Cyber Security
A 90-Day Cybersecurity Maturity Model Certification Readiness Plan for Small Contractors
Most small contractors in the Defense Industrial Base do not fall behind on their requirements because they lack concern. They fall behind because it is often difficult to clearly show…
CMMC Incident Reporting: A 72-Hour Contractor Checklist
A suspected compromise involving Controlled Unclassified Information can put a defense contractor on a clock before the facts are complete. I tell clients to treat the first alert as a…
How I Approve SaaS Tools for CUI Compliance
A SaaS tool can create a serious compliance gap long before anyone uploads a contract drawing or technical specification. A project manager may invite an outside collaborator, sync a folder…
CMMC Personnel Screening Evidence Small Contractors Need
A CMMC assessor can’t give credit for a practice that lives only in a manager’s memory. For contractors handling CUI, CMMC personnel screening needs clear proof that people were reviewed…
CMMC CUI Marking Template for CMMC Level 2 Contractors
A mistake in handling Controlled Unclassified Information (CUI) can expose sensitive government data, create significant audit gaps, and confuse employees who need clear handling instructions. Under the Cybersecurity Maturity Model…
CMMC Level 2 Subcontractor Flowdown Checklist
A prime contractor can have strong CMMC controls and still create risk through one poorly scoped subcontract. If controlled unclassified information crosses that subcontractor’s boundary, the prime needs proof that…
CMMC Level 2 Encryption Evidence Checklist
Encryption can be active across your environment and still fail an assessment if you cannot prove where it protects CUI, which module provides it, and how your team manages it.…
CMMC Annual Affirmation in SPRS: A Senior Official’s Guide
A CMMC Level 2 assessment can show strong controls on paper, yet an unsupported annual affirmation can still create contract risk. For senior officials, the CMMC annual affirmation is a…
CMMC Physical Security Checklist for Small Contractors
A locked office door is not enough to prove CMMC Level 2 compliance. I regularly see small contractors protect their space reasonably well, yet struggle to show who had access,…
CUI in CAD Systems: A Practical CMMC Scoping Guide
A CAD file can carry Controlled Unclassified Information long after it leaves the engineering workstation. A drawing may sit in a PDM vault, move through Microsoft 365, appear in a…
Entra ID Password Protection for CMMC Level 2
Weak passwords still break strong environments. When I help a team prepare for Entra ID password protection in a CMMC Level 2 context, I start with one plain fact: Microsoft…
CMMC Level 2 Device Risk in Entra Conditional Access
A stolen password should not open the door to Controlled Unclassified Information. When I help teams build CMMC conditional access controls, I want identity, device health, and audit evidence to…