CMMC

Old screenshots, stale policies, and inactive accounts can weaken an otherwise sound CMMC program. When preparing for an assessment, I treat CMMC assessment evidence as proof of how your environment…

A CMMC assessment day can expose gaps that felt minor during preparation. A missing policy approval, unclear employee answer, or unavailable system owner can turn a solid security program into…

A retired laptop can still carry contract data long after its last login. The same is true for USB drives, copier storage, failed SSDs, and old mobile devices placed in…

Most small contractors in the Defense Industrial Base do not fall behind on their requirements because they lack concern. They fall behind because it is often difficult to clearly show…

A suspected compromise involving Controlled Unclassified Information can put a defense contractor on a clock before the facts are complete. I tell clients to treat the first alert as a…

A CMMC assessor can’t give credit for a practice that lives only in a manager’s memory. For contractors handling CUI, CMMC personnel screening needs clear proof that people were reviewed…

A mistake in handling Controlled Unclassified Information (CUI) can expose sensitive government data, create significant audit gaps, and confuse employees who need clear handling instructions. Under the Cybersecurity Maturity Model…

A prime contractor can have strong CMMC controls and still create risk through one poorly scoped subcontract. If controlled unclassified information crosses that subcontractor’s boundary, the prime needs proof that…

Encryption can be active across your environment and still fail an assessment if you cannot prove where it protects CUI, which module provides it, and how your team manages it.…