and lockout policy |
| 3.1.9 Met | Provide privacy and security notices consistent with applicable CUI rules. | A logon banner stating authorized use, monitoring and CUI handling is shown before every Windows sign-in. | Settings catalog |
| 3.1.10 Met | Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. | Devices lock after a fixed idle period to a screen that shows no content; users lock manually on leaving the device. | Settings catalog · TRN-019 |
| 3.1.11 Met | Terminate (automatically) a user session after a defined condition. | Conditional Access sign-in frequency and idle-session timeouts end cloud sessions; PIM activations expire on their own. | Conditional Access · PIM |
| 3.1.12 Met | Monitor and control remote access sessions. | All remote work runs through the managed tunnel and Entra sign-in. Both are logged centrally and reviewed with the daily alert queue. | STD-021 · Sentinel |
| 3.1.13 Met | Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | The tunnel and every cloud session are encrypted (TLS 1.2 or later). | STM-011 |
| 3.1.14 Met | Route remote access via managed access control points. | The locked tunnel and Conditional Access are the only routes to tenant data; there is no VPN concentrator, open port or remote-desktop listener. | STD-021 · Firewall policy |
| 3.1.15 Met | Authorize remote execution of privileged commands and remote access to security-relevant information. | Privileged commands run only from a compliant device on a PIM-activated admin account. Remote-control tools are blocked at the gateway; no RMM agent is installed. | POL-003 · STD-021 |
| 3.1.16 Met | Authorize wireless access prior to allowing such connections. | There is no organizational wireless network in the boundary. Device Wi-Fi behaviour is set by policy, consumer wireless features are disabled, and every network is treated as hostile. See justification J3. | Wireless policy · STD-021 |
| 3.1.17 Met | Protect wireless access using authentication and encryption. | Whatever the local Wi-Fi provides, all traffic is authenticated and encrypted inside the tunnel before it leaves the device. | STM-011 · STD-021 |
| 3.1.18 Met | Control connection of mobile devices. | Only enrolled or app-protected mobile devices reach tenant data; Conditional Access refuses everything else. | Mobile policies · Conditional Access |
| 3.1.19 Met | Encrypt CUI on mobile devices and mobile computing platforms. | BitLocker on every laptop; mobile devices must have a passcode, which enables hardware encryption, to stay compliant. | BitLocker · Compliance policy |
| 3.1.20 Met | Verify and control/limit connections to and use of external systems. | Personal and unmanaged systems cannot reach the tenant. External services are allowed by explicit gateway rule; AI services are limited to those approved in POL-008. | POL-008 · STD-021 |
| 3.1.21 Met | Limit use of portable storage devices on external systems. | Portable storage is blocked by device control and not used to carry organizational data. | PRO-008 · Device control |
| 3.1.22 Met | Control CUI posted or processed on publicly accessible systems. | The public website sits outside the boundary and never holds CUI; one named person approves anything published. See justification J4. | POL-003 · SSP-001 |
3.2 Awareness and Training
3 of 3 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.2.1 Met | Ensure that managers, systems administrators, and users are aware of the security risks associated with their activities and of the applicable policies, standards, and procedures. | Every user completes the training modules before access and every year after; completion is recorded. | POL-004 · TRN-019 |
| 3.2.2 Met | Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. | Admin eligibility is granted only after role training on the build, the runbooks and the incident process. | TRN-019 · RUN-016 |
| 3.2.3 Met | Provide security awareness training on recognizing and reporting potential indicators of insider threat. | A dedicated module covers insider-threat indicators and the reporting route. | TRN-019 |
3.3 Audit and Accountability
9 of 9 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.3.1 Met | Create and retain system audit logs and records to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. | Windows, Defender, Entra and Purview audit records flow to Sentinel; security tables are exported to storage under a locked immutability policy that no one, including the owner, can shorten. | PRO-005 · alerting/ |
| 3.3.2 Met | Ensure that the actions of individual system users can be uniquely traced to those users. | Every person has one named account; there are no shared accounts; device and cloud records carry the user identity. | POL-003 · PRO-005 |
| 3.3.3 Met | Review and update logged events. | Logged events are reviewed whenever a rule is tuned, and every tuning is recorded with the measurement behind it. | PRO-005 · PLN-006 |
| 3.3.4 Met | Alert in the event of an audit logging process failure. | Audit-tamper, stream-lag and silent-device rules notify a person when logging stops, lags or is altered. | ref-audit-tamper · ref-audit-stream-lag |
| 3.3.5 Met | Correlate audit record review, analysis, and reporting processes for investigation and response. | Sentinel correlates device, identity and cloud events; every alert is closed with its cause in the daily review. | PRO-005 · Review-AlertQueue.ps1 |
| 3.3.6 Met | Provide audit record reduction and report generation to support on-demand analysis and reporting. | Saved queries and workbooks reduce and report without altering the underlying records. | Sentinel · PRO-005 |
| 3.3.7 Met | Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. | Devices synchronize time with an authoritative source by policy; cloud services use provider time. | Settings catalog |
| 3.3.8 Met | Protect audit information and audit logging tools from unauthorized access, modification, and deletion. | Device records leave the device within minutes; the archive is immutable; workspace access is limited to one PIM role. | PRO-005 · Locked archive |
| 3.3.9 Met | Limit management of audit logging functionality to a subset of privileged users. | Only the PIM-activated security role can change logging, and any change raises an alert. | PIM · ref-audit-tamper |
3.4 Configuration Management
9 of 9 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.4.1 Met | Establish and maintain baseline configurations and inventories of organizational systems throughout the respective system development life cycles. | A snapshot of the whole tenant is the approved baseline; the asset inventory lists every device, account, service and key. | STD-023 · INV-012 |
| 3.4.2 Met | Establish and enforce security configuration settings for information technology products employed in organizational systems. | Every setting is a tenant policy; remediations detect and repair drift within minutes; the result is scored against the DISA STIG. | PLN-010 · remediations/ · Evaluate-STIG.ps1 |
| 3.4.3 Met | Track, review, approve or disapprove, and log changes to organizational systems. | Every change is entered in the dated change register with its approval; the drift check proves nothing else moved. | PLN-006 |
| 3.4.4 Met | Analyze the security impact of changes prior to implementation. | Impact is written down before a change; blocking rules run in log-only mode first and are measured before enforcement. | PLN-006 · STD-021 |
| 3.4.5 Met | Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. | Only PIM-activated admins can change configuration, and only through the tenant; a setting made by hand is drift and is reversed. | PLN-006 · PIM |
| 3.4.6 Met | Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. | The service baseline lists what must run and what must not; a remediation enforces it. | STD-011 · Service-baseline remediation |
| 3.4.7 Met | Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. | Discovery services are off, inbound ports are closed, legacy authentication and protocols are blocked. | STD-011 · Firewall policy |
| 3.4.8 Met | Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. | App Control for Business allows only approved, signed software to run (permit-by-exception). | PLN-010 · App Control |
| 3.4.9 Met | Control and monitor user-installed software. | Users cannot install software; installs come from the tenant; any new service, driver or task raises an alert. | App Control · ref-persistence |
3.5 Identification and Authentication
11 of 11 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.5.1 Met | Identify system users, processes acting on behalf of users, and devices. | Named Entra accounts, Entra-joined devices and inventoried service principals; nothing anonymous. | INV-012 · POL-003 |
| 3.5.2 Met | Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. | Every sign-in is authenticated by Entra ID and every device by its compliance state before access. | Conditional Access |
| 3.5.3 Met | Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. | FIPS 140-validated FIDO2 security keys for every account, including break-glass. No password, SMS or push path exists. | Authentication methods · RUN-016 |
| 3.5.4 Met | Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. | FIDO2 is challenge-response and origin-bound; token protection binds sessions to the device. | Authentication methods · Token protection |
| 3.5.5 Met | Prevent reuse of identifiers for a defined period. | Identifiers are never reassigned; departed accounts are retained disabled. | POL-003 |
| 3.5.6 Met | Disable identifiers after a defined period of inactivity. | Inactive accounts are disabled after the defined period; the tenant audit checks sign-in activity. | POL-003 · Tenant audit |
| 3.5.7 Met | Enforce a minimum password complexity and change of characters when new passwords are created. | No one signs in with a password. Remaining passwords (the per-device local administrator) are long, random and generated by LAPS; device policy enforces complexity. See justification J1. | Password policy · LAPS |
| 3.5.8 Met | Prohibit password reuse for a specified number of generations. | Password history is enforced by policy and LAPS generates a new unique value at each rotation. See justification J1. | Password policy · LAPS |
| 3.5.9 Met | Allow temporary password use for system logons with an immediate change to a permanent password. | First access uses a one-time, expiring Temporary Access Pass that is spent on registering the security key. See justification J1. | GDE-012 |
| 3.5.10 Met | Store and transmit only cryptographically-protected passwords. | Platform credential stores are encrypted; no secret appears in scripts or documents, enforced by a scrubber and secret scan on every commit. | LAPS · tools/scrub.ps1 |
| 3.5.11 Met | Obscure feedback of authentication information. | Windows and Entra mask every credential and PIN entry. | Platform default, verified |
3.6 Incident Response
3 of 3 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.6.1 Met | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. | PLN-007 defines roles, detection sources, response steps and recovery; Sentinel provides detection and the break-glass runbook provides recovery. | PLN-007 · RUN-016 |
| 3.6.2 Met | Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. | Incidents are kept in a register. Reportable cyber incidents go to DoD through DIBNet within 72 hours using an ECA certificate. | PLN-007 register |
| 3.6.3 Met | Test the organizational incident response capability. | The escalation path and the break-glass procedure are exercised and the results recorded. | PLN-007 · RUN-016 |
3.7 Maintenance
6 of 6 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.7.1 Met | Perform maintenance on organizational systems. | Operating system, Office and firmware updates are delivered by tenant update rings with deadlines. | PRO-008 |
| 3.7.2 Met | Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. | Maintenance is done only through Intune and the published admin scripts by the named administrator; no third-party RMM tools. | PRO-008 |
| 3.7.3 Met | Ensure equipment removed for off-site maintenance is sanitized of any CUI. | A device is wiped before it leaves for repair and rebuilt from the tenant when it returns. | PRO-008 · RUN-013 |
| 3.7.4 Met | Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. | Removable media is blocked by default; anything permitted is scanned by Defender before use. | Device control · Defender |
| 3.7.5 Met | Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. | Remote administration needs a security key and PIM activation, and ends when the activation expires. | PIM · Conditional Access |
| 3.7.6 Met | Supervise the maintenance activities of maintenance personnel without required access authorization. | Outside technicians never touch a device holding data; hardware goes to a vendor only after it has been wiped. | PRO-008 · POL-009 |
3.8 Media Protection
9 of 9 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.8.1 Met | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. | Digital CUI exists only on encrypted managed devices and in tenant storage; paper is kept locked. | PRO-008 |
| 3.8.2 Met | Limit access to CUI on system media to authorized users. | Labels and group permissions restrict CUI to named people. | Purview labels · POL-003 |
| 3.8.3 Met | Sanitize or destroy system media containing CUI before disposal or release for reuse. | Devices are wiped and storage destroyed per NIST SP 800-88 before disposal; each is recorded. | PRO-008 · INV-012 |
| 3.8.4 Met | Mark media with necessary CUI markings and distribution limitations. | Sensitivity labels apply CUI markings and distribution limitations to documents and mail. | Purview labels |
| 3.8.5 Met | Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. | Devices travel encrypted and in personal custody; no removable media carries CUI. | PRO-008 · POL-009 |
| 3.8.6 Met | Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. | Full-disk encryption on every device; any permitted removable media must itself be encrypted. | BitLocker · STM-011 |
| 3.8.7 Met | Control the use of removable media on system components. | Defender device control blocks removable storage by default. | Device control |
| 3.8.8 Met | Prohibit the use of portable storage devices when such devices have no identifiable owner. | Unknown storage devices are blocked outright. | Device control |
| 3.8.9 Met | Protect the confidentiality of backup CUI at storage locations. | Backups stay inside the tenant's encrypted storage; the audit archive is encrypted and immutable. | PRO-008 · STM-011 |
3.9 Personnel Security
2 of 2 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.9.1 Met | Screen individuals prior to authorizing access to organizational systems containing CUI. | Individuals are screened before any account is created. | POL-009 |
| 3.9.2 Met | Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. | On departure, the account is disabled, sessions revoked, keys recovered and devices wiped the same day. | POL-009 · INV-012 |
3.10 Physical Protection
6 of 6 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.10.1 Met | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. | Devices are used in a controlled work area. Physical protection of cloud datacenters is inherited from the cloud providers. See justification J5. | POL-009 · SSP-001 |
| 3.10.2 Met | Protect and monitor the physical facility and support infrastructure for organizational systems. | The work area is secured and monitored; datacenter protection is inherited. | POL-009 · SSP-001 |
| 3.10.3 Met | Escort visitors and monitor visitor activity. | Visitors are escorted and never left with an unlocked device or CUI. | POL-009 |
| 3.10.4 Met | Maintain audit logs of physical access. | Visitor access to the work area is logged; datacenter access logs are the provider's. | POL-009 |
| 3.10.5 Met | Control and manage physical access devices. | Keys and security keys are inventoried and recovered on departure. | INV-012 · POL-009 |
| 3.10.6 Met | Enforce safeguarding measures for CUI at alternate work sites. | Travel and home-working rules apply; tunnel, encryption and device controls work the same everywhere. | POL-009 · STD-021 |
3.11 Risk Assessment
3 of 3 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.11.1 Met | Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. | A risk register is reviewed at least annually and whenever the system changes significantly. | PRO-010 |
| 3.11.2 Met | Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. | Defender vulnerability management scans continuously; the STIG and NSA evaluators run on schedule. | Defender · Evaluate-STIG.ps1 |
| 3.11.3 Met | Remediate vulnerabilities in accordance with risk assessments. | Findings are fixed in order of risk; advisories read and acted on are recorded. | PRO-010 · LOG-020 |
3.12 Security Assessment
4 of 4 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.12.1 Met | Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. | The eleven-read self-audit runs before every score and at least annually. | PRO-010 · Explainer 05 |
| 3.12.2 Met | Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | Every weakness is numbered with owner and milestone; closed items keep their closure evidence. No item was open when the score was posted. | POAM-002 |
| 3.12.3 Met | Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. | Drift checks, an hourly consistency scanner and the daily alert review run continuously. | remediations/ · alerting/ |
| 3.12.4 Met | Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. | The SSP records the boundary, components, flows and, for each requirement, what is in force and where the evidence is. Its version and date are reported in SPRS. | SSP-001 |
3.13 System and Communications Protection
16 of 16 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.13.1 Met | Monitor, control, and protect communications at the external boundaries and key internal boundaries of organizational systems. | Egress passes through the gateway policy; inbound traffic is denied by the firewall on every device. | STD-021 · Firewall policy |
| 3.13.2 Met | Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. | Tenant-owned design: no local settings, one identity, one policy source, every change recorded. | PLN-010 · Explainer 01 |
| 3.13.3 Met | Separate user functionality from system management functionality. | Management happens only from the separate admin account in admin portals, never from the user session. | POL-003 |
| 3.13.4 Met | Prevent unauthorized and unintended information transfer via shared system resources. | Single-user devices, no shared accounts, virtualization-based security on. | PLN-010 |
| 3.13.5 Met | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | No publicly accessible component exists in the boundary; the public website is hosted entirely outside it. See justification J4. | SSP-001 |
| 3.13.6 Met | Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). | Inbound is denied by default; outbound runs on firewall rules and gateway policy, and each exception is recorded. | Firewall policy · STD-021 |
| 3.13.7 Met | Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). | The tunnel is locked on and carries the device's traffic; the local network is used only to reach the tunnel. | STD-021 |
| 3.13.8 Met | Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. | TLS 1.2 or later for every service, inside an encrypted tunnel. | STM-011 |
| 3.13.9 Met | Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. | Session controls and idle timeouts close connections; admin sessions end with PIM expiry. | Conditional Access · PIM |
| 3.13.10 Met | Establish and manage cryptographic keys for cryptography employed in organizational systems. | Recovery keys are escrowed in the tenant; provider-managed keys are recorded; security keys are inventoried. | STM-011 · INV-012 |
| 3.13.11 Met | Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | FIPS 140-validated modules: platform encryption in FIPS mode and FIPS-validated security keys, each with its CMVP certificate recorded. | STM-011 · CMVP certificates |
| 3.13.12 Met | Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. | Camera and microphone cannot be switched on remotely; the in-use indicator stays on. | Settings catalog |
| 3.13.13 Met | Control and monitor the use of mobile code. | App Control and attack-surface-reduction rules restrict scripts and block macros from the internet; blocks are alerted. | PLN-010 · ref-malware |
| 3.13.14 Met | Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. | Teams is the only voice service, under the same identity and device controls; other voice services are blocked. | Conditional Access · STD-021 |
| 3.13.15 Met | Protect the authenticity of communications sessions. | Certificate-validated TLS, with tokens bound to the device so a stolen session cannot be replayed elsewhere. | Token protection · STM-011 |
| 3.13.16 Met | Protect the confidentiality of CUI at rest. | Full-disk encryption on every device; service encryption at rest in the tenant. | BitLocker · STM-011 |
3.14 System and Information Integrity
7 of 7 met| ID | Requirement | How it is met | Evidence |
|---|---|---|---|
| 3.14.1 Met | Identify, report, and correct system flaws in a timely manner. | Update rings install fixes by deadline; vulnerability management tracks what remains. | PRO-008 · Defender |
| 3.14.2 Met | Provide protection from malicious code at designated locations within organizational systems. | Real-time protection, attack-surface reduction and tamper protection on every device. | Defender policies |
| 3.14.3 Met | Monitor system security alerts and advisories and take action in response. | Vendor and government advisories are read and each one acted on is recorded. | LOG-020 |
| 3.14.4 Met | Update malicious code protection mechanisms when new releases are available. | Signatures update automatically, and a remediation repairs any device that falls behind. | Signature remediation |
| 3.14.5 Met | Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. | Scheduled scans plus real-time scanning of every download and opened file. | Defender policies |
| 3.14.6 Met | Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. | Gateway logs, network protection and the Sentinel rules watch traffic in both directions. | STD-021 · alerting/ |
| 3.14.7 Met | Identify unauthorized use of organizational systems. | Logon, break-glass, privilege-escalation and identity-risk detections notify a person. | ref-logon · ref-breakglass-any-signin |
What is not on this page, and why
- Tenant, subscription and workspace identifiers; account, group and device names
- The SPRS record itself, the SSP version and date, and the CAGE-level assessment entry
- Alert exclusions, firewall allow-lists, gateway rule contents and application-control rules
- Evidence files, configuration snapshots, the change log and the incident register
Each of these either identifies the system or tells an attacker where its blind spots are. Publishing the structure helps other suppliers; publishing the contents would only help an adversary.
Before you post your own score
- Every sentence in the SSP that says “is” is true today; plans go in the POA&M
- Every requirement names its evidence, specifically enough for an assessor to open it
- The change register and the incident register have entries; a register that is never written to is a finding
- You ran the self-audit as if you wanted to fail, and fixed what it found
Questions
What score do you need for CMMC Level 2 (Self)?
Final Level 2 (Self) status requires all 110 requirements met, a score of 110. A score of at least 88 with only eligible items outstanding earns conditional status, which lasts 180 days while the POA&M is closed.
Does a perfect score mean the system is secure?
It means every requirement was assessed as met against the evidence on that day. It is only worth what the evidence is worth. That is why each row above names where the proof lives, and why the registers and the alert review have to keep running after the score is posted.
Can I copy these statements into my SSP?
Use them as a pattern, not as text. Each statement describes this configuration; yours has to describe your system, in your words, pointing to your evidence. A statement that does not match the system is worse than a gap.
Read this
This page shows the structure of one company's assessment record, not a determination about yours. Implementation statements are condensed, and physical and personnel statements are written generically. A NIST SP 800-171 score is your own assessment of your own system against your own evidence. Misrepresenting a CMMC status to the U.S. Government is a federal offense (18 U.S.C. §1001; False Claims Act). CMMC is a registered mark of the U.S. Department of Defense; Sanctir is not affiliated with or endorsed by DoD, the Cyber AB, or Microsoft.
Next step
Build it yourself, or have it built
The policies, scripts, alert rules and document skeletons behind this record are free in the reference repository. To have it implemented, audited or taught instead, an initial scoping conversation is provided at no charge.
Controlled Information & Cybersecurity advisory · Contact · Return to Sanctir