CMMC Level 2, done in the open
In October 2026 Sanctir posted a NIST SP 800-171 self-assessment score of 110 out of 110 and affirmed a CMMC Level 2 (Self) status in the Department of Defense's Supplier Performance Risk System — from one Microsoft 365 tenant and two laptops, with no consultant and no managed-service provider. Everything we used is published, with our identifiers removed, so any small defense supplier can do the same.
collingeorge/cmmc-l2-reference
75 policy definitions · 17 alert rules · 23 remediations · 10 audit and administration scripts · 24 document skeletons · 8 explainers. MIT license for code, CC BY 4.0 for documents. Free; no sign-up.
DISA STIG results, 21–22 October 2026
Measured on both workstations and in the cloud tenant with DISA’s own published benchmark content, run through the evaluator in the repository. Both workstations returned identical results.
| STIG (version) | Result | Rules not passed |
|---|---|---|
| NIST SP 800-171 Rev 2 (SPRS) | 110 / 110 | Posted 12 October 2026; CMMC Level 2 (Self) affirmed |
| Windows 11 (V2R11) | 208 / 209 | 1 stricter than DISA: every elevation asks for the administrator’s CAC and PIN |
| Defender Antivirus (V2R10) | 64 / 67 | 3 stricter: attack-surface-reduction rules in Block, not Audit |
| Windows Defender Firewall (V2R3) | 17 / 20 | 3 stricter: outbound traffic blocked by default on every profile |
| Office 365 ProPlus (V3R8) | 122 / 125 | 3 stricter: files that fail validation are blocked, not opened in Protected View |
| Edge (V2R5) | 53 / 54 | 1 risk-accepted decision: sync on for the work account, passwords and payment data never synced |
| OneDrive (V2R4) | 12 / 12 | — |
| Entra ID (V1R2) + Intune MDM (V1R2) | 11 pass, 0 fail | 2 documented emergency-access exceptions, per Microsoft’s guidance |
| Defender for Endpoint (V1R2) | 21 / 25 | 4 features pending Microsoft |
| Central Log Server SRG (V3R5) | 127 reviewed | 4 gaps found and closed |
Every rule not passed is accounted for: 10 are settings stricter than DISA’s expected value, which the benchmark reads as a fail, and 1 is a recorded, risk-accepted decision. There is no open finding. These are Sanctir’s own measurements of its own system, not an assessment by DISA, a C3PAO or any third party. Method, every exception and how to reproduce it: explainer 07.
Start with the right file
START-HERE.md — for owners who are not IT specialists: what the clauses require, how the score works, how to score yourself honestly, how to post it in SPRS (both records), which keys and certificates you need, and every command.
01 — Everything is owned by the tenant — the premise. A local machine never carries an individual setting; anything set by hand is drift, and drift is reversed and recorded.
02 — Build order — the sequence to deploy in, layer by layer. Each layer assumes the one before it; out of order is how you lock yourself out of your own tenant.
03 — Why this stack — Microsoft 365 E5 component by component, Sentinel and the locked archive, Cloudflare Zero Trust, FIPS security keys, the DoD ECA certificate, DISA SCAP and STIG tools, and what it costs.
04 — Working with an AI assistant — how Claude Code sped up implementation, testing and deployment on a standard subscription; the rules that kept it safe; and the four things it got wrong.
05 — Run your own audit — the eleven reads an assessor would do, in order, and what ours found before anyone else could.
06 — Tenant set-up and enrolment — the exact commands, from an empty tenant to enrolled, compliant devices. Every script prints its plan first and changes nothing without -Apply.
07 — DISA STIG results — what was measured and how, every rule not passed and why, the Intune conflict DISA’s check caught, and why DISA’s SCC scanner is not used.
08 — CAC and security-key-only sign-in — the administrator signs in only with a CAC, the daily user only with a FIDO2 security key, and Windows Hello is gone; the order that avoids a lock-out, and the sign-in-frequency lesson.
policies/ — Intune settings catalog, compliance, Conditional Access and authentication-method definitions, each with a deploy script that reads one configuration file. docs/templates/ — System Security Plan, Plan of Action, policies, procedures, plans, standards and runbooks: the structure of documents that passed, with the contents removed and guidance in their place.
How to use it, in five steps
1. Read START-HERE, then explainer 01
START-HERE explains what the clauses require, how the score works and how to post it in SPRS. Explainer 01 sets the premise: the tenant owns every setting and a local machine carries none. If you disagree with the premise, the rest will fight you.
2. Download the repository and set your configuration
Download the toolkit as a .zip (button above) or clone it. Copy config.example.json to config.json and fill in your tenant. Every deploy script reads that one file, so nothing tenant-specific lives in the scripts.
3. Deploy in the build order
Identity first, then the endpoint baseline, then logging and alerting, then the remediations that hold it all in place. Every script shows its plan before it changes anything and needs -Apply to act. The layer-by-layer sequence is in explainer 02; the exact commands are in explainer 06.
4. Take a baseline snapshot
From then on every change is a recorded change, and the drift check proves nothing else moved. Record changes in the configuration-management register (PLN-006).
5. Audit yourself as if you wanted to fail
Run the eleven reads an assessor would do, in the order in explainer 05. Fix what it finds, record what remains in the Plan of Action (POAM-002), and only then score and post.
Template library
Twenty-four document skeletons: the structure of documents that passed, with the contents removed and guidance in their place. Each opens on GitHub; the whole set is in the .zip.
Plans & assessment
- SSP-001 System Security Plan
- POAM-002 Plan of Action and Milestones
- PLN-006 Configuration Management Plan and change register
- PLN-007 Incident Response Plan and register
- PLN-010 Endpoint Baseline Architecture
- TCP-017 Technology Control Plan for ITAR technical data
- DOC-000 Document set completion checklist
Policies & procedures
- POL-003 Access Control and Identification Policy
- POL-004 Security Awareness and Training
- POL-008 Acceptable Use of Artificial Intelligence Services
- POL-009 Personnel Security and Physical Protection Policy
- PRO-005 Audit and Accountability Procedure
- PRO-008 Maintenance and Media Protection Procedure
- PRO-010 Risk and Security Assessment Procedure
Standards
Control map
Where to start for each of the fourteen NIST SP 800-171 control families: the document that governs it and the parts of the repository that implement it. This is a starting index, not a requirement-by-requirement mapping; that mapping belongs in your System Security Plan.
| Family | Document | Implemented by |
|---|---|---|
| Access Control (AC) | POL-003 | Conditional Access policies; local accounts and groups, screen lock, LAPS and logon banner (policies/) |
| Awareness & Training (AT) | POL-004, TRN-019 | Training modules and records |
| Audit & Accountability (AU) | PRO-005 | Audit policy, event-log size, time sync, process command-line auditing; audit-tamper and stream-lag alerts (alerting/) |
| Configuration Management (CM) | PLN-006, PLN-010, STD-011, STD-023 | Security baseline; DISA packages for Defender, Edge and Microsoft 365 Apps; service-baseline and drift-consistency remediations (remediations/) |
| Identification & Authentication (IA) | POL-003 | CAC-only administrator and security-key-only user sign-in through custom authentication strengths; Windows Hello off; lockout policy |
| Incident Response (IR) | PLN-007 | High-severity incident, malware, privilege-escalation and persistence alert rules |
| Maintenance (MA) | PRO-008, GDE-012, RUN-013 | Update rings and Office updates; documented rebuild test |
| Media Protection (MP) | PRO-008 | BitLocker, removable-media encryption, Defender device control |
| Personnel Security (PS) | POL-009 | Personnel procedures; break-glass account runbook (RUN-016) |
| Physical Protection (PE) | POL-009 | Physical-protection policy |
| Risk Assessment (RA) | PRO-010, LOG-020 | Security-advisory review register; audit and evaluation scripts |
| Security Assessment (CA) | SSP-001, POAM-002, PRO-010, DOC-000 | Self-audit method (explainer 05) |
| System & Communications Protection (SC) | STM-011, STD-021, TCP-017 | Firewall, egress leak-path and credential-network policies; session controls and token protection; Cloudflare Gateway rules |
| System & Information Integrity (SI) | STD-023 | Defender antivirus, attack-surface reduction, exploit protection, signature remediation, malware alerts |
See what “done” looks like
All 110 requirements as they stood when we posted 110 of 110: how each is met, where the evidence lives, and the eight decisions we had to justify in writing.
It is not a product and it does not produce a score. A NIST SP 800-171 score is your own assessment of your own system against your own evidence; the repository gives you controls that work, tooling that produces the evidence, and the method. Misrepresenting a CMMC status to the U.S. Government is a federal offense (18 U.S.C. §1001; False Claims Act). CMMC is a registered mark of the U.S. Department of Defense; this project is not affiliated with or endorsed by DoD, the Cyber AB, or Microsoft. The dated analysis behind the "self-assessed" status is in the research library: The Deadline Went Away. The Obligations Did Not.
Discuss an engagement
If you would rather have this implemented, audited or taught than do it yourself, an initial scoping conversation is provided at no charge. Describe the situation in general terms first; use an encrypted channel for anything specific.
Controlled Information & Cybersecurity advisory · Return to Sanctir