Blog
What should a defense contractor know before the assessor arrives?
What the regulations actually say, in plain terms. Each article answers one question a small defense contractor asks us, and points to the engagement that covers it.
Which articles are available?
NEWEST FIRSTHow to Scope a CUI Enclave: GCC High, AVD, Boundary
How to scope a CUI enclave for CMMC Level 2: drawing the boundary, where GCC High and Azure Virtual Desktop fit, and what the scope document holds.
Insider Threat Programs and User Activity Monitoring
What an insider threat program contains, how user activity monitoring works, and which NIST SP 800-53 controls apply, including PM-12 and the AU family.
ITAR Technical Data and NIST SP 800-171
How ITAR technical data and NIST SP 800-171 overlap for defense contractors, what DFARS 7012 adds, and how the 22 CFR 120.54 encryption carve out works.
RMF and ATO for Federal Systems Explained
How the Risk Management Framework and an Authority to Operate work for federal systems, using NIST SP 800-37, NIST SP 800-53 and CNSSI 1253.
SSP vs POA&M: What a CMMC Assessor Reads First
The difference between a System Security Plan and a POA&M, what a CMMC assessor reads first, and how to write both so they hold up in an assessment.
The 110 NIST SP 800-171 Requirements by Family
The 110 NIST SP 800-171 Rev 2 requirements explained family by family, with the count in each of the 14 families and what each family asks of a contractor.
What a Fractional CISO Does for a Defense Contractor
What a fractional CISO does for a small defense contractor: owning the security program, leading CMMC work, directing vendors and briefing leadership.
What CMMC Level 2 Requires in 2026
What CMMC Level 2 requires of a defense contractor in 2026, what DoD suspended on July 13, and which obligations still apply today.
Ready to talk it through?
BOOK A CALLPick a time for a 30 minute call with the practice.
What happens in 30 minutes
- We learn about your company, the contracts you hold or are bidding on, and what is driving your timeline.
- We talk through where you stand and which engagement fits, if any does.
- If there is a fit, we follow up with a written scope. No slides.