CMMC Level 1 FastTrack · Steps 03–04
Device check and documents: the proof behind your affirmation
Jackie Poole NSO runs the device check and produces the paperwork. Together they become the evidence file your company officer relies on when affirming in SPRS.
Step 03
Device check
A signed script runs on each in-scope computer and records the result. Failed items come with fix-it instructions.
Disk encryption
BitLocker or FileVault is turned on for the whole drive.
Screen lock
The screen locks after 15 minutes or less of inactivity.
Antivirus
Malware protection is running with current definitions.
Patches
Operating system and browser updates are current.
Non-admin daily account
Everyday work happens in a standard account, not an administrator.
Step 04
Documents
Generated from your intake answers and device results, and mapped to all 15 Level 1 practices.
System Security Plan
Describes your Level 1 scope, who has access, and how each of the 15 practices is met.
Acceptable Use Policy
The rules employees sign for using company devices and accounts.
Media Sanitization Protocol
How drives, USB sticks and paper with contract information are wiped or destroyed.
Keep the device report and documents on file for at least as long as your affirmation is current. Only an authorized officer of your company can submit the SPRS affirmation.