CMMC Annual Affirmation in SPRS: A Senior Official’s Guide
A CMMC Level 2 assessment can show strong controls on paper, yet an unsupported annual affirmation can still create contract risk. For senior officials, the CMMC annual affirmation is a…
CMMC Physical Security Checklist for Small Contractors
A locked office door is not enough to prove CMMC Level 2 compliance. I regularly see small contractors protect their space reasonably well, yet struggle to show who had access,…
CUI in CAD Systems: A Practical CMMC Scoping Guide
A CAD file can carry Controlled Unclassified Information long after it leaves the engineering workstation. A drawing may sit in a PDM vault, move through Microsoft 365, appear in a…
Entra ID Password Protection for CMMC Level 2
Weak passwords still break strong environments. When I help a team prepare for Entra ID password protection in a CMMC Level 2 context, I start with one plain fact: Microsoft…
CMMC Level 2 Device Risk in Entra Conditional Access
A stolen password should not open the door to Controlled Unclassified Information. When I help teams build CMMC conditional access controls, I want identity, device health, and audit evidence to…
Purview Endpoint DLP for CUI and CMMC Level 2
Most CUI doesn’t leak through a dramatic breach. It leaves through ordinary user actions on an endpoint, a USB copy, a browser upload, a print job, or a quick paste…
CMMC L2 Secure Boot and TPM Evidence in Intune
A device can look healthy in Intune and still leave you short on audit evidence. I see that gap often with Intune Secure Boot and TPM evidence, because admins trust…
CMMC Teams Recording Policy for CUI in Microsoft 365
One Teams recording can turn a normal project call into a CUI handling event. I see that happen most often when a meeting starts as routine collaboration and ends with…
DFARS 252.204-7012 for Microsoft 365 Contractors
Buying Microsoft 365 doesn’t settle DFARS 252.204-7012. I see many contractors assume the license, the cloud brand, or a secure-looking dashboard means the requirement is covered. It isn’t. The clause…
Microsoft Forms Governance for Teams Handling CUI
A form looks harmless until it collects CUI. Once that happens, convenience stops mattering and control takes over. When I set Microsoft Forms governance for teams that handle controlled unclassified…