Latest articles
Your SPRS Score, Explained: Why It Runs From −203 to 110
How 110 controls become one number, why most first scores are negative, and which gaps to close first.
Read →
What Actually Counts as CUI? (And What Doesn't.)
How FCI, CUI Basic, and CUI Specified differ, and how overmarking inflates your boundary and your budget.
Read →
GCC High vs. Commercial M365: Who Actually Needs to Migrate
Why your contracts drive the decision, how ITAR data triggers it, and the enclave alternative that migrates fewer seats.
Read →
What CMMC Level 2 Really Costs, and Where the Money Goes
The cost stack from discovery to assessment, and why scope moves the total more than tooling does.
Read →
No SSP, No Score: The Document Everything Depends On
Why 3.12.4 carries no point value, what a real System Security Plan contains, and how assessors test it.
Read →
POA&Ms Under CMMC: What Can Stay Open at Assessment
The 88-point floor, the short list of gaps that may stay open, and the 180-day closeout that replaced the old open-ended plan.
Read →
Inside a C3PAO Assessment: What Assessors Actually Test
How assessors work through 320 objectives with three evidence methods, starting from your SSP.
Read →
Choosing an MSP for CMMC: The Shared-Responsibility Questions That Matter
Your MSP is inside your assessment whether they like it or not. These are the questions to ask before you sign.
Read →
Mapping the Microsoft Security Stack to NIST SP 800-171
What Entra, Intune, Defender, Sentinel, and Purview each cover in 800-171, and what no license buys you.
Read →
The 72-Hour Clock: DFARS Incident Reporting Nobody Practices
Sort out the medium assurance certificate, DIBNet access, and 90-day preservation before an incident starts the clock.
Read →From the archive
Top 5 Critical Shifts in GSA's New Cybersecurity Mandate
The eight "showstopper" controls, the Rev. 3 divergence, and the 60-minute reporting clock.
RJ Williams · Feb 6, 2026Read →
New CMMC FAQs Just Dropped: Let's Break It Down
What FAQs Revision 2.1 says about the November 10 start date, VDI scoping, encrypted CUI, and ESPs.
RJ Williams · Nov 19, 2025Read →
How to Master CMMC Scoping: Level 1 vs Level 2 Explained
How to draw the boundary, how to choose between an enclave and an organization-wide scope, and the scoping mistakes that cost the most.
Kyle Kiider · Jul 25, 2025Read →
48 CFR CMMC Final Rule Is With OMB — Are You Ready?
The acquisition rule reaches OMB: what it means and how contractors should prepare.
Kyle Kiider · Jul 24, 2025Read →
CMMC Compliance: No Apologies, Just Action
Seventeen things you've probably already done, the team to assemble, and the quick wins that matter.
RJ Williams · Oct 13, 2024Read →Long-form guides
The CMMC Deadline Playbook
The 32 CFR / 48 CFR phase-in as it actually works, what primes are doing right now, and a 90-day action plan.
Guide · ScopingCUI Scope Reduction Field Guide
How discovery establishes an evidence-backed CMMC boundary before you budget remediation.
Guide · BudgetThe CMMC Level 2 Cost Planning Guide
The real cost stack with published pricing, what drives your number, and the sequencing that controls it.
Guide · GCC HighThe GCC High Migration Timeline
Each phase from discovery to cutover, with the critical path, the risks, and the enclave alternative.