A departure notice, an access-removal action and a verification result are different records. This lab teaches you to connect them without assuming one proves all the others.
Learning objectives and preparation
By the end of this exercise, explain the difference between initiating a personnel change, performing an access action and checking its result. Identify which environment each artifact covers and write a conclusion limited to the evidence supplied. Use only the fictional records below; do not copy real credentials, personnel files or client data into a training workspace.
FAR 52.204-21 includes limiting system access to authorized users and permitted functions. This lab illustrates reasoning about those concepts. It is not a complete assessment of a requirement or an official scoring exercise.
Create the five fictional artifacts
- HR-01: TRAINING-USER-07 leaves the fictional project at 17:00 Monday.
- IT-02: a ticket requests removal from TRAINING-APP-A and TRAINING-APP-B.
- ID-03: the identity provider records a disable action at 17:05 Monday.
- APP-04: a Tuesday export shows an active local account in APP-B.
- TEST-05: a reviewer confirms access is unavailable through the central sign-in path only.
Label the packet 'Fictional learning material.' Give each item an authoring system and timestamp. The exercise deliberately leaves a question about a local application account that may not depend on the central sign-in path.
Draw the evidence chain
On paper, connect the request to the intended actions, the actions to the affected identities, and the verification to the access paths actually tested. Mark where a record concerns APP-A, APP-B or the central identity provider. Do not let a shared user display name stand in for a verified identity match.
Ask what TEST-05 establishes. It supports the limited conclusion that the tested central path was unavailable at the time of the check. It does not answer whether a separate local APP-B login remains usable or whether every token and permission has been handled.
Work the answer before adding new evidence
A defensible first answer is: 'The packet records the departure request and central disable action. The central sign-in check supports that path's removal, but APP-B's active local account needs investigation.' This describes the useful result and the remaining uncertainty without claiming that every system is secure.
Now add a fictional APP-B administrator record showing the local account was disabled, plus a dated follow-up check covering that login method. Explain which uncertainty the new material resolves. Preserve the first packet and append the later records so learners can see the sequence rather than rewriting it.
Self-check and workplace transfer
Why is a closed ticket not enough? Because closure may describe an administrative state while leaving the performed actions and verification unclear. Why is a failed central login not enough? Because the test covers a particular path. What should a reviewer request? Evidence addressing the remaining identity, environment, timing and access-method questions.
For a broader view of the 15 safeguards and a browser-based work planner, see the CMMC Level 1 Guide planner, a related Federal Bid Partners publication.
For practical readiness organization, CMMC Pulsar provides workflows for controls and evidence. For business and procurement support, Federal Bid Partners provides advisory services. These are affiliated commercial resources. Completing this lesson does not demonstrate compliance or confer a credential.
Sources & context
The worked examples and internal registers are editorial teaching aids. Use current official guidance and the actual procurement documents for decisions.
Educational information; not a determination of compliance, award eligibility or certification. Our editorial approach and commercial relationships.