Tag
CMMC
12 articles
Compliance frameworks
CMMC and cloud services: FedRAMP equivalency
When a cloud service holding CUI must be FedRAMP Moderate authorized or equivalent, what equivalency requires, and what to collect from your provider.
6 min read
Compliance frameworks
FCI vs CUI: what CMMC protects
The definitions of Federal Contract Information and Controlled Unclassified Information, how marking works, and why the difference sets your CMMC level.
6 min read
Compliance frameworks
CMMC for subcontractors in the defense supply chain
How CMMC reaches subcontractors through flow-down, why the level you need follows the information you receive, and what to settle with your prime first.
5 min read
Compliance frameworks
Preparing for a CMMC assessment
A practical order of work for CMMC assessment prep: fix scope, assemble what the assessor reads first, build evidence per objective, and rehearse the room.
6 min read
Compliance frameworks
CMMC Level 2: self-assessment vs C3PAO assessment
Who decides which CMMC Level 2 assessment you face, what stays identical between a self-assessment and a C3PAO assessment, and where the two diverge.
6 min read
Compliance frameworks
CMMC levels, explained
What CMMC Levels 1, 2 and 3 require, which information each protects, how each is assessed and affirmed, and how to tell which level your contract needs.
6 min read
Compliance frameworks
The SPRS score, explained
How the NIST 800-171 SPRS score is calculated from 110 down, what Basic, Medium and High assessments mean, what you post, and how to keep the score honest.
6 min read
Compliance frameworks
Writing a POA&M that assessors accept
The fields a plan of action and milestones needs, how to write milestones an assessor believes, and what a POA&M cannot do under DoD scoring and CMMC.
6 min read
Compliance frameworks
The NIST 800-171 System Security Plan
What a NIST 800-171 system security plan must describe, a structure that works for assessors, and how to keep the plan accurate after the assessment.
6 min read
Compliance frameworks
NIST 800-171 Revision 2 vs Revision 3
What changed between NIST SP 800-171 Rev. 2 and Rev. 3, which revision your contract likely requires, and how to prepare for Rev. 3 without wasted work.
6 min read
Compliance frameworks
Scoping where CUI lives in your environment
How to trace where CUI enters and moves, sort assets into the CMMC scoping categories, choose between an enclave and the enterprise, and document the result.
6 min read
Compliance frameworks
NIST 800-171: protecting CUI in practice
What NIST SP 800-171 requires of contractors holding CUI, the requirements that take the most work, and the DFARS obligations that sit alongside them.
6 min read