UCSIntel
Integrity. Compliance. Controlled.
Sample Deliverable · CMMC Level 2

Documentation Gap Report

The following is a redacted example of a gap report produced during a UCS engagement. Sensitive fields have been removed. Company identity is fictional. Control findings and scoring are representative of a mid-size Virginia defense subcontractor entering Phase 2.

SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION · SAMPLE — NOT FOR DISTRIBUTION
Entity
Apex Defense Solutions LLC
Virginia · CMMC Level 2
CAGE / UEI
CAGE:
UEI:
Report Date
March 2026
Prepared by: UCSIntel
Primary Contact:
Contract Value:
NAICS: 541330
Executive Summary

Apex Defense Solutions LLC is a Virginia-based engineering services firm operating under active DoD contracts requiring compliance with NIST SP 800-171 and CMMC Level 2. This assessment was conducted across 110 applicable practices covering 14 control domains. At the time of assessment, the organization had achieved full compliance on 35 practices, partial implementation on 36, and had not addressed 39 practices — yielding a calculated SPRS score of 47 out of 110.

The most significant deficiencies are concentrated in System and Communications Protection (SC), Access Control (AC), and Audit and Accountability (AU). Critical gaps include the absence of encryption on CUI-handling internal systems, active shared administrator credentials with no individual accountability, and audit log retention that falls materially below the 90-day minimum requirement. These three findings alone represent the highest-risk exposure to contract performance and assessment outcome.

With targeted remediation in the sequences documented in this report, the organization can project a score in the 85–95 range within a 60–90 day engagement window. The POA&M items identified are scoped for the existing IT team with selective vendor assist. No major infrastructure replacement is required. The primary effort is documentation, configuration hardening, and access model restructuring.

SPRS Score
47
OUT OF 110 MAXIMUM
Compliant35
Partial36
Non-Compliant39

Score is self-attested per DFARS 252.204-7019 methodology. Assessment conducted March 2026. Contracting officer notification required for scores below 70.

Control Domain Summary — All 14 Families
DomainFamilyCompliantPartialNon-CompliantRisk
ACAccess Control8/2277High
ATAwareness and Training1/311Low
AUAudit and Accountability2/943Medium
CMConfiguration Management2/934Medium
IAIdentification and Authentication4/1143Medium
IRIncident Response1/311Low
MAMaintenance2/622Medium
MPMedia Protection3/933Medium
PEPhysical Protection4/611Low
PSPersonnel Security1/210Low
RARisk Assessment0/312Medium
CASecurity Assessment1/412Medium
SCSystem and Communications Protection4/1657High
SISystem and Information Integrity2/723Medium
Top 5 Critical Gaps — Remediation Priority
1.SC.3.177CUI Encryption in Transit
Critical

TLS 1.2 or higher not enforced on internal application servers handling CUI. Unencrypted channels identified on three endpoints.

Remediation
Deploy TLS 1.2+ across all CUI-handling systems. Update IIS and Apache configurations. Validate with network scan.
Est. Effort
2–3 weeks
2.AC.2.006Least Privilege — Shared Accounts
Critical

Fourteen shared administrator credentials in active use across engineering and operations. No individual accountability trail.

Remediation
Provision named accounts for all personnel. Disable shared accounts. Implement RBAC policy in AD.
Est. Effort
3–4 weeks
3.AU.2.041Audit Log Review and Retention
High

No centralized log aggregation. Logs stored locally on endpoints; retention averages 11 days. CMMC requires 90-day minimum.

Remediation
Deploy SIEM or centralized syslog server. Configure 90-day hot retention and 1-year archive.
Est. Effort
4–6 weeks
4.CM.3.068Baseline Configuration — Endpoints
High

No documented baseline configuration exists for workstations or servers. Variance from standard not detectable or enforced.

Remediation
Document baselines using DISA STIGs or CIS Benchmarks. Implement configuration monitoring via GPO or MDM.
Est. Effort
3–5 weeks
5.IA.3.083Multi-Factor Authentication — Privileged Access
Critical

MFA not enforced for any privileged accounts including domain admin, server admin, and remote access sessions.

Remediation
Enforce MFA via Azure AD Conditional Access or equivalent. Prioritize VPN and RDP sessions.
Est. Effort
1–2 weeks
Plan of Action & Milestones — Preview (3 of 39 items)
Full POA&M delivered as part of engagement package
ItemControlWeaknessMilestonesResourcesScheduledStatus
POA-001SC.3.177CUI transmitted without encryption on internal network segmentsWeek 1: inventory affected systems · Week 3: TLS deployed · Week 4: scan and validateInternal IT + vendor assistQ2 2026Open
POA-002AC.2.006Shared administrator accounts without individual accountabilityWeek 1: audit accounts · Week 2: provision named accounts · Week 3: disable shared credsInternal ITQ1 2026Open
POA-003AU.2.041Audit logs not centralized; retention below 90-day requirementWeek 2: select SIEM · Week 4: deploy · Week 6: validate retention policyInternal IT + MSSPQ2 2026Open
Remaining 36 POA&M items and full evidence index are part of the delivered engagement package. Fields marked are redacted in this sample.
UCSIntel · Universal Compliance Services LLC · compliance@ucsintel.com
SAMPLE — NOT FOR DISTRIBUTION
Start Your Assessment

See Where Your Documentation Stands

A 20-minute call is enough to identify your critical gaps before your assessor does.

Schedule Your Documentation Review
No commitment required. Mary Lozada · Compliance Documentation Consultant