AI Offense Is Eating Our Lunch
AI-powered offensive agents are moving cyberattacks from human speed to machine speed. Defenders need AI agents of their own.
Read the Post →
CMMC ‘Significant Changes’: What Does the Rule Actually Say?
CMMC significant change is never defined in the rule. See what 32 CFR 170 and DFARS 7021 say and who decides when a new assessment is required.
Read the Post →
CMMC After the Pause: What 30 Days of DoW Solicitations Actually Tell Us
The CMMC Level 2 pause did not end cybersecurity requirements. Thirty days of DoW solicitations show what buying activities still require, and when.
Read the Post →
CMMC Level 2 Requirements for Mid-Size Contractors
CMMC Level 2 requirements, explained for the mid-size DIB contractor actually facing them: what NIST SP 800-171 requires and why it matters.
Read the Post →
CMMC Advisor vs. Consultant vs. C3PAO: Know the Difference
CMMC advisor, consultant, or C3PAO? The roles sound interchangeable but only one can certify you. Here is the boundary that actually protects you.
Read the Post →
The System Security Plan (SSP): What Belongs in One
A System Security Plan (SSP) under NIST 800-171 anchors roughly 70% of your CMMC compliance program. Here is what actually has to be in one.
Read the Post →
CMMC Mock Assessment: Train Like You Fight
A CMMC Mock Assessment rehearses your Level 2 assessment against the real 320 objectives, so gaps surface in our conference room, not the C3PAO’s.
Read the Post →
Can You Mail CUI? What 32 CFR 2002.14(d) Actually Says
You can hard-copy mail CUI. The regulation is simpler than many people expect: protect the contents, address the package correctly, and check the handling requirements.
Read the Post →
CMMC compliance is a program, not a project.
A project has a finish line. A program has a Watch Bill, a Logbook, and a relief who shows up on schedule to take the next shift. That distinction sounds academic until the recertification clock starts running.
Read the Post →
What CMMC Actually Requires (and Why Most Aren’t Ready)
CMMC requirements start in one place, and it is not where most contractors expect. Before you touch a tool, a policy template, or a vendor pitch, you have to answer a single question.
Read the Post →
What Is CUI? A Plain-English Definition for DoD Contractors
Controlled Unclassified Information has one real definition, and it comes from a single regulation: 32 CFR 2002.4(h). Almost every mistake contractors make about CUI comes from skipping a word in it.
Read the Post →
CMMC-as-a-Service and Why We Don’t Call Midwatch an MSP
Midwatch is purpose-built for CMMC. It is not a managed-services play with a CMMC label retrofitted onto it. That distinction sounds like marketing until an assessor actually looks at the environment.
Read the Post →
Temporary Deficiencies, Enduring Exceptions, and Operational Plans of Action: What are they and why do I care?
All three concepts are defined in the CMMC rule, and represent expansions and clarifications of short entries in NIST 800-171. They have not been discussed much in the professional public dialogue, and I suspect that…
Read the Post →
When Do I Get The Points? Understanding SPRS Scoring in 2026
Many companies in the Defense Industrial Base (DIB) are working to update their SPRS score. Traditionally, this has been a simple exercise: conduct a self-assessment, calculate the score, upload it to SPRS, and move…
Read the Post →
🎃 When the Agent Tried to Escape: A Halloween Tale of Rogue AI Logic
🧪 The Experiment Begins It started as a controlled late-night test of CrewAI and LangChain — a proof-of-concept for how autonomous AI agents could assist in applied research and compliance automation. Each agent was…
Read the Post →
The Challenge of Documentation: CMMC 2.0
A long-time requirement for any auditable process or standard has been documentation. It makes you wonder if early cave paintings quickly moved from art to “documenting your hunting process” for future audits. Perhaps…
Read the Post →
When do I need CUI banners for CMMC?
In order to answer this question, let’s examine the regulatory security requirements that may drive the need for CUI banners. First, we will discuss electronic systems and then move on to physical.Security requirements…
Read the Post →
SPA, ESP, CSP - What's the Difference, and Why it Matters
In practice, SPA/CSP/ESP split important hairs and are often confused. Each label has crucially specific connotations for CMMC assessments.
Read the Post →
Thoughts on CMMC Assessment Readiness
“Most companies think they’re ready. They are not. CMMC is brutal, and the sooner businesses accept that, the better chance they have of passing their first real assessment."I have been saying this for a while but have…
Read the Post →
How to Simplify the PIEE Recipe
According to the DoD, uploading a NIST self-assessment score is supposed to be as easy as an easy-bake pie. If you are a prime already doing business with the federal government, it might just be as easy as popping that…
Read the Post →
CMMC and Contract Negotiation
CMMC is an enterprise challenge — not just an IT challenge...this blog focuses on efforts required to negotiate contract specificity and...
Read the Post →
CMMC: Compliance Mt. Everest
I would assert that CMMC is by far the most challenging cybersecurity assessment methodology ever; the federal compliance Mt. Everest.
Read the Post →
When do I get the points?
Many companies today are working to update their SPRS score. The standard model for this is to conduct an assessment, assign a score, upload the score, and move on.However, for companies building a CMMC compliance…
Read the Post →
What's an Evidence Locker, and why do I need one?
Well, the short answer is because you have to because they make you. Wait, evidence locker appears nowhere in the rule. You are making things up! We coined the termed, true, but call it a derived requirement. There are…
Read the Post →
32 CFR 170 Final Rule: 10 Initial Impressions
I have completed my initial skim of the 470 pages of the 32CFR170 Final Rule. I think it's a huge improvement over the proposed version.
Read the Post →
What kind of training does a L2 CMMC require?
Cybersecurity Maturity Model Certification (CMMC) includes a list of controls that dictate training requirements for relevant employees: the Awareness and Training domain. Organizations Seeking Certification (OSCs) may…
Read the Post →
Do I Need to Have a SIEM for CMMC?
The DoD is rolling out their new cybersecurity audit plan around NIST SP 800-171: Cybersecurity Maturity Model Certification, or CMMC. This means checking contractors' compliance against a very strict checklist of…
Read the Post →
The Power of Definition
This ‘power’ allows organizations to define crucial variables for themselves as they document their information security architecture.
Read the Post →
10 Cybersecurity Tips for Small Business
Tip 1. You're not too small to be a target. I once had a person in a major corporation say to me, “We are a soap and diaper company. Who would hack us?” My answer, “Everyone who wants a piece of your $85 Billion a…
Read the Post →
The Challenge of CMMC Documentation
Ah, documentation. The most beloved part of every cybersecurity and IT professional's day. If only they could have more paperwork, then their joy would finally be complete.Right? Right?Perhaps not. Many technical people…
Read the Post →
Mini Blog: CTI in a Nutshell
Controlled Technical Information (CTI) is really at the heart of what DoD wants/needs to have protected as a part of many ongoing DoD Cybersecurity efforts, including CMMC. But what really is CTI? The DoD FAQ has an…
Read the Post →
Understanding Microsoft Windows Copilot+ Recall
Microsoft's introduction of the Copilot+ Recall feature has sparked significant concern within the cybersecurity and compliance communities. While innovative for its AI-infused enhancements, Copilot+ Recall works to…
Read the Post →
COOEY Kittens!
The CMMC ecosystem has experienced a major increase in activity in 2024.This ramp-up has seen us lean on a number of new analogies when...
Read the Post →
What is Periodic?
How often should our company review our compliance with the NIST SP 800-171 security requirements?
Read the Post →
DFARS FAQ and Contractor Noncompliance
On January 27th, 2017 the DoD published the “Networking and Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-DO18) Frequently Asked Questions (FAQs) regarding the implementation of DFARS Subpart…
Read the Post →
CMMC Myths
The origin story of Cybersecurity Maturity Model Certification (CMMC) goes back more than 20 years. Having roots in 32 CFR 2002, the Homeland Security Act of 2002, and the 2010 Executive Order 13556, the standard’s…
Read the Post →
How to conduct a DoD Cyber Self-Assessment?
What the heck is this spurrrs thing people keep talking about? And why did my prime just ask us if we have one? The Supplier Performance Risk System or SPRS (pronounced spurs) is the system that “...is the authoritative…
Read the Post →
88 MPH: CMMC 2.11 Draft Rule and the DIB's Need for Speed
On 22 Dec (pre-release) or 26 Dec (official inclusion in the Federal Register) the DoD and OMB released the new Title 32CFR170 CMMC Rule. There are 234 pages in the main document alone, with more than 200 hundred pages…
Read the Post →
Be Better, Not Perfect
For Defense Industrial Base (DIB) companies, it has been a long 3 years in cybersecurity. In 2020 the DoD published the interim-final Cybersecurity Maturity Model Certification (CMMC) 1.0 rule and standards.The three…
Read the Post →
Nittany Lions and Tiger Teams - Possible Lessons from Penn State’s Brush with the False Claims Act
News of the False Claims lawsuit against Pennsylvania State University reached the CMMC landscape in August of 2023, when the 2022 legal filing became public. It is important to note that at the time of this writing…
Read the Post →
2.1
On August 4, the Office of Management Budget (OMB) released a series of documents detailing updates to the Cybersecurity Maturity Model Certification (CMMC) framework. While the documents' visit to the OMB’s website was…
Read the Post →
Alternative Control Guidance
On January 27th, 2017 the DoD published the “Networking and Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-DO18) Frequently Asked Questions (FAQs) regarding the implementation of DFARS Subpart…
Read the Post →
TikTok Ban in Effect: FAR 52.204-27 Interim Rule
Last month, the Office of Management and Budget’s (OMB’s) memorandum requiring the removal of TikTok from government devices impacted the American public for the first time. The Federal Acquisition Regulation (FAR)…
Read the Post →
Here Comes the Airplane: A Glance at the Near-Future of Cyber Rulemaking
In the wake of NIST 800-171 Revision 3, the near-future of information security has been discussed at length across the Defense Industrial Base (DIB). Published in May 2023, this revised document has already made…
Read the Post →
The First 72
On January 27th, 2017 the DoD published the “Networking and Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-DO18) Frequently Asked Questions (FAQs) regarding the implementation of DFARS Subpart…
Read the Post →
Google Workspace for the DIB?
The manufacturing and critical infrastructure sectors in the United States are under threat. In particular, Defense Industrial Base (DIB) professionals are grappling with an unprecedented combination of foreign and…
Read the Post →
The Gist of NIST SP800-171r3
Last week, the National Institute of Standards and Technology (NIST) published a draft revision of Special Publication (SP) 800-171. SP 800-171r3, “Protecting Controlled Unclassified Information in Nonfederal Systems…
Read the Post →
DoD Guidance on Control Flexibility
On January 27th, 2017 the DoD published the “Networking and Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-DO18) Frequently Asked Questions (FAQs) regarding the implementation of DFARS Subpart…
Read the Post →
CMMC Tracking: Three Pro Tips
The most current version of Cybersecurity Maturity Model Certification includes 110 practices or security requirements, also called controls. Supplier Risk Performance System (SPRS) scores are calculated based on these…
Read the Post →
Auntie Em! Auntie Em! It’s an Acronym!
The yellow brick road to Cybersecurity Maturity Model Certification (CMMC) is paved with one thing. Acronyms. In order to take your company from “a house dropped on my sister” to the ruby slippers of certification, you…
Read the Post →
Are You Late For a Very Important Date?
On January 27th, 2017 the DoD published the “Networking and Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-DO18) Frequently Asked Questions (FAQs) regarding the implementation of DFARS Subpart…
Read the Post →
I FAQ, Therefore I Am
On January 27th, 2017 the DoD published the “Networking and Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-DO18) Frequently Asked Questions (FAQs) regarding the implementation of DFARS Subpart…
Read the Post →
'Love' is a Verb. So is 'Identified.'
If you’ve ever picked up a self-help book, you may have come across the phrase “love is a verb.” This adage is designed to draw attention to the active decision-making necessary for relationships to succeed…
Read the Post →
Micro Blog - 3 Questions about POA&M
What is a POA&M and when do I need one? According to NIST SP 800-37 Rev. 2, a Plan of Actions and Milestones (POAM or POA&M) is, “A document for a system that “identifies tasks needing to be accomplished. It details…
Read the Post →
Micro Blog - 3 Questions about Potential CMMC Changes
Is the new CMMC rule going to be a draft rule or an interim final rule? While an interim final rule was originally scheduled for release in May of 2023, which would have provided the Defense Industrial Base (DIB) with…
Read the Post →
'The Fifth Risk' of Vulnerability Management
As seen on GRC Viewpoint: https://lnkd.in/dHQjaGQz. Maintaining an environment which centralizes not only the protection, but the creation of knowledge is the cornerstone of any successful vulnerability management…
Read the Post →
Microsoft Exchange Server – Two Zero Day Vulnerabilities Found
On September 29th, Microsoft announced Zero Day vulnerabilities which affect the 2013, 2016 and 2019 versions of Microsoft Exchange. Note that this does not impact customers that are using the online version of…
Read the Post →
Handling CUI
This question of U.S. ONLY and CUI comes up a lot. To be clear, although I have deep experience on the sharing of intelligence information with foreign countries, I am just another retiree. This is my take on the…
Read the Post →
DIB Contractors should start considering an Evidence Locker for CMMC
Organizations seeking certification, or OSC, in the Defense Industrial Base (DIB) should start considering the creation and maintenance of an “evidence locker” for CMMC.This is more work and I don’t like suggesting that…
Read the Post →
CMMC Rollout: Where to Next?
Several people have asked me about this one. I posted this in the NDIA forum a week or so ago to generate discussion there on the current status of CMMC. Reposted here for the broader audience. Although we might have a…
Read the Post →
Leadership in the Remote Work Environment
Today, a set of questions came across my desk from a reporter for a high-tech magazine. It piqued my interest, so I provided some input and later decided to turn the content into a blog on the topic of leadership in the…
Read the Post →
When is Encryption Enough?
Based on the LinkedIn exchanges of views on encrypted CUI and covered systems linked below, I have, as promised crafted an input to the DoD asking for clarification on whether or not a system that only contained fully…
Read the Post →
The #1 Problem in Cybersecurity: The Truth You Don’t Want to Know
The Truth You Don’t Want to KnowMy new favorite saying, and it seems to be rampant in the halls of success, but perhaps nowhere more so than in the IT arena when looking at IT security. As I cross a broad swath of…
Read the Post →
Scoping Guide
Although the new Cybersecurity Maturity Model Certification (CMMC) Scoping Guides bring much needed clarification, specific aspects of these documents threaten to severely degrade Defense Industrial Base (DIB) security…
Read the Post →
The FedRAMP System needs updating; it was never intended for commercial use
As we move forward with accountability around cyber for the Defense Industrial Base (DIB), the specific language in the rules, controls, and requirements becomes increasingly important. In the previous no-accountability…
Read the Post →
How Do We Right the CMMC Ship?
Previously I wrote CMMC Trip to Tartarus story under the banner “CMMC is impossible and here is why!” I did not receive many comments that said this assertion was incorrect. Far fewer than I thought I would in fact, and…
Read the Post →
CMMC: A Trip to Tartarus
So I normally don’t go in for the sensationalized headline. I abhor them in fact, but in this case, I think it is needed.Put the breaks on, and as Tom from Compliance Forge says, let’s talk about this one. I am really…
Read the Post →
CMMC and the Challenge of Documentation
HistoryA long-time requirement for any auditable process or standard has been documentation. I sometimes think that early cave paintings quickly moved from art to “documenting your hunting process” for future audits…
Read the Post →
Observations from a CMMC Protest paper: A plain English translation
I have put this together as a review of the paper posted by Bob Metzger’s law firm, New DOD Cyber Rules Create Fertile Bid Protest Grounds, By Lucas Hanback and Jeffery Chiow. Primarily the translation focuses on…
Read the Post →
Cyber Operations, Cyber Standards, and Solar Winds
In the course of the much appreciated exchange of ideas in a LinkedIn thread, the concept of Cyber Standards like CMMC (the new DoD Cybersecurity Maturity Model Certification), and the Solar Winds hack came up. The…
Read the Post →
CUI, DFARS, and the Catch-22
Federal Government: "Put CUI controls in place so we can give you a contract."Federal Contractors: "No. Give us the contract and tell us exactly what CUI we have, where, then we will tell you how we are doing against…
Read the Post →
Cybersecurity in an Uncertain World
For a commercial enterprise, how much cybersecurity investment needs to be determined from a risk assessment based on a number of tangible and intangible factors. How mature is our security program? How IT-enabled are…
Read the Post →
Is Your Dashboard Zombie Green?
Some years ago a good friend of mine sarcastically quipped, "Yeah that scorecard is green, Zombie Green!" It became a running joke on our team because the habit of marking everything green in that organization, even in…
Read the Post →
FAR, DFAR, and NIST 800-171; The Complexities of Compliance
The Short AnswerFor anyone who wants to skip to the end, here it is. In order to be DoD cybersecurity compliant today, you should have NIST 800-171’s 110 security controls implemented. In order to demonstrate your…
Read the Post →
What is in a Password
Passwords are ubiquitous in terms of modern information security. So much so that considering if the current password policy we have is adequate rarely occurs. It was good enough five years ago, or ten years ago, or…
Read the Post →
A Case Study in Poor Risk Assessment
Assessing Coronavirus risk is an interesting case study in how humans broadly assess risk and do so very poorly. Everyone on the planet has been doing a risk assessment, so it makes a good analogy that will have a great…
Read the Post →