Most government contractors believe their security plan describes how they protect the information they’re trusted with. Across more than 80 assessments, we’ve learned how often that belief holds, and how quickly a plan shows whether it does. The size of the plan tells you nothing on its own. What matters is whether it’s true. If … Read more
Is this page for you? Start here if any of these sound familiar: You just won a defense contract, or you’re about to, and it has a cybersecurity clause you don’t fully understand. You’re pursuing a defense contract and want to know what you’ll be asked to show. You’re moving from commercial work into government … Read more
Someone on your team downloads the current version of NIST SP 800-171 from the NIST website, opens it, and finds 97 requirements instead of the 110 you have been working with. There are domains that you have never documented: Planning, System and Services Acquisition, and Supply Chain Risk Management. Next, they find brackets associated with … Read more
There is a sales pitch making the rounds that makes CMMC harder than it needs to be. It goes something like this. If you do not buy our backup solution, you will fail your assessment. It sounds urgent, it sounds official, and it is mostly wrong. We keep running into this one, so let’s set … Read more
A DIBCAC High assessment carries higher stakes than a C3PAO assessment, and the margin for error is thinner. A DIBCAC High assessment measures your compliance with NIST SP 800-171, the requirement that flows down through DFARS 252.204-7012, and the score you earn during the week is the score you keep. We have seen it from … Read more
Boundaries, VDI clarifications, and the end of SPA chaining Understanding what’s out of scope matters as much as knowing what’s in scope. The final CMMC rule made significant clarifications about boundaries, VDI endpoints, and security protection asset relationships. These changes simplify scoping and eliminate some of the more problematic interpretations from earlier guidance. This article … Read more
Four Certified CMMC Assessors break down the major changes, the harder requirements, and the practical implications. The CMMC rule is final. After years of speculation, interim guidance, and leaked drafts, defense contractors can now read exactly what the Department of War requires. Four Certified CMMC Assessors from Kieri Solutions worked through the rule together: Amira … Read more
On July 13, 2026 the Department of War suspended CMMC Phase 2, the stage of the rollout that would have required a third-party assessment as a condition of contract award beginning November 10, 2026. Phase 1 self-assessment, NIST 800-171, and the underlying DFARS obligations all remain in force. A reform task force is reviewing the … Read more
Understanding process, store, and transmit definitions under the final rule CUI assets face the most rigorous assessment in CMMC Level 2. While security protection assets get evaluated only for relevant capabilities, and contractor risk managed assets get SSP review with spot checks, CUI assets get assessed against all 110 security requirements. Understanding what makes something … Read more
The foundation of CMMC scoping starts with knowing what CUI actually is Before you can scope your CMMC environment, you need to answer a fundamental question: Do I even have CUI? Most defense contractors answer this question incorrectly. They either think everything is CUI or nothing is. Both extremes create problems during an assessment. This … Read more
