CMMC Personnel Security: The Two PS Controls That Fail on the HR-to-IT Handoff
The two CMMC personnel security PS controls, screening and termination, and the five HR-to-IT handoff failures that get them marked NOT MET.
Blog
Articles about cmmc level 2 readiness compliance requirements, frameworks, and audit preparation.
CMMC Asset Categories: How to Sort CUI Assets, CRMAs, and Specialized Assets
How to sort every asset into the five CMMC asset categories: CUI Assets, Security Protection Assets, CRMAs, Specialized, and out-of-scope.
CMMC Phase 2 Is Suspended: What Still Legally Binds You and What Doesn't
DoD suspended CMMC Phase 2 on July 13, 2026. What still applies: Phase 1 SPRS checks, self-assessments, affirmations, and DFARS 7012.
CMMC Boundary Protection Failures: 6 SC-Control Mistakes That Get Flagged at Assessment
Six System and Communications Protection (SC) mistakes that fail CMMC assessments: weak boundaries, permit-by-default rules, and non-FIPS encryption.
CMMC Maintenance (MA): The 6 Controls Behind Maintenance Logs, Remote Sessions, and Equipment Sanitization
The 6 CMMC Maintenance (MA) controls explained: maintenance logs, tool and personnel control, MFA for remote sessions, equipment sanitization, escorts.
DFARS 7012 and 7021: The Contract Clauses That Trigger CMMC Requirements
DFARS 252.204-7012 and 7021 explained: what each clause requires, how they differ, and what receiving 7021 in a contract actually means.
The 14 CMMC Domains Explained: What Each Family Covers and Why It Matters
The 14 CMMC control families explained: requirement counts, SPRS point exposure, which domains fail most in C3PAO assessments, and where to focus first.
CMMC Encryption Requirements: FIPS 140-2 Validation and What It Means for Your Systems
CMMC Level 2 requires FIPS-validated cryptographic modules, not just AES-256. Which SC controls apply, where validation is required, and how to verify.
CMMC MFA Requirements: Where Multi-Factor Authentication Is Required and How to Implement It
CMMC Level 2 MFA requirements: which accounts need it, why SMS fails the replay-resistance test, and what authentication methods qualify under IA.L2-3.5.3.
CMMC Incident Response Plan Requirements: The Three Controls and Why Testing Is Where Teams Fail
CMMC incident response plan requirements explained: the three IR controls, the 72-hour DFARS reporting rule, and why testing is where teams fail.
9 CMMC Myths That Could Cost Your Small Business Its DoD Contracts
9 CMMC myths that trip up small defense contractors, from 'we're too small' to 'we'll pass the C3PAO' — and what each misconception actually costs.
CMMC Network Segmentation: How to Build a CUI Enclave That Holds Up Under Assessment
CMMC network segmentation done right: how to build a CUI enclave that reduces scope and survives a C3PAO assessment — and why a VLAN isn't enough.
CMMC for Manufacturers: The 40-70 Gap Reality and How to Close It
CMMC compliance for manufacturers: why small shops start with 40-70 NIST 800-171 gaps and the scoping, enclave, and SSP moves that close them.
CMMC Annual Affirmation: Who Signs, When It's Due, and the False Claims Act Risk Behind It
CMMC annual affirmation explained: who signs as affirming official, when it is due each year, and the False Claims Act risk behind the signature.
CMMC Audit and Accountability Requirements: 7 Logging Mistakes That Fail Assessments
CMMC Audit and Accountability requirements: seven logging mistakes in the AU control family that fail assessments, and how to fix each one.
CMMC vs ISO 27001: How Much of Your Certification Actually Carries Over
CMMC vs ISO 27001: what an existing ISO 27001 certification covers toward CMMC Level 2, where it leaves gaps, and how to plan the crossover.
CMMC and the Cloud: How the Customer Responsibility Matrix Decides Which Controls You Still Own
How the Customer Responsibility Matrix splits CMMC controls between you and your cloud, plus FedRAMP Moderate vs equivalency for holding CUI.
CMMC Phase 2 Starts November 10, 2026: A Month-by-Month Plan to Be Ready in Time
CMMC Phase 2 requires C3PAO certification after Nov 10, 2026. A month-by-month plan to prepare, and what to do if the deadline is too close.
CMMC System Security Plan: What Assessors Look For and What Most Companies Get Wrong
What CMMC assessors look for in your System Security Plan, and the 8 SSP mistakes that turn a Level 2 assessment into a stack of findings.
CMMC Configuration Management: Baselines, Least Functionality, and the CM Controls That Trip Up Small Teams
The CMMC Configuration Management family: baselines, change control, least functionality, and the CM controls that trip up small defense contractors.
CMMC and Your MSP: When an External Service Provider Falls Inside Your Assessment Scope
Does your MSP or external service provider fall inside your CMMC assessment scope? Three factors decide it, including who handles Security Protection Data.
Your SPRS Score Is Below 88: How to Read the Number and Decide What to Fix First
Your SPRS score is below 88? That blocks conditional CMMC status and POA&Ms. How to read the number and sequence remediation to cross the 88-point line.
FedRAMP Moderate vs FedRAMP Equivalency: What Your Cloud Needs Before It Can Hold CUI
FedRAMP Authorized vs Moderate Equivalency for cloud holding CUI: what each path requires under CMMC, who holds the evidence, and which fits your contract.
CMMC Flow-Down: What Primes Must Pass to Subcontractors and How to Respond When You Get the Email
Got a CMMC flow-down email from your prime? How to tell which level you need, what the prime owes you, and how to respond as a subcontractor.
CMMC Media Protection: Marking, Storing, and Sanitizing CUI Media Without Failing the MP Controls
CMMC media protection at Level 2: the 9 MP controls, CUI marking and sanitization rules people get wrong, and the evidence assessors ask for.
CMMC Risk Assessment and Vulnerability Scanning: The RA Controls and How Often You Really Need to Scan
CMMC risk assessment and vulnerability scanning: the three RA controls, how often you really need to scan, and the evidence assessors expect at Level 2.
CMMC Physical Protection: The 6 PE Controls and the One That Covers Remote Workers
CMMC physical protection requirements: the 6 PE controls and the alternate-work-site rule (3.10.6) that puts remote workers' home offices in scope.
CMMC Security Awareness Training: The 3 AT Controls and the Insider-Threat Piece Most Teams Miss
CMMC security awareness training: the 3 AT controls, the insider-threat piece most teams miss, and what assessors ask your staff to prove it.
CMMC System and Information Integrity (SI): The 7 Controls Behind Flaw Remediation and Malware Defense
CMMC System and Information Integrity: the 7 SI controls for flaw remediation, malware defense, and monitoring, and how SI chains to RA and CM.
How to Submit Your SPRS Score to the DISA Portal: A Step-by-Step Guide for the Level 2 Self-Assessment
How to submit your NIST 800-171 self-assessment score to SPRS via the DISA portal: PIEE roles, assessment entry, and the senior-official affirmation.
The Controls That Fail Most CMMC Assessments: Access Control, Audit Logs, and Documentation
The controls that cause most CMMC assessment failures: SPRS point values, root causes, and how to prove implementation before the C3PAO arrives.
CMMC Evidence Package: The Documentation Requirements Assessors Actually Evaluate
What your CMMC evidence package needs to pass C3PAO assessment: documentation types, recency requirements, and what assessors reject.
CMMC Scoping: How an Enclave Strategy Can Cut Your Compliance Costs in Half
A CUI enclave can cut CMMC assessment scope 50-70%. Decision tree with three factors that determine whether an enclave fits your operations.
CMMC Access Control: The 22 Requirements That Produce the Most Assessment Failures
CMMC Level 2 access control has 22 requirements and produces the most C3PAO findings. Six failures account for 70-80%, with remediation steps.
CMMC POA&M Rules: Which Controls Qualify, the 180-Day Window, and the 88-Point Minimum
POA&Ms cover only 1-point CMMC controls when your SPRS score is 88+, and items must close within 180 days. Worked example with eligibility rules.
NIST 800-171 Rev 2 vs Rev 3: What Changed and Why CMMC Still Uses Rev 2
Rev 3 has 97 controls and 422 objectives. CMMC stays on Rev 2 via DoD class deviation. Side-by-side comparison and Rev 3 prep guidance.
CMMC Audit Preparation Checklist: 90-Day, 6-Month, and 12-Month Plans by Starting Maturity
Timeline-aware CMMC audit prep: 12-18 month, 6-12 month, and 90-day plans. Evidence checklist + the 5 mistakes that fail C3PAO assessments.
CMMC Level 1 vs Level 2: How to Tell Which Your DoD Contract Requires
Level 1 protects FCI with 17 controls; Level 2 protects CUI with 110. How to tell which CMMC level your DoD contract actually requires.
How Long Does CMMC Certification Take? 12-18 Months by Starting Maturity
How long does CMMC certification take? 12-18 months from kickoff for most defense contractors. Phase-by-phase timeline by starting maturity.
Free CMMC Readiness Quiz Online: What an SPRS Score Estimate Actually Tells You
A free CMMC readiness quiz online estimates your SPRS score in 15 minutes. What it can and can't tell you about C3PAO assessment readiness.
CMMC for Subcontractors: Why Being Small Doesn't Exempt You From Level 2
CMMC for subcontractors: small defense companies still face all 110 controls when they handle CUI. Flow-down rules, scope strategy, and real costs.
CMMC System Security Plan (SSP): What Assessors Look For Beyond the Template
CMMC system security plan (SSP) templates fail when narratives stay generic. Here is what assessors look for, the structure, and the common failures.
What to Expect During a CMMC C3PAO Assessment: A Day-by-Day Walkthrough
What to expect during a CMMC C3PAO assessment: pre-assessment, the 5-day on-site week (Examine, Interview, Test), and the post-assessment report.
CMMC Timeline 2026: What Phase 2 Enforcement Means for DoD Contractors
CMMC timeline 2026: Phase 2 enforcement begins November 10, 2026. The four phases, what each triggers, and a realistic prep track at each stage.
CMMC Level 2 Self-Assessment vs C3PAO: Which Path Your Contract Requires
Self-assessment or C3PAO? Your DFARS clauses determine the path. Compare cost, timeline, and verification requirements for both CMMC Level 2 paths.
SPRS Score Calculator: Estimate Your NIST 800-171 Score Before Submitting to DISA
Calculate your SPRS score before submitting to DISA. Worked example with NIST 800-171 point values, the 88 threshold, and POA&M eligibility rules.
CMMC Level 2 Requirements: The 110 Controls Your DoD Contract Depends On
CMMC Level 2 requires 110 controls from NIST 800-171 Rev 2. Use this per-domain checklist to map gaps before your gap analysis or SPRS submission.
CUI vs FCI: How to Determine Which CMMC Level Your Organization Needs
CUI vs FCI: how to determine which CMMC level your DoD contracts require. Decision steps, contract clause guide, and what each level costs.
CMMC Gap Analysis: The Step-by-Step Process Before You Hire a Consultant
CMMC gap analysis step by step: scope CUI, assess all 110 controls, calculate your SPRS score, and build a prioritized remediation plan.
CMMC Compliance Costs for Small Businesses: What the $138K-$285K Range Actually Covers
CMMC compliance costs for small defense contractors: what the $138K-$285K range covers, worked cost example, and how scope reduction cuts the bill.
Find your compliance gaps
Free gap assessment with actionable findings, prioritized by risk. Get your report in minutes.
Start your assessment