Worked example: how a 12-person mover gets to Level 2
Example Moving Co. is fictional. Its names, numbers and dates are made up to show how the pieces of a Level 2 self-assessment fit together. Its scores are worked out from the official point values. Its providers are fictional too: nothing here says that any real product, ours included, meets the cloud rule.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
The company
Example Moving Co. is a 12-person household goods mover that works as an agent for a TSP on military moves: an owner, an office manager, two estimators, two crew leads, five movers (three of them seasonal) and a warehouse lead. It uses moving software in the cloud, a cloud email service, four office computers, six company phones, a copier, and an outside IT company.
Its scope
Every asset, its type, and what the company did about it.
Moving software (cloud)
Type: CUI asset
What they did: Got the provider's proof that it meets the cloud rule (a FedRAMP Marketplace listing at Moderate or higher, or evidence for DoD's equivalency policy) and its customer responsibility matrix, and wrote what is still the company's job into the SSP. Without that proof, the shipment information would have had to move to a service that has it.
Email (cloud)
Type: CUI asset
What they did: Moved to an email service that is FedRAMP authorized at Moderate or higher, and stopped emailing orders around.
Four office computers
Type: CUI assets
What they did: Encrypted, managed by the IT company, multifactor sign-in.
Six company phones
Type: CUI assets
What they did: Enrolled in device management, encrypted, screen-locked.
Copier
Type: CUI asset
What they did: Set to overwrite stored jobs; the drive will be wiped before the copier is returned.
Router, firewall and Wi-Fi
Type: Security protection assets, and CUI assets
What they did: Business and guest Wi-Fi separated by the firewall. CUI assets too, because shipment information passes through them.
Security tools (device management, sign-in and multifactor service, password manager, antivirus)
Type: Security protection assets
What they did: Run by the IT company, with multifactor sign-in for administrators.
Outside IT company
Type: Its services are security protection assets
What they did: Handles passwords, settings and activity records, not shipment information. Its service description and customer responsibility matrix are in the SSP.
IT company's remote-support tool
Type: Security protection asset
What they did: Multifactor sign-in; sessions recorded.
Accounting system
Type: Contractor risk managed asset
What they did: Written rule: invoices for military moves never carry a service member's details.
Personal phones
Type: Contractor risk managed assets
What they did: Blocked from the email service and the moving software; the written rule and crew training say never to photograph paperwork or labels with them. Listed in the asset inventory and SSP.
Paperwork, file cabinet and office
Type: In scope (paper and places)
What they did: Locked cabinet, visitor log, shredding.
Guest Wi-Fi
Type: Out of scope
What they did: No way into the business network.
See what's in scope at a moving company for how the five types work.
Sources: 32 CFR 170.19, 32 CFR 170.16
From first score to Final status
October 2026: Scope
Followed the shipment information through the company, sorted every system and device into the five types, and listed the paperwork and the places it is kept. Blocking personal phones from email and the moving software kept shipment information off them, and keeping orders out of email meant fewer copies to protect.
November 2026: First practice score: minus 12
Took Project Spectrum's free Level 2 self-assessment. 16 of the 44 requirements that can cost 5 points were open, including multifactor sign-in, device encryption, an incident plan and training. There was no System Security Plan yet, so this was only a practice score: an official score needs one.
December 2026: Practice score: 61
Turned on multifactor sign-in everywhere, enrolled and encrypted every device, and moved email. Adapted the policies pack to how they work, and the owner approved it. Put the asset inventory, standard settings, staff screening, offboarding and disposal steps in place, locked up paperwork and drives, wrote the incident plan, ran crew training with a signed attendance sheet, and trained the office manager for the security duties of the job.
January 2027: Score: 92
Wrote the System Security Plan from the template; set up activity records, alerts and monitoring with the IT company; did a first risk assessment and a check of every protection; started the visitor log and escorts. 18 one-point gaps were left, all of a kind that may wait on a plan of action.
1 February 2027: Conditional status
Did the self-assessment against the official objectives, posted 92 in SPRS, noting that it has a POA&M for the 18 gaps, and the owner affirmed. 1 February 2027 became the CMMC Status Date; the closeout deadline was 31 July 2027.
15 June 2027: Final status
Closed all 18 gaps, posted the closeout self-assessment (110) and affirmed again. The CMMC Status Date stays 1 February 2027.
Next: Keeping it
Yearly affirmations due by 1 February 2028 and 1 February 2029; a new self-assessment due by 1 February 2030; evidence kept until at least 1 February 2033; risk review, control check and SSP update at least once a year.
Sources: 32 CFR 170.24, 32 CFR 170.21, 32 CFR 170.16, 32 CFR 170.22, 32 CFR 170.4
What they learned
- Scope first. Every system they kept shipment information out of was one less system to fix.
- Check cloud services early. Moving email took the longest of any single fix.
- Multifactor sign-in and device management fixed the most points at once.
- Collect evidence as you go: screenshots, signed sheets, logs. It is much harder to gather at the end.
- Plan for seasonal crews: accounts, training and devices on the first day and on the last.
Your own path will differ. Start with Start here and the free tools. This example is general information, not legal or compliance advice; see the disclaimer.