Level 4 MSSP · CMMC readiness support
CMMC Level 2: Technical Controls & Evidence Support
Bring security operations, vulnerability management, and audit-support evidence together around your Controlled Unclassified Information environment. Start with Converge Platinum, then scope the remaining work with your IT and compliance teams.
Converge Platinum: our recommended Level 2 starting point
Platinum combines the Gold security foundation with continuous agent-based vulnerability visibility, quarterly internal/external scanning and review or an agreed customer cadence, an annual scoped penetration test, and 12 pooled CISSP advisory hours per contract year.
Recurring scans must also address newly identified applicable vulnerabilities. Agent scanning does not replace coverage of network appliances and other agentless systems. A penetration test is an additional validation service, not a substitute for a control assessment. Review the full tier comparison and testing limits.
We can assist with GCC or GCC High procurement where appropriate. Eligibility, licensing, provider obligations, data flows, connector compatibility, and cryptographic implementation must be evaluated for the customer scope. Selecting a cloud product does not itself establish compliance.
Requirement-by-requirement
All 110 Level 2 requirements
This is a capability and responsibility map, not a customer assessment. No requirement is rated MET. Evidence examples describe what may support a review; they do not mean that records already exist or that a tool alone satisfies the requirement.
Reading the map: Base means the Silver foundation inherited by Gold and Platinum. Scoped means additional work or licensing must be agreed; it is not automatically included. Shared means both Level 4 and your team have work to perform. Configuration and hardening references describe available support; customer infrastructure remains customer-owned unless contracted.
Access control · 22 requirements
AC.L2-3.1.1 Restrict access to authorized users, processes, and devices
Service support: Base inventories, tool accounts, privileged access; scoped native configuration.
Responsibility: Shared.
Evidence examples: Approved onboarding list; account/device inventory; access tickets.
AC.L2-3.1.2 Restrict permitted transactions and functions
Service support: Base privileged-access tooling; onboarding least-privilege help.
Responsibility: Shared.
Evidence examples: Role matrix; permissions export; elevation records.
AC.L2-3.1.3 Enforce authorized CUI information flows
Service support: Scoped identity, sharing, and UTM configuration.
Responsibility: Customer/shared when engaged.
Evidence examples: Data-flow diagram; sharing policies; rule exports; transfer tests.
AC.L2-3.1.4 Separate incompatible duties
Service support: Governance help scoped or Platinum advisory pool.
Responsibility: Customer; Level 4 for its personnel.
Evidence examples: Duty matrix; requester/approver history.
AC.L2-3.1.5 Apply least privilege to accounts and security functions
Service support: Base JIT administration and credential management.
Responsibility: Shared.
Evidence examples: Approved roles; privilege inventory; elevation logs.
AC.L2-3.1.6 Use nonprivileged roles for ordinary activity
Service support: Privileged-access capability supports separation.
Responsibility: Shared.
Evidence examples: Separate account list; session samples.
AC.L2-3.1.7 Block unauthorized privileged functions and log execution
Service support: Base privileged tooling and SIEM.
Responsibility: Shared.
Evidence examples: Denied elevation test; successful elevation event; audit record.
AC.L2-3.1.8 Limit failed logon attempts
Service support: Base standard GPO hardening.
Responsibility: Shared.
Evidence examples: Effective lockout policy; failed-login test/log.
AC.L2-3.1.9 Present required privacy and security notices
Service support: Scoped policy/GPO configuration.
Responsibility: Customer approves; Level 4 implements if engaged.
Evidence examples: Approved banner; configuration; login screenshot.
AC.L2-3.1.10 Lock inactive sessions and hide displayed content
Service support: Base standard GPO session locking.
Responsibility: Shared.
Evidence examples: Effective timeout settings; observed lock test.
AC.L2-3.1.11 End sessions under defined conditions
Service support: Scoped identity/session policies.
Responsibility: Shared.
Evidence examples: Defined conditions; policy; termination test.
AC.L2-3.1.12 Monitor and control remote access
Service support: Base privileged-access/SIEM; scoped remote-access/UTM.
Responsibility: Shared.
Evidence examples: Remote-access inventory; sessions; approvals; alerts.
AC.L2-3.1.13 Encrypt remote access sessions
Service support: Customer-specific remote access design.
Responsibility: Customer/scoped Level 4.
Evidence examples: Protocol settings; session test; cryptographic evidence.
AC.L2-3.1.14 Route remote access through managed control points
Service support: Scoped UTM or remote-access engineering.
Responsibility: Customer/scoped Level 4.
Evidence examples: Access diagram; gateway rules; bypass test.
AC.L2-3.1.15 Authorize remote privileged commands and security-data access
Service support: Base privileged tooling and ticketed security-tool approvals.
Responsibility: Shared.
Evidence examples: Authorized commands/roles; approval; session logs.
AC.L2-3.1.16 Authorize wireless access before connection
Service support: Onboarding review; scoped network configuration.
Responsibility: Customer/scoped Level 4.
Evidence examples: Approved WLAN/device list; access configuration.
AC.L2-3.1.17 Authenticate and encrypt wireless access
Service support: Scoped network/UTM engagement.
Responsibility: Customer/scoped Level 4.
Evidence examples: Wireless security settings; authentication test.
AC.L2-3.1.18 Control mobile-device connections
Service support: Scoped endpoint/identity/mobile controls.
Responsibility: Customer/shared when engaged.
Evidence examples: Device enrollment; connection policy; blocked-device test.
AC.L2-3.1.19 Encrypt CUI on mobile devices and platforms
Service support: Scoped encryption configuration.
Responsibility: Customer/scoped Level 4.
Evidence examples: Encryption status; key custody; module/version evidence.
AC.L2-3.1.20 Verify and restrict external-system use/connections
Service support: Onboarding firewall review; scoped UTM/identity enforcement.
Responsibility: Customer/shared.
Evidence examples: Approved external systems; connection rules; review record.
AC.L2-3.1.21 Limit portable storage use on external systems
Service support: Base USB restrictions plus customer policy.
Responsibility: Shared.
Evidence examples: Device-control settings; approved-media list; test.
AC.L2-3.1.22 Control CUI on public systems
Service support: Scoped governance assistance.
Responsibility: Customer.
Evidence examples: Public-content approval; review/removal records.
Awareness and training · 3 requirements
AT.L2-3.2.1 Teach security risks and applicable policies/procedures
Service support: Base SAT and phishing simulations.
Responsibility: Shared.
Evidence examples: Curriculum; assignments; completions; policy acknowledgments.
AT.L2-3.2.2 Train personnel for assigned security duties
Service support: Base administrator-specific training; scoped additional advisory.
Responsibility: Shared.
Evidence examples: Role-based assignments; completions; duty matrix.
AT.L2-3.2.3 Teach insider-threat recognition and reporting
Service support: Base confirmed insider-threat training.
Responsibility: Shared.
Evidence examples: Lesson content; completion; reporting procedure.
Audit and accountability · 9 requirements
AU.L2-3.3.1 Generate and retain audit records for investigation
Service support: Base SIEM/SOC, 90 days central; Windows archive policy; extended retention scoped.
Responsibility: Shared.
Evidence examples: Event-source list; retention/export settings; sample logs.
AU.L2-3.3.2 Trace actions to individual users
Service support: Base tool audit trails and centralized logs.
Responsibility: Shared.
Evidence examples: Named account mapping; JIT/vault and target events.
AU.L2-3.3.3 Review and update selected logged events
Service support: Supported logging configuration and ticketed security-tool changes; ongoing event-selection review assigned in customer scope.
Responsibility: Shared.
Evidence examples: Event-selection baseline; review and change tickets.
AU.L2-3.3.4 Alert on audit logging failure
Service support: Base missing-source alerts confirmed.
Responsibility: Level 4 for tools; customer for other sources.
Evidence examples: Alert configuration; simulated failure; response ticket.
AU.L2-3.3.5 Correlate audit review, analysis, and reporting
Service support: Base SIEM/SOC integrations.
Responsibility: Level 4 for scoped feeds.
Evidence examples: Correlation rule; linked incident timeline; analyst record.
AU.L2-3.3.6 Reduce audit data and generate on-demand reports
Service support: Base SIEM export/report capability.
Responsibility: Level 4; customer evidence custodian.
Evidence examples: Sample query, filtered output, and requested report.
AU.L2-3.3.7 Synchronize clocks with an authoritative source
Service support: Customer time-synchronization configuration, with infrastructure engineering available by scope.
Responsibility: Customer infrastructure; scoped Level 4.
Evidence examples: Effective time source and drift outputs; network settings.
AU.L2-3.3.8 Protect logs and logging tools against unauthorized alteration/deletion
Service support: Base security-only clearing; scoped archive protection.
Responsibility: Shared.
Evidence examples: ACLs; privileged-role list; audit of deletion; recovery test.
AU.L2-3.3.9 Restrict audit-management privileges
Service support: Base authorized-security access to SIEM/SOC.
Responsibility: Shared.
Evidence examples: Logging-administrator roles; access approvals.
Configuration management · 9 requirements
CM.L2-3.4.1 Maintain baselines and lifecycle inventories
Service support: Base endpoint inventory; network discovery and monitoring separately quoted; asset tags on request.
Responsibility: Shared.
Evidence examples: Reconciled hardware/software/firmware inventory; baseline versions.
CM.L2-3.4.2 Establish and enforce secure configuration settings
Service support: Standard hardening GPOs; Microsoft baseline engineering scoped.
Responsibility: Shared.
Evidence examples: Baseline; effective GPO; exceptions; configuration test.
CM.L2-3.4.3 Track, review, approve/reject, and log changes
Service support: Base security-tool tickets and cybersecurity approval.
Responsibility: Level 4 for tools; customer for infrastructure.
Evidence examples: Request, decision, implementation record, before/after config.
CM.L2-3.4.4 Analyze security impacts before implementing changes
Service support: Security-impact analysis assigned to the change owner; advisory assistance available by scope.
Responsibility: Split by change owner.
Evidence examples: Pre-change impact analysis linked to approval.
CM.L2-3.4.5 Approve and enforce access restrictions for changes
Service support: Base privileged tooling; customer change/access policies.
Responsibility: Shared.
Evidence examples: Authorized change roles; access restrictions; approval.
CM.L2-3.4.6 Permit only necessary system capabilities
Service support: Base standard GPO hardening.
Responsibility: Shared.
Evidence examples: Approved functionality baseline; disabled features.
CM.L2-3.4.7 Restrict unnecessary software, ports, protocols, services
Service support: Base hardening; scoped UTM for network enforcement.
Responsibility: Shared.
Evidence examples: Service/port baseline; rules; scan/test.
CM.L2-3.4.8 Enforce software deny/allow policy
Service support: Base software-installation restrictions; enforcement to verify.
Responsibility: Shared.
Evidence examples: Application execution policy; allowed/denied execution test.
CM.L2-3.4.9 Control and monitor user-installed software
Service support: Base GPO restrictions, RMM inventory, privileged controls.
Responsibility: Shared.
Evidence examples: Software inventory; install approvals; blocked-install events.
Identification and authentication · 11 requirements
IA.L2-3.5.1 Identify users, processes, and devices
Service support: Base verified lists, inventories, and tool account control.
Responsibility: Shared.
Evidence examples: Identity/device register; service-account list.
IA.L2-3.5.2 Authenticate before allowing access
Service support: Base tool authentication; scoped system/identity implementation.
Responsibility: Shared.
Evidence examples: Authentication configuration; successful/failed tests.
IA.L2-3.5.3 MFA for privileged local/network and nonprivileged network access
Service support: Microsoft-native methods where applicable; alternate MFA scoped.
Responsibility: Shared.
Evidence examples: Enforced MFA policies; endpoint/remote/console tests; recovery procedure.
IA.L2-3.5.4 Use replay-resistant network authentication
Service support: Customer-specific identity/MFA design.
Responsibility: Shared.
Evidence examples: Protocol/method configuration; authentication test.
IA.L2-3.5.5 Prevent identifier reuse for a defined period
Service support: Controlled lifecycle; policy definition to verify.
Responsibility: Customer for AD/apps; Level 4 for tools.
Evidence examples: Identifier policy; deleted/retired account register.
IA.L2-3.5.6 Disable inactive identifiers after a defined period
Service support: Scoped identity policy; Level 4 tool lifecycle.
Responsibility: Shared.
Evidence examples: Inactivity threshold; disabled-account report.
IA.L2-3.5.7 Enforce password complexity and changed characters
Service support: Base GPO policies and privileged credential rotation.
Responsibility: Shared.
Evidence examples: Effective policy; applicable password-change test.
IA.L2-3.5.8 Prevent password reuse for a defined history
Service support: Base password GPO capability.
Responsibility: Shared.
Evidence examples: Effective history settings; test.
IA.L2-3.5.9 Require immediate replacement of temporary passwords
Service support: Scoped identity/lifecycle configuration.
Responsibility: Shared.
Evidence examples: Temporary-account workflow; first-login test.
IA.L2-3.5.10 Protect passwords cryptographically at rest and in transit
Service support: Privileged credential platform and native identity services.
Responsibility: Shared.
Evidence examples: Architecture; protocol configuration; storage/security documentation.
IA.L2-3.5.11 Obscure authentication feedback
Service support: Native system/application configuration.
Responsibility: Customer/scoped Level 4.
Evidence examples: Login UI test and settings.
Incident response · 3 requirements
IR.L2-3.6.1 Operate preparation, detection, analysis, containment, recovery, and user response
Service support: Base SOC/SIEM and MDR for covered servers and hosted applications/services; Gold/Platinum extend MDR to every supported enrolled endpoint; approved isolation; scoped assistance.
Responsibility: Shared; customer typically leads recovery.
Evidence examples: Response plan; contact tree; containment approval; incident timeline.
IR.L2-3.6.2 Track and report incidents to designated internal/external authorities
Service support: Tool alerts, tickets, cybersecurity escalation.
Responsibility: Shared; customer retains required external reporting unless contracted.
Evidence examples: Incident register; notifications; report receipts.
IR.L2-3.6.3 Test incident response capability
Service support: Platinum exercise support uses annual advisory pool; partners separately scoped.
Responsibility: Shared with customer/consultant.
Evidence examples: Exercise scenario; participants; results; improvement actions.
Maintenance · 6 requirements
MA.L2-3.7.1 Perform system maintenance
Service support: Base RMM patch deployment/reporting.
Responsibility: Customer operations; Level 4 contracted tools.
Evidence examples: Patch/maintenance schedule; results; customer follow-up.
MA.L2-3.7.2 Control maintenance tools, methods, and personnel
Service support: Privileged tooling and security-tool change process.
Responsibility: Shared.
Evidence examples: Approved tools/personnel; access records; procedure.
MA.L2-3.7.3 Sanitize CUI before offsite maintenance
Service support: Separate sanitization engagement available.
Responsibility: Customer unless contracted.
Evidence examples: Sanitization record; equipment custody; verification.
MA.L2-3.7.4 Malware-check diagnostic/test media before use
Service support: Base endpoint security supports checking.
Responsibility: Customer/technician performing work.
Evidence examples: Scan result; diagnostic-media checklist.
MA.L2-3.7.5 MFA for nonlocal maintenance and end sessions after work
Service support: Privileged platform MFA/JIT; system MFA scoped.
Responsibility: Shared.
Evidence examples: MFA test; maintenance-session start/end; ticket.
MA.L2-3.7.6 Supervise maintenance personnel without access authorization
Service support: Scoped procedures and support.
Responsibility: Customer; Level 4 for its applicable work.
Evidence examples: Escort/supervision record; temporary-access approval.
Media protection · 9 requirements
MP.L2-3.8.1 Physically control and securely store paper/digital CUI media
Service support: Documentation help scoped; no blanket physical service.
Responsibility: Customer.
Evidence examples: Storage inventory; access rules; site inspection.
MP.L2-3.8.2 Limit media access to authorized users
Service support: Scoped access-design assistance.
Responsibility: Customer/shared when engaged.
Evidence examples: Media permissions; approved custodians; access records.
MP.L2-3.8.3 Sanitize/destroy CUI media before reuse/disposal
Service support: Separate sanitization/destruction engagement.
Responsibility: Customer unless contracted.
Evidence examples: Method; serial/asset record; destruction or wipe verification.
MP.L2-3.8.4 Apply CUI markings and distribution limits
Service support: Scoped documentation assistance.
Responsibility: Customer/consultant.
Evidence examples: Marking rules; labeled examples; training.
MP.L2-3.8.5 Control and track media transported outside controlled areas
Service support: Scoped process assistance.
Responsibility: Customer.
Evidence examples: Transfer log; recipient authorization; custody receipt.
MP.L2-3.8.6 Encrypt transported digital CUI unless alternatively physically protected
Service support: Scoped encryption or handling design.
Responsibility: Customer/shared when engaged.
Evidence examples: Encryption/config evidence or approved physical safeguards.
MP.L2-3.8.7 Control removable media on systems
Service support: Base standard USB restriction GPOs.
Responsibility: Shared.
Evidence examples: Effective device-control rules; allow/deny test.
MP.L2-3.8.8 Prohibit portable storage without an identifiable owner
Service support: Base restrictions support customer ownership policy.
Responsibility: Shared.
Evidence examples: Approved-media/owner register; restriction test.
MP.L2-3.8.9 Protect backup CUI confidentiality at storage locations
Service support: Separate backup/DR product.
Responsibility: Customer/provider unless Level 4 contracted.
Evidence examples: Backup encryption/access settings; storage/provider records.
Personnel security · 2 requirements
PS.L2-3.9.1 Screen personnel before CUI-system access
Service support: Documentation assistance scoped.
Responsibility: Customer HR; Level 4 for applicable own personnel.
Evidence examples: Screening policy; completion/authorization attestation.
PS.L2-3.9.2 Protect systems during/after transfers and terminations
Service support: Base authorized offboarding tickets and Level 4 tool deactivation.
Responsibility: Shared.
Evidence examples: Authorized ticket; account/session/access removal; equipment checklist.
Physical protection · 6 requirements
PE.L2-3.10.1 Restrict physical access to systems/equipment/environments
Service support: Documentation support scoped.
Responsibility: Customer/facility provider.
Evidence examples: Authorized access list; locks/badges; inspection.
PE.L2-3.10.2 Protect and monitor facilities and supporting infrastructure
Service support: Documentation support scoped.
Responsibility: Customer/facility provider.
Evidence examples: Monitoring plan; wiring/power protection; inspection.
PE.L2-3.10.3 Escort and monitor visitors
Service support: Documentation support scoped.
Responsibility: Customer/facility provider.
Evidence examples: Visitor procedure; sign-in; escort record.
PE.L2-3.10.4 Keep physical-access audit records
Service support: Documentation support scoped.
Responsibility: Customer/facility provider.
Evidence examples: Badge/visitor logs; retention policy.
PE.L2-3.10.5 Manage keys, badges, and other physical-access devices
Service support: Documentation support scoped.
Responsibility: Customer/facility provider.
Evidence examples: Key/badge inventory; issuance/revocation.
PE.L2-3.10.6 Protect CUI at alternate work sites
Service support: Scoped remote-work guidance.
Responsibility: Customer.
Evidence examples: Remote-site rules; acknowledgment; safeguards evidence.
Risk assessment · 3 requirements
RA.L2-3.11.1 Periodically assess operational, asset, and individual risk
Service support: Scoped CISSP assistance; Platinum pool.
Responsibility: Customer approves; Level 4 technical inputs.
Evidence examples: Risk assessment; threat/impact analysis; accepted actions.
RA.L2-3.11.2 Scan systems/apps periodically and upon new applicable vulnerabilities
Service support: Gold annual scans; Platinum quarterly/scope-defined and vulnerability-triggered checks plus agent scanning.
Responsibility: Level 4 contracted scans; customer supplies complete scope.
Evidence examples: Internal/external scan reports; asset coverage; advisories and triggered checks.
RA.L2-3.11.3 Remediate vulnerabilities according to assessed risk
Service support: Cybersecurity team tracks findings/remediation; Level 4 support scoped.
Responsibility: Customer normally implements; Level 4 for contracted fixes.
Evidence examples: Risk ranking; assigned actions; remediation and retest record.
Security assessment · 4 requirements
CA.L2-3.12.1 Periodically assess effectiveness of security controls
Service support: Scoped assessment help; Platinum advisory/testing supports inputs.
Responsibility: Customer/consultant; shared evidence.
Evidence examples: Assessment plan and results; interviews/tests; remediation.
CA.L2-3.12.2 Plan and implement correction of deficiencies
Service support: Technical findings tracked; broader plan assistance scoped.
Responsibility: Customer overall; Level 4 technical findings.
Evidence examples: Remediation plan; milestones; owners; closure proof.
CA.L2-3.12.3 Monitor ongoing control effectiveness
Service support: Base SOC/SIEM/tool reports; Platinum recurring scans.
Responsibility: Shared.
Evidence examples: Monitoring plan; reviewed reports; failure/follow-up records.
CA.L2-3.12.4 Maintain an SSP describing boundary, environment, implementation, and connections
Service support: Templates and technical assistance scoped; Platinum pool.
Responsibility: Customer approves; Level 4 describes its controls.
Evidence examples: Customer-specific SSP; diagrams; provider responsibility matrix.
System and communications protection · 16 requirements
SC.L2-3.13.1 Protect external and key internal communication boundaries
Service support: Monitoring and onboarding firewall review; managed UTM separate.
Responsibility: Customer/scoped Level 4.
Evidence examples: Diagram; firewall rules; flow/security logs; rule test.
SC.L2-3.13.2 Use secure architecture, development, and engineering practices
Service support: Scoped infrastructure/security engineering.
Responsibility: Customer/design or development owner.
Evidence examples: Design review; secure-development practices; architecture.
SC.L2-3.13.3 Separate ordinary user and system-management functions
Service support: Base privileged access; scoped management-network design.
Responsibility: Shared.
Evidence examples: Admin interfaces/roles; segmentation; access test.
SC.L2-3.13.4 Prevent unintended disclosure through shared resources
Service support: Scoped platform/host configuration review.
Responsibility: Customer/provider.
Evidence examples: Isolation settings; platform design; reuse/isolation test.
SC.L2-3.13.5 Separate public-facing components from internal networks
Service support: Onboarding review; scoped UTM/network work.
Responsibility: Customer/scoped Level 4.
Evidence examples: Public-component inventory; network diagram; isolation test.
SC.L2-3.13.6 Deny network traffic by default and allow exceptions
Service support: Scoped UTM or customer firewall policy.
Responsibility: Customer/scoped Level 4.
Evidence examples: Default-deny rules; approved exceptions; traffic test.
SC.L2-3.13.7 Prevent split tunneling on remote connections
Service support: Scoped remote-access/UTM configuration.
Responsibility: Customer/scoped Level 4.
Evidence examples: VPN/remote policy; routing and bypass test.
SC.L2-3.13.8 Protect CUI in transit with cryptography or permitted physical safeguards
Service support: Scoped secure-transfer/remote-access design.
Responsibility: Customer/provider; Level 4 when contracted.
Evidence examples: Data-flow list; transport settings; certificate/module evidence.
SC.L2-3.13.9 End network connections at session end or after inactivity
Service support: Scoped host, application, and UTM policies.
Responsibility: Customer/scoped Level 4.
Evidence examples: Timeout policy; connection termination test.
SC.L2-3.13.10 Establish and manage cryptographic keys
Service support: Scoped encryption/hosting/DR configuration.
Responsibility: Shared by service.
Evidence examples: Key-management procedure; permissions; recovery/rotation records.
SC.L2-3.13.11 Use FIPS-validated cryptography for CUI confidentiality
Service support: Scoped cryptographic design and validation of module certificates, versions, and operating modes for the customer environment.
Responsibility: Shared/provider.
Evidence examples: Module certificate; exact version; approved mode/configuration.
SC.L2-3.13.12 Prevent remote activation of collaborative devices and indicate use
Service support: Scoped endpoint/collaboration policies.
Responsibility: Customer/scoped Level 4.
Evidence examples: Camera/microphone settings; activation/indicator tests.
SC.L2-3.13.13 Control and monitor mobile code
Service support: Endpoint protection supports the control; application and script policies require customer-specific configuration.
Responsibility: Shared.
Evidence examples: Browser/script policy; execution restrictions; events.
SC.L2-3.13.14 Control and monitor VoIP
Service support: Voice/UTM are separate product lines.
Responsibility: Customer/provider unless contracted.
Evidence examples: Voice inventory; segmentation/access rules; monitoring records.
SC.L2-3.13.15 Protect authenticity of communications sessions
Service support: Scoped identity and transport configuration.
Responsibility: Customer/provider; Level 4 when engaged.
Evidence examples: Certificate/trust settings; secure-session tests.
SC.L2-3.13.16 Protect CUI confidentiality at rest
Service support: Scoped storage, endpoint, tenant, and DR protections.
Responsibility: Customer/provider; shared when contracted.
Evidence examples: Data-store inventory; encryption/access settings; test.
System and information integrity · 7 requirements
SI.L2-3.14.1 Identify, report, and correct flaws promptly
Service support: All tiers include RMM patch deployment and reports to internal IT identifying failed patches and affected machines; Gold/Platinum scan enhancements.
Responsibility: Shared; customer investigates and remediates failures unless Level 4 is separately engaged.
Evidence examples: Machine-level patch failure reports; failure tickets; remediation and exceptions.
SI.L2-3.14.2 Deploy malware protection at designated locations
Service support: Base endpoint and email threat protection.
Responsibility: Level 4 scoped tools; customer remaining locations.
Evidence examples: Deployment inventory; policies; safe protection test.
SI.L2-3.14.3 Monitor security advisories/alerts and respond
Service support: Base SOC/SIEM; cybersecurity team.
Responsibility: Shared.
Evidence examples: Advisory review; alerts; response/notification tickets.
SI.L2-3.14.4 Update malware protection as releases become available
Service support: Base managed endpoint/email tools.
Responsibility: Level 4 for contracted tools.
Evidence examples: Engine/content/version reports; update/health alerts.
SI.L2-3.14.5 Perform periodic malware scans and real-time external-file scans
Service support: Base endpoint protection.
Responsibility: Level 4 tools; customer uncovered systems.
Evidence examples: Configured scan policies; history; real-time protection test.
SI.L2-3.14.6 Monitor systems and inbound/outbound traffic for attacks
Service support: Base SIEM/SOC and MDR for covered servers and hosted applications/services; Gold/Platinum extend MDR to every supported enrolled endpoint; scoped network telemetry.
Responsibility: Shared.
Evidence examples: Enabled sources; detections; sample investigation.
SI.L2-3.14.7 Identify unauthorized system use
Service support: Base security monitoring and privileged audit trails.
Responsibility: Shared.
Evidence examples: Use rules; detection cases; account/activity reviews.
Who does what?
Converge is co-managed security. Your internal IT and compliance teams remain central to the program. MSSP One or a separate infrastructure engagement can shift additional operational work to Level 4.
Level 4 manages the contracted security tools
We reconcile supplied user and asset lists, configure supported tools and reporting, manage security-tool changes with cybersecurity-team approval, and track findings from contracted vulnerability scans and penetration tests.
Supported threat containment follows an agreed escalation and approval path. If the customer cannot be reached, approval escalates to Level 4's cybersecurity team under the agreed response authority.
The customer owns the broader environment
Your team approves access and policies, identifies FCI/CUI and the assessment boundary, supplies asset changes, performs native AD/Microsoft 365 account actions, and normally owns infrastructure remediation, recovery, physical safeguards, and personnel processes.
Offboarding requires an authorized ticket. Level 4 disables access in its covered tools; internal IT handles native accounts and other systems unless that work is contracted.
Standard hardening policies and Microsoft security-baseline engineering are available within the agreed implementation scope. Under Converge, internal IT normally applies infrastructure changes unless Level 4 is specifically engaged. Firewall-rule review and network visibility do not include unlimited firewall administration.
We support Microsoft-native multifactor authentication where applicable and alternative methods to suit customer systems and scope. Each required access path needs configuration and validation; MFA on a management platform alone does not prove MFA on every underlying system.
Evidence that supports your team
Reports are the starting point—not the whole audit file
During onboarding, we configure supported report types, schedules, and delivery to your designated compliance mailbox within the purchased scope. Your team can collect available exports directly where supported, organize reports, and retain the evidence it needs. We can assist with collection and audit preparation through our ticketing system when engaged.
Included technical reporting
- Supported security-tool, training, and patch reports, including failed patches and affected machines.
- Security-tool change records and approvals; scan and remediation records for contracted testing.
- Central security logs retained for 90 days by default. Exports and extended retention are available by scope.
- Collection-health alerts for expected sources that stop reporting; supported Windows log archiving can be configured.
Customer-specific evidence support
- Templates can help develop the customer's security program, policies, and system security plan. Templates are tailored during an engagement, not published for download here.
- Documentation and evidence assistance is separately billed for Silver and Gold; eligible Platinum assistance draws from the annual advisory pool.
- A custom audit evidence repository is available as a separate, additional-fee engagement for technical and customer-provided evidence.
Evidence location, access, retention, review frequency, and responsibility are agreed for the environment. Reports and repositories must be evaluated for the sensitivity of the information they contain before use. Do not send CUI, credentials, or sensitive configurations through a public contact form.
Framework references
Requirement summaries are plain-language paraphrases. Use the official texts and applicable assessment objectives for a customer assessment. Framework references reviewed October 14, 2026.
- FAR 52.204-21 — basic safeguards for FCI
- 32 CFR 170.14 — CMMC model and incorporated standards
- 32 CFR 170.19 — assessment scope
- NIST SP 800-171 Revision 2 — Level 2 requirements
- NIST SP 800-171A, June 2018 — assessment procedures
NIST has published Revision 3; this CMMC Level 2 map uses Revision 2 because that is the version incorporated by the CMMC rule reviewed above.
Connect the controls to your operating plan
We can work alongside your internal team and compliance consultant to document the boundary, allocate responsibilities, and identify the services and evidence your environment needs.
- MSSP Converge — co-managed security
- Compliance consulting and evidence support
- Plans, scope, and agreement guide