Sample mock assessment: Harlan Creek Machine Works.
A fictional 45-person CNC shop that machines parts for two defense primes, runs Microsoft 365 GCC High, and receives CUI drawings by email. This is the report Garde1 produces before you book a C3PAO. Company and findings are illustrative; the scoring rules are real. SPRS is weighted: four 5-point gaps plus six smaller ones put Harlan Creek at 82.
100 of 110 requirements met. Conditional status needs 88 or more, with only 1-point requirements (and FIPS encryption) left on the POA&M. Four 5-point gaps stand in the way, and PE.L2-3.10.4 also blocks Conditional status: 32 CFR 170.21 never allows it on a POA&M.
Scope Garde1 built
- 31 people handle CUI: engineering, programming, quality and the shop floor.
- CUI assets: the GCC High tenant, 6 engineering workstations, the DNC server and 9 CNC controllers.
- Security protection assets: Intune, Defender, Sentinel and the firewall.
- Out of scope: guest Wi-Fi and the front-office PCs, separated by VLAN.
- Contradiction caught: the questionnaire said CUI never leaves Microsoft 365, but G-code made from CUI drawings goes to the DNC server. It is now in scope.
Results by family.
What failed, and the fix.
Ordered by points. The last column is what 32 CFR 170.21 allows on a POA&M; anything marked otherwise must be fixed before the assessment.
| Requirement | Points | What we found | The fix | POA&M |
|---|---|---|---|---|
| IA.L2-3.5.3 Multifactor authentication | −5 | Three global admin accounts in Entra ID are excluded from the conditional-access policy that enforces MFA. | Remove the exclusion in Entra. Garde1 gives the steps and re-checks it at your next assessment. | Fix before Conditional |
| AU.L2-3.3.1 Create and keep audit logs | −5 | The two CAM programming workstations keep local logs for 7 days and do not forward them anywhere. | Send their logs to the Microsoft Sentinel workspace the rest of the tenant already uses, and keep them 90 days. | Fix before Conditional |
| CM.L2-3.4.1 Baseline configuration and inventory | −5 | The DNC server and the nine CNC controllers it feeds are missing from the asset inventory. | Add them as specialized assets, with the controller model and firmware for each. | Fix before Conditional |
| MP.L2-3.8.3 Sanitize media before disposal | −5 | Four drives from retired engineering PCs were recycled in March with no sanitization record. | Adopt the media disposal procedure in your generated MP policy and record each drive going forward. | Fix before Conditional |
| SC.L2-3.13.11 FIPS-validated encryption | −3 | The CAM workstations encrypt their drives, but with a configuration that is not FIPS-validated. | Switch BitLocker to FIPS mode through Intune. | Allowed on POA&M |
| PE.L2-3.10.4 Physical access logs | −1 | The front-door badge system keeps no visitor log, and the paper sign-in sheet is thrown out weekly. | Keep the sign-in sheets for a year, or turn on visitor logging in the badge system. | Never allowed on POA&M |
| AT.L2-3.2.3 Insider threat awareness | −1 | Annual training covers phishing but not insider threat indicators. | Assign the insider threat module to all 31 people in scope. | Allowed on POA&M |
| AU.L2-3.3.8 Protect audit information | −1 | Local administrators on the CAM workstations can clear their own event logs. | Resolved by forwarding logs off the machines (see AU.L2-3.3.1). | Allowed on POA&M |
| CM.L2-3.4.9 User-installed software | −1 | Office users can install software from the internet without approval. | Apply the Intune app-installation restriction from your baseline. | Allowed on POA&M |
| SC.L2-3.13.13 Mobile code | −1 | Office macros from the internet are not blocked. | Turn on the Microsoft 365 policy that blocks macros from the internet. | Allowed on POA&M |
The path to 88.
Fix the four 5-point gaps and the physical access log, and the score reaches 104 (forwarding the CAM logs also resolves AU.L2-3.3.8). The remaining 4 items fit on a POA&M, with 180 days to close them after Conditional status. Garde1 gives the steps for each one and applies the supported settings for you once you approve them.
Credit from Microsoft.
Microsoft's public placemat for GCC High (v2.0 Preview, October 2024) marks 52 requirements as Microsoft's, 57 as shared and 1 as yours. Garde1 credited only the 52, and only on the GCC High tenant. How we counted.
Want this for your shop?
Connect Microsoft 365 and answer the scoping questions. Your first mock assessment runs during the 14-day trial, in about 12 minutes. Start a trial