RSP-0142Awaiting your reviewTier: Critical
Precision Machining Co.
Supplier Cybersecurity Assessment v2Submitted 2026-10-09 16:42Greg Halvorsen · IT ManagerCMMC L2 (self)
Weighted score
72 / 100
Medium riskwas 68 last year
Answered
16 of 17
1 optional left blank
Auto-flags
4
2 not yet reviewed
Follow-ups open
2
Vendor replied to 1
Review progress
Answers accepted13 of 17
CUI handling
weight 25%75%
2.4
Where will Acme CUI reside?×3
On-premises enclave; Commercial cloud (not FedRAMP)
Commercial cloud for CUI is not permitted under DFARS 7012(b)(2)(ii)(D).
ES
Elena SorokinOct 10
Which commercial cloud service is in scope, and does it hold CUI or only FCI?
PM
Greg Halvorsen (vendor)Oct 10
Dropbox Business, used for quotes only (FCI). CUI drawings stay on-prem. We can move quotes to the enclave.
6/10
Access control & MFA
weight 25%61%
3.1
Which MFA methods are enforced for remote and privileged access?×5
Authenticator app (TOTP / push); SMS one-time code
SMS is not phishing-resistant; accepted only with a migration date.
DW
Dana WhitfieldOct 10
Is SMS used for privileged accounts? Please give a date to retire it.
Waiting for vendor reply · reminder in 3 days
8/10
3.3
How often are user access rights reviewed?×3
Annually
Below Acme minimum (quarterly for CUI systems).
3/10
Incident response
weight 20%81%
4.3
Upload your incident response plan (PDF or DOCX).×2
IR-Plan-v2.pdf (2.1 MB) · last revised 2023-01
Plan is older than 12 months.
5/10
Decision for Precision Machining Co.
2 flagged answers still need your review. Rejecting requires a comment.