Level 4 MSSP · CMMC readiness support
CMMC Level 1: Safeguards, Controls & Responsibilities
Protect Federal Contract Information with a clear division of work: managed technical safeguards from Level 4, customer-owned business processes, and evidence that reflects how your environment actually operates.
A practical foundation for protecting FCI
We help translate the FAR safeguards into a working technical plan for your covered environment. The Converge foundation provides security tools and reporting; your team supplies approvals, business processes, physical safeguards, and operational follow-through.
Silver is a starting service platform, not a declaration of Level 1 readiness. Gold adds MDR across supported enrolled endpoints. Choose the required coverage after reviewing your systems and the work your internal team performs. Compare all three tiers and their scope.
Requirement-by-requirement
The 15 FAR safeguards
This is a capability and responsibility map, not a customer assessment. No requirement is rated MET. Evidence examples describe what may support a review; they do not mean that records already exist or that a tool alone satisfies the requirement.
Level 1 concerns Federal Contract Information (FCI). The physical-access safeguard at paragraph (ix) includes visitor escorts, access records, and access-device management. The 15 FAR clauses are sometimes presented as 17 assessment practices. This guide keeps the FAR clause structure.
(b)(1)(i) — Authorized users, processes, and devices
Delivery and responsibility: Shared: verified onboarding lists and tool access; customer controls native accounts and approvals
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.1.1. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Approved onboarding list; account/device inventory; access tickets.
(b)(1)(ii) — Authorized functions and transactions
Delivery and responsibility: Shared: privileged-access controls plus customer role/permission decisions
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.1.2. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Role matrix; permissions export; elevation records.
(b)(1)(iii) — External system connections and use
Delivery and responsibility: Customer enforcement; Level 4 reviews and acts where UTM/infrastructure is scoped
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.1.20. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Approved external systems; connection rules; review record.
(b)(1)(iv) — Publicly accessible information
Delivery and responsibility: Customer content approval and public-disclosure controls
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.1.22. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Public-content approval; review/removal records.
(b)(1)(v) — Identify users, processes, and devices
Delivery and responsibility: Shared: inventories, named users, device identity, and account reconciliation
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.5.1. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Identity/device register; service-account list.
(b)(1)(vi) — Authenticate before access
Delivery and responsibility: Shared: authentication configured on applicable systems; MFA offering does not replace native access validation
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.5.2. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Authentication configuration; successful/failed tests.
(b)(1)(vii) — Sanitize or destroy FCI media
Delivery and responsibility: Customer or separately contracted Level 4 sanitization/destruction work
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.8.3. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Method; serial/asset record; destruction or wipe verification.
(b)(1)(viii) — Restrict physical access
Delivery and responsibility: Customer/consultant; documentation help can be scoped
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.10.1. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Authorized access list; locks/badges; inspection.
(b)(1)(ix) — Escort visitors, record access, manage access devices
Delivery and responsibility: Customer/consultant; three distinct activities must be evidenced
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.10.3, 3.10.4, 3.10.5. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Visitor procedure; sign-in; escort record; Badge/visitor logs; retention policy; Key/badge inventory; issuance/revocation.
(b)(1)(x) — Protect external and key internal communications boundaries
Delivery and responsibility: Customer or managed UTM engagement; monitoring alone is not enforcement
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.13.1. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Diagram; firewall rules; flow/security logs; rule test.
(b)(1)(xi) — Separate publicly accessible components
Delivery and responsibility: Customer or scoped infrastructure/UTM implementation
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.13.5. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Public-component inventory; network diagram; isolation test.
(b)(1)(xii) — Identify, report, and correct flaws promptly
Delivery and responsibility: Base patch tooling/reporting; customer acts on failures and unsupported systems unless separately engaged
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.14.1. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Machine-level patch failure reports; failure tickets; remediation and exceptions.
(b)(1)(xiii) — Malicious-code protection
Delivery and responsibility: Base endpoint/email protection on supported scoped assets; validate all required locations
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.14.2. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Deployment inventory; policies; safe protection test.
(b)(1)(xiv) — Update malicious-code protection
Delivery and responsibility: Base security-tool management; verify update/health evidence
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.14.4. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Engine/content/version reports; update/health alerts.
(b)(1)(xv) — Periodic and real-time malware scanning
Delivery and responsibility: Base endpoint protection; verify configured malware scans and external-source coverage; not the annual vulnerability scan
Related technical mechanisms: NIST SP 800-171 Rev. 2 3.14.5. This cross-reference does not add CUI-specific Level 2 obligations to Level 1.
Evidence to discuss: Configured scan policies; history; real-time protection test.
Who does what?
Converge is co-managed security. Your internal IT and compliance teams remain central to the program. MSSP One or a separate infrastructure engagement can shift additional operational work to Level 4.
Level 4 manages the contracted security tools
We reconcile supplied user and asset lists, configure supported tools and reporting, manage security-tool changes with cybersecurity-team approval, and track findings from contracted vulnerability scans and penetration tests.
Supported threat containment follows an agreed escalation and approval path. If the customer cannot be reached, approval escalates to Level 4's cybersecurity team under the agreed response authority.
The customer owns the broader environment
Your team approves access and policies, identifies FCI/CUI and the assessment boundary, supplies asset changes, performs native AD/Microsoft 365 account actions, and normally owns infrastructure remediation, recovery, physical safeguards, and personnel processes.
Offboarding requires an authorized ticket. Level 4 disables access in its covered tools; internal IT handles native accounts and other systems unless that work is contracted.
Standard hardening policies and Microsoft security-baseline engineering are available within the agreed implementation scope. Under Converge, internal IT normally applies infrastructure changes unless Level 4 is specifically engaged. Firewall-rule review and network visibility do not include unlimited firewall administration.
We support Microsoft-native multifactor authentication where applicable and alternative methods to suit customer systems and scope. Each required access path needs configuration and validation; MFA on a management platform alone does not prove MFA on every underlying system.
Evidence that supports your team
Reports are the starting point—not the whole audit file
During onboarding, we configure supported report types, schedules, and delivery to your designated compliance mailbox within the purchased scope. Your team can collect available exports directly where supported, organize reports, and retain the evidence it needs. We can assist with collection and audit preparation through our ticketing system when engaged.
Included technical reporting
- Supported security-tool, training, and patch reports, including failed patches and affected machines.
- Security-tool change records and approvals; scan and remediation records for contracted testing.
- Central security logs retained for 90 days by default. Exports and extended retention are available by scope.
- Collection-health alerts for expected sources that stop reporting; supported Windows log archiving can be configured.
Customer-specific evidence support
- Templates can help develop the customer's security program, policies, and system security plan. Templates are tailored during an engagement, not published for download here.
- Documentation and evidence assistance is separately billed for Silver and Gold; eligible Platinum assistance draws from the annual advisory pool.
- A custom audit evidence repository is available as a separate, additional-fee engagement for technical and customer-provided evidence.
Evidence location, access, retention, review frequency, and responsibility are agreed for the environment. Reports and repositories must be evaluated for the sensitivity of the information they contain before use. Do not send CUI, credentials, or sensitive configurations through a public contact form.
Framework references
Requirement summaries are plain-language paraphrases. Use the official texts and applicable assessment objectives for a customer assessment. Framework references reviewed October 14, 2026.
- FAR 52.204-21 — basic safeguards for FCI
- 32 CFR 170.14 — CMMC model and incorporated standards
- 32 CFR 170.19 — assessment scope
- NIST SP 800-171 Revision 2 — Level 2 requirements
- NIST SP 800-171A, June 2018 — assessment procedures
NIST has published Revision 3; this CMMC Level 2 map uses Revision 2 because that is the version incorporated by the CMMC rule reviewed above.
Connect the controls to your operating plan
We can work alongside your internal team and compliance consultant to document the boundary, allocate responsibilities, and identify the services and evidence your environment needs.
- MSSP Converge — co-managed security
- Compliance consulting and evidence support
- Plans, scope, and agreement guide