Example, read only. A sample account that shows what finished CMMC looks like.
Safeguard 2 of 15 · AC.L1-b.1.ii
AC.L1-3.1.2 · FAR 52.204-21 (b)(1)(ii) · NIST SP 800-171 3.1.2
Transaction & Function Control
Limit information system access to the types of transactions and functions that authorized users are permitted to execute
What it means
Even authorized users shouldn't have more access than their job requires, a bookkeeper shouldn't be able to change IT settings.
Why it matters
Admin sprawl is the most common finding. If a bookkeeper or intern is a Global Admin or has root, expect questions. Least-privilege role assignment, documented, is what primes want to see.
How to do it, Microsoft 365
- 1Go to admin.microsoft.com → Users → Active users
- 2Filter by Roles = any admin role (Global Admin, Billing Admin, User Admin, etc.)
- 3Screenshot the filtered list showing every admin-level account
- 4Separately, screenshot a regular (non-admin) user's role page to show baseline
Capture: Two screenshots: (1) admin role assignments, (2) a standard user showing no elevated roles.
The narrative on file
Access follows least privilege. Estimators can open and edit quotes and drawings; the office admin can read but not change them; only the owner holds admin rights in Microsoft 365. Roles are documented in the access list kept in SharePoint and reviewed each quarter.
You answer in plain English; Charlie writes the official narrative for your System Security Plan.
What makes it pass
- Every user with admin/elevated privileges is visible by name
- The role assigned to each admin is visible (Global Admin, Super Admin, root, etc.)
- At least one screenshot of a standard user showing they have NO admin role
- For the role matrix: every system covered, business justification per row, owner signature
Assessment objectives, NIST SP 800-171A
This is one of 15
Answer in plain English, drop the proof, confirm it MET.
Cedar Ridge Machine Works, LLC walked all 15 the same way. The platform explains each one in plain English, tells you exactly what to grab, checks it, and writes the paperwork, and you confirm each one MET. The self assessment stays your act. Start free, or book a call.