Putting CUI in the Cloud: The FedRAMP Moderate Question
Put CUI in the cloud and DFARS 252.204-7012 adds a requirement most contractors miss: FedRAMP Moderate (or equivalent). Here is what that means.
ReadGuides & checklists
Practical, step-by-step guidance — CMMC readiness, CUI boundary, SSP & POA&M, and cost planning.
CMMC Level 2 readiness: the first three moves
Before you buy tools or write policy, three moves de-risk a CMMC Level 2 assessment: scope your CUI, stand up your SSP, and start collecting evidence continuously.
ReadExternal Service Providers and the Shared-Responsibility Matrix
Your cloud and managed providers can carry part of your CMMC load - but only if you document who does what. Meet the shared-responsibility matrix.
ReadYour CUI boundary, in plain English
The CUI boundary is the line around everything that touches your controlled information — and it drives your entire CMMC cost. Here is how to draw a defensible one.
ReadSSP and POA&M: what each does, and why assessors read them first
Two documents anchor every CMMC program. The SSP says how you meet each control; the POA&M says what is not done yet and when it will be. Here is how they work together.
ReadFIPS-Validated vs 'Encrypted': The CUI Distinction That Trips Assessments
For CUI, 'we encrypt it' is not the requirement - FIPS-validated cryptography is. The distinction trips up more assessments than almost anything.
ReadMSP vs MSSP vs vCISO: Who Does What for CMMC
MSP, MSSP, vCISO - three roles that sound alike and do very different things for your CMMC program. Here is how to tell them apart.
ReadCUI Marking Basics
Mislabeled CUI is a problem before an attacker ever shows up. The essentials of marking Controlled Unclassified Information correctly.
ReadIncident Response Under CMMC (3.6): Beyond the Written Plan
Having an incident response plan isn't the same as being able to execute one. What the 3.6 family requires, and why the 72-hour clock matters.
ReadPOA&M Do's and Don'ts for CMMC Level 2
A Plan of Action & Milestones can save your assessment - or sink it. The rules for using one well at Level 2.
ReadAccess Control and MFA Under NIST SP 800-171
Access control is the largest family in 800-171, and MFA is where many programs stall. A practical look at what these controls require.
ReadYour SPRS Score, Explained
The number in SPRS is often the first thing a contracting officer sees. Here's how it's calculated and what a realistic score looks like.
ReadDFARS Flow-Down: 7012, 7019, 7020, and 7021
The four DFARS clauses that drive CUI and CMMC obligations - what each requires, and how they flow down to subcontractors.
ReadNIST SP 800-171 and CMMC: How They Fit Together
CMMC didn't replace NIST SP 800-171 - it put teeth on it. Here's the relationship, in plain terms.
ReadHow to Choose a C3PAO
Your assessor isn't your consultant - and shouldn't be. What to look for when selecting a C3PAO for your CMMC Level 2 assessment.
ReadCMMC's Three Levels, Explained
Level 1, 2, or 3? A plain-English guide to what each CMMC level requires, who needs which, and how the assessment differs.
ReadNo matches for your search.