Boundaries, VDI clarifications, and the end of SPA chaining Understanding what’s out of scope matters as much as knowing what’s in scope. The final CMMC rule made significant clarifications about boundaries, VDI endpoints, and security protection asset relationships. These changes simplify scoping and eliminate some of the more problematic interpretations from earlier guidance. This article … Read more
Four Certified CMMC Assessors break down the major changes, the harder requirements, and the practical implications. The CMMC rule is final. After years of speculation, interim guidance, and leaked drafts, defense contractors can now read exactly what the Department of War requires. Four Certified CMMC Assessors from Kieri Solutions worked through the rule together: Amira … Read more
On July 13, 2026 the Department of War suspended CMMC Phase 2, the stage of the rollout that would have required a third-party assessment as a condition of contract award beginning November 10, 2026. Phase 1 self-assessment, NIST 800-171, and the underlying DFARS obligations all remain in force. A reform task force is reviewing the … Read more
Understanding process, store, and transmit definitions under the final rule CUI assets face the most rigorous assessment in CMMC Level 2. While security protection assets get evaluated only for relevant capabilities, and contractor risk managed assets get SSP review with spot checks, CUI assets get assessed against all 110 security requirements. Understanding what makes something … Read more
The foundation of CMMC scoping starts with knowing what CUI actually is Before you can scope your CMMC environment, you need to answer a fundamental question: Do I even have CUI? Most defense contractors answer this question incorrectly. They either think everything is CUI or nothing is. Both extremes create problems during an assessment. This … Read more
The CMMC proposed rule introduces a concept some defense contractors find puzzling. Security protection data. This category includes vulnerability scan results, system security plans, network diagrams, firewall configurations, and endpoint security settings. Under 32 CFR Part 170, when an external service provider handles security protection assets but doesn’t process, store, or transmit CUI directly, those … Read more
If your consultant assessed you against 110 practices instead of 320 assessment objectives, you’re preparing for the wrong test Kieri Solutions has noticed a troubling pattern. Defense contractors approaching us for CMMC assessments have had gap analyses performed by third-party consultants. When we ask about their readiness, they reference those gap analyses with confidence. Then … Read more
