CMMC Level 2 Audit Evidence Search Queries

A CMMC assessor rarely asks for theory. They ask for proof.

If your team can’t pull the right records fast, solid security work can look thin. I build CMMC Level 2 audit evidence around repeatable searches, clear time ranges, and records that point back to the control objective without guesswork.

What “purview” means in a Level 2 review

In a CMMC Level 2 assessment, “purview” usually means the part of the environment that falls within view, control, and accountability for the assessment. In Microsoft-heavy environments, teams also use the word to mean Microsoft Purview, the Microsoft toolset for content discovery, auditing, and compliance records. Those are related ideas, but they are not the same thing.

The official CMMC materials focus on scope, evidence, and assessment objectives. So I start with the DoD’s Level 2 scoping guide and the official Level 2 assessment guide. Those documents help me decide which users, devices, systems, cloud services, and records matter for the review.

That matters because a good evidence search starts with boundary control. If I don’t know where CUI lives, who can reach it, which endpoints touch it, and which tools log that activity, my searches won’t hold up. Microsoft Purview can help find files, emails, labels, and audit events. Still, it is one evidence source, not the whole story.

If I can’t trace a query to a control, a system, a date range, and a record owner, I don’t count it as audit-ready evidence.

I also keep one point in mind: “purview” is practical shop talk, not a formal control citation. The assessment still turns on the current CMMC guidance and the NIST SP 800-171 objectives that Level 2 assesses.

What good assessor evidence looks like

Good evidence is traceable, time-bounded, and aligned to the control objective. I want every artifact to answer five basic points: what control it supports, which system produced it, who pulled it, what date range it covers, and why it proves the requirement.

That is why I don’t hand over random screenshots. A screenshot may support context, but it rarely stands well on its own. I prefer a dated export, the query or filter used to pull it, and a related ticket, policy, approval, or configuration record. Together, those items tell a clean story.

For example, if I need to support an access control objective, I don’t stop at an Entra role screenshot. I pair it with a user access ticket, a manager approval, the sign-in or audit record, and the current group membership export. If I need to support patching or anti-malware controls, I want a vulnerability report, the remediation ticket, and the endpoint console status from the same time window.

I also label files so another reviewer can re-run the trail. A name like “AC_M365_Audit_FileAccess_2026-04-01_to_2026-06-30.csv” beats “audit export final 3.” The best CMMC Level 2 audit evidence is not just readable, it is repeatable.

Volume can also work against you. Dumping a month of tenant logs into a folder wastes time and raises more questions. A narrow search with preserved context is stronger than a huge export with no explanation.

Illustrative search queries across common systems

The exact syntax changes by tool. A search in Microsoft 365 won’t look like one in Splunk, Intune, Jira, or Qualys. Still, the search intent should stay stable, and the examples below give me a solid starting point.

Microsoft 365, Entra ID, and file repositories

In Microsoft 365, I usually start by locating CUI and then proving who touched it, how it moved, and whether controls worked around it.

• In Microsoft Purview Content Search, I might search for terms such as “CUI”, contract numbers, export control markings, program codes, or sensitivity label names across Exchange, SharePoint, Teams, and OneDrive for a fixed date range.
• In Microsoft 365 audit logs, I often look for file access, download, share, delete, label change, mailbox access, and permission change events tied to a named user, a privileged account, or a CUI-related site.
• In Entra ID, formerly Azure AD, I search sign-in logs for failed MFA, Conditional Access failures, guest access, risky sign-ins, and role assignments during the assessment window.
• In SharePoint and OneDrive, I look for external sharing activity, anonymous links, site permission changes, and access to known CUI libraries.

These queries support access control, audit logging, identification and authentication, and data handling objectives. They also show whether your Secure Cloud Architecture and Cloud Management practices match your written rules.

Endpoint management, ticketing, and SIEM

Endpoints tell the truth fast. If a device is out of policy, the logs usually show it before the documents do.

• In Intune, Configuration Manager, Jamf, or a similar tool, I search for in-scope devices missing disk encryption, inactive EDR, stale check-ins, local admin exceptions, failed compliance policies, or drift from the device baseline.
• In an endpoint console, I search for anti-malware disabled events, tamper protection changes, isolation events, USB use on restricted devices, and devices that missed recent signature or sensor updates.
• In ticketing, I search for access approvals, offboarding tickets, patch exceptions, baseline change requests, incident response records, and closure evidence tied to the same users or devices in the logs.
• In a SIEM such as Microsoft Sentinel or Splunk, I search for repeated failed logons, after-hours privileged access, security agent disablement, suspicious file activity, and alerts closed without documented analysis.

This is where Endpoint Security and Device Hardening show up as real operating practice, not marketing language. Strong Cybersecurity Services leave evidence trails. Weak ones leave meetings and screenshots.

HR, training records, and vulnerability tools

People records matter because Level 2 is not just a tooling exercise. Training, access changes, and remediation discipline all leave evidence that assessors expect to see.

• In an LMS or HR platform, I search for current users with overdue security training, completion records for users with CUI access, and signed policy acknowledgments during onboarding and annual refresh cycles.
• In a vulnerability platform such as Qualys, Tenable, Rapid7, or Nessus-based reporting, I search for critical findings older than your remediation target, assets that missed the last scan, exploitable issues on in-scope systems, and open items assigned to no owner.
• In file repositories, I search for current versions of policies, standards, baselines, SSP updates, POA&M entries, and evidence indexes with revision dates and approval history.

I treat those examples as illustrative, not universal. Your environment, retention settings, naming rules, and assessment scope will change the final query set.

How I tailor a search pack to the environment

Before I build any query pack, I line it up with the current DoD guidance. The Level 2 scoping guide tells me what belongs in the boundary, while the assessment guide tells me what the assessor needs to verify. I then map each planned search to a NIST SP 800-171 objective, an owner, a data source, and a date range.

I see the toughest gaps in Small Business IT. Cloud Infrastructure, Office 365 Migration, and older Data Center Technology often coexist, so the evidence trail crosses cloud tenants, domain systems, firewalls, and file shares. Some firms also support Restaurant POS Support or Kitchen Technology Solutions on segmented networks, which adds vendor access, patch windows, and extra logging sources to the boundary.

That mix affects Endpoint Security, Device Hardening, and Business Continuity & Security evidence. It also changes who owns the artifacts. A team may have one admin for Entra, another for backup logs, and an outside provider for EDR or SIEM.

For companies investing in Innovative IT Solutions, Tailored Technology Services, or broader Digital Transformation, documentation has to keep pace with change. Good Cloud Management, Infrastructure Optimization, and Secure Cloud Architecture create usable records when ownership is clear. Managed IT for Small Business works best when a Business Technology Partner ties Technology Consulting to an IT Strategy for SMBs and names who pulls, reviews, stores, and approves each artifact. If you want a short outside refresher, ND-ISAC’s Level 2 overview is a useful supplement to the DoD materials.

Conclusion

A strong Level 2 evidence package is not a folder full of exports. It is a set of records that I can trace back to scope, control intent, system ownership, and a clear time window.

When my search queries match the environment and the assessment objective, the audit gets simpler. That is the core of audit-ready evidence. It gives the assessor less to interpret and gives your team a cleaner path to prove the security work you already do.