CMMC POA&M for Level 2: How I Write It, Age It, and Avoid Assessor Flags (Template Included) If you’re heading into a CMMC Level 2 assessment, your CMMC POA&M can…
When an assessor asks, “Show me your proof,” they’re not asking if you meant to encrypt laptops. They want evidence that encryption is on, it stays on, and it covers…
How many “temporary” accounts are still active in your tenant right now? If you handle CUI, that question isn’t academic. Under CMMC user provisioning expectations, every account needs a clear…
If you’re a small defense contractor, your CMMC SSP template can’t read like a policy brochure. It has to read like a map. A map of where CUI lives, who…
If you’re chasing CMMC Level 2, the fastest way to blow your schedule (and your budget) is to scope Microsoft 365 the wrong way. I see it all the time:…
If I’m walking into a CMMC assessment, I don’t want my patching story to sound like “we try our best.” I want it to sound like a process with clear…
If you’re handling CUI in Microsoft 365, you don’t get to treat retention and holds like a “set it once” task. Under CMMC Level 2, I’ve found auditors and incident…
Email forwarding looks harmless until it isn’t. One inbox rule can copy Controlled Unclassified Information (CUI) to a personal mailbox, a vendor, or a compromised account. In March 2026, I…
If you handle CUI, your people can’t be the weak link. They’re also your best defense. A good CMMC Level 2 training plan turns everyday habits (how staff log in,…
If you administer Microsoft 365 or servers for a defense contractor, you already know the weak spot: admin credentials. One phish, one token theft, one reused browser session, and an…
