Cybersecurity Maturity Model Certification for the Defense Industrial Base. NIST SP 800-171, CUI protection, and SPRS scoring.
The most counterintuitive finding I see in compliance reviews is a marking error caused by marking too much, not too little. Most Controlled Unclassified Information marking guidance tells you to add the banner and portion...
Read the Guide
Updated July 30, 2026: On July 13, 2026 the Department of War suspended CMMC Phase II, which had been scheduled for November 10, 2026. Phase I self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev 2,...
Read the Guide
The defense contractor's general counsel forwards two documents on a Tuesday morning. The first is the new DoD contract referencing Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7021, the Cybersecurity Maturity Model Certification (CMMC) clause. The...
Read the Guide
Updated July 30, 2026: On July 13, 2026 the Department of War suspended CMMC Phase II, which had been scheduled for November 10, 2026. Phase I self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev 2,...
Read the Guide
What is your Supplier Performance Risk System (SPRS) score right now? Not the score you submitted. The score that reflects your actual implementation status today, measured against the 110 controls in NIST SP 800-171 Rev...
Read the Guide
The following is an illustrative composite drawn from current CMMC assessment market conditions. Contractor A had 340 workstations, four office locations, a shared IT environment spanning HR, finance, and engineering, and a standard enterprise network...
Read the GuideOne compliance analysis per week from Josef Kamara, CPA, CISSP, CISA. Federal and private compliance, written for practitioners.