Skip to content
CMMC Guidance

Specimen. Northfield Precision Works is a fictional 80-person machining supplier and does not exist. Every figure below is illustrative, and nothing here is a client’s data or a promised outcome.

Back to Continuous Guidance

Coverage report

Northfield Precision Works

Period
March 2026
Context
Month 14 of continuous guidance

SPRS score

110 / 110

+10 this period

The score returned to 110 after the two requirements below went unmet last period, together worth 10 points. Both were caught in monitoring, remediated, and the entry reconciled in SPRS before anyone was asked to sign anything.

Held since
month 10, at submission
Next affirmation
July 2026 · in 4 months

Drift caught in monitoring

2 events

Neither of these generated a notification from the systems that caused them. Both are the failure this site’s reference section names as the common way to lose points in that family.

  • IA3.5.3 · 5 points2026-02-14 → 2026-02-17 · 3 days open

    An MFA exception was added for a vendor integration, taking privileged remote access out of scope for enforcement.

  • SI3.14.1 · 5 points2026-02-21 → 2026-03-02 · 9 days open

    Three endpoints stopped reporting to patch management after a broken agent upgrade, so flaw remediation could no longer be evidenced for them.

Everything else running

Evidence refresh41 of 41 current
Oldest artifact is 26 days old. Nothing has aged past its refresh interval this period.
Vulnerability management2 of 2 remediated
Both findings triaged to the requirement they touch and closed inside the window their severity sets.
POA&M0 open
Two items closed this period. Nothing carried forward, so the plan is current as written.
Incident responseNo reportable events
The DFARS 252.204-7012 72-hour playbook was exercised on 2026-03-11. Reporting path verified end to end.
Reassessment readinessPackage current
SSP, POA&M and scoring worksheet reflect the environment as it ran on the last day of the period.

Prepared by The CMMCg Method, stage 04. No engineer is named on a specimen. On a real engagement this is signed by the engineer who did the work, and it is the same person who answers the phone afterward.

The point of the report is that nobody had to go looking.

A supplier without this finds the same two problems at their next assessment, eleven months later, with the score already submitted and a senior official’s name on it.

Talk to an engineer