A complete walkthrough showing System Security Plan development, policy creation, and monitoring procedures that satisfy assessors Mobile code appears twice in NIST SP 800-171 Rev 3. Two separate requirements with six assessment objectives between them. Most implementers struggle with these requirements because mobile code is widely misunderstood. They think it means cell phones. They try … Read more
Why logging isn’t enough and what assessors actually look for The word “monitor” appears approximately 250 times in the CMMC Level 2 assessment guide. That’s twice as many times as “logging.” Yet many defense contractors treat these terms as interchangeable. They capture logs and assume they’re monitoring. They’re not. This distinction matters because assessors specifically … Read more
Why most CMMC compliance journeys take twice as long as they should We went through it ourselves in 2020. We call it the “version 20” problem. You start writing a System Security Plan. You mark a bunch of things “not implemented” because you’re just getting started. You do a gap analysis. You make some technical … Read more
A complete blueprint based on the environment Kieri Solutions used to pass their own DIBCAC assessment Most CMMC compliant environments come with enterprise price tags. Dedicated IT staff requirements. Complex managed service arrangements where you lose control of your own systems. Kieri Solutions faced the same problem. They needed a CMMC Level 2 compliant environment … Read more
A walkthrough of actual documents showing pre-written solutions versus empty templates Most CMMC compliance documentation products share a common problem. They give you empty templates and hope you figure out how to fill them in. You open a System Security Plan template. It says “describe your facility security controls.” Blank space. You’re supposed to know … Read more
A detailed walkthrough showing how technology-agnostic policies combine with Microsoft 365 GCC-High implementation for complete CMMC Level 2 compliance CMMC compliance documentation and reference architecture are two distinct components of Level 2 compliance. Manual processes and technical configurations. Most compliance solutions address one or the other. Documentation packages give you policies and procedures but leave … Read more
