If your CMMC Level 2 plan lives in people’s heads, your audit will feel like a fire drill. I’ve watched small and mid-sized defense contractors spend weeks hunting for screenshots,…
Scope creep in CMMC Level 2 scoping usually doesn’t happen because people are careless. It happens because CUI shows up in normal work, email threads, shared drives, Teams chats, ticketing…
If you’re chasing CMMC Level 2, you already know the ugly truth: phishing is still the easiest way into a DoD contractor. Attackers don’t need zero-days when they can steal…
Microsoft Teams can feel like a conference room, a file cabinet, and a phone system all in one. That’s great for speed, but it’s also how Controlled Unclassified Information (CUI)…
If you’re preparing for CMMC Level 2, BitLocker is one of those controls that sounds simple until the assessor asks, “Show me proof.” The goal isn’t just turning on encryption,…
When an assessor asks, “Show me your proof,” they’re not asking if you meant to encrypt laptops. They want evidence that encryption is on, it stays on, and it covers…
CMMC POA&M for Level 2: How I Write It, Age It, and Avoid Assessor Flags (Template Included) If you’re heading into a CMMC Level 2 assessment, your CMMC POA&M can…
How many “temporary” accounts are still active in your tenant right now? If you handle CUI, that question isn’t academic. Under CMMC user provisioning expectations, every account needs a clear…
If you’re a small defense contractor, your CMMC SSP template can’t read like a policy brochure. It has to read like a map. A map of where CUI lives, who…
If you’re chasing CMMC Level 2, the fastest way to blow your schedule (and your budget) is to scope Microsoft 365 the wrong way. I see it all the time:…
