CMMC Field Companion Prototype

▤

128 Practices Reviewed

128 / 171 (75%)

▧

247 Evidence Linked

247 / 342 (72%)

18 Open Questions

18 active (40%)

◈

7 Lead Review Needed

7 queued (20%)

Domain Progress

Overall Progress 75%

AAccess Control (AC)

24 / 30

80%

AAudit & Accountability (AU)

20 / 27

74%

CConfiguration Management (CM)

18 / 26

69%

IIdentification & Authentication (IA)

22 / 30

73%

IIncident Response (IR)

14 / 20

70%

AC.L2-3.1.1

Limit system access to authorized users, processes acting on behalf of authorized users, and devices.

♡ ‹ ›

Assessment Objectives

Authorized users are uniquely identified. System access is limited to authorized users. Processes acting on behalf of users are identified and limited. Devices are authorized before access is granted.

Evidence Linked 3

Entra ID User Export.csvCSV · 45 KB
June 27, 2026

Access Control Policy.pdfPDF · 312 KB
June 26, 2026

VPN Authorized Users Screenshot.pngPNG · 1.2 MB
June 26, 2026

View all Evidence →

Interview Notes

👤 Jane Smith, IT ManagerJune 27, 2026 10:15 AM

Users are provisioned through Entra ID.
Access is role-based using security groups.
Service accounts are documented and reviewed quarterly.
VPN access is limited to approved devices with MFA.

Assessment Call

Rationale