Latest articles
Your SPRS Score, Explained: Why It Runs From −203 to 110
How 110 controls become one number, why most first scores are negative, and which gaps to close first.
Read →
What Actually Counts as CUI? (And What Doesn't.)
FCI vs. CUI Basic vs. CUI Specified — and why overmarking quietly inflates your boundary and your budget.
Read →
GCC High vs. Commercial M365: Who Actually Needs to Migrate
The contract-driven decision, the ITAR trigger, and the enclave alternative that migrates fewer seats.
Read →
What CMMC Level 2 Really Costs — and Where the Money Goes
The honest cost stack from discovery to assessment, and why scope — not tooling — is the biggest lever.
Read →
No SSP, No Score: The Document That Gates Everything
Why 3.12.4 carries no point value, what a real System Security Plan contains, and how assessors test it.
Read →
POA&Ms Under CMMC: What Can Stay Open at Assessment
The 88-point floor, 1-point items only, and the 180-day closeout clock. The old escape hatch is gone.
Read →
Inside a C3PAO Assessment: What Assessors Actually Test
320 objectives, three evidence methods, one anchor document — and why booking lead time matters.
Read →
Choosing an MSP for CMMC: The Shared-Responsibility Questions That Matter
Your MSP is inside your assessment whether they like it or not. Here's how to pick one who knows it.
Read →
Mapping the Microsoft Security Stack to NIST SP 800-171
Entra, Intune, Defender, Sentinel, Purview — what each actually covers, and what no license buys you.
Read →
The 72-Hour Clock: DFARS Incident Reporting Nobody Practices
Medium assurance certificates, DIBNet, 90-day preservation — the mechanics to sort out before you need them.
Read →From the archive
Top 5 Critical Shifts in GSA's New Cybersecurity Mandate
The eight "showstopper" controls, the Rev. 3 divergence, and the 60-minute reporting clock.
RJ Williams · Feb 6, 2026Read →
New CMMC FAQs Just Dropped: Let's Break It Down
FAQs Revision 2.1 decoded: the November 10 line in the sand, VDI scoping, encrypted CUI, and ESPs.
RJ Williams · Nov 19, 2025Read →
How to Master CMMC Scoping: Level 1 vs Level 2 Explained
Boundaries, enclave vs. organization-wide, and the scoping mistakes that cost the most.
Kyle Kiider · Jul 25, 2025Read →
48 CFR CMMC Final Rule Is With OMB — Are You Ready?
The acquisition rule reaches OMB: what it means and how contractors should prepare.
Kyle Kiider · Jul 24, 2025Read →
CMMC Compliance: No Apologies, Just Action
Seventeen things you've probably already done, the team to assemble, and the quick wins that matter.
RJ Williams · Oct 13, 2024Read →Long-form guides
The CMMC Deadline Playbook
The 32 CFR / 48 CFR phase-in as it actually works, what primes are doing right now, and a 90-day action plan.
Guide · ScopingCUI Scope Reduction Field Guide
How discovery establishes an evidence-backed CMMC boundary before you budget remediation.
Guide · BudgetThe CMMC Level 2 Cost Planning Guide
The real cost stack with published pricing, what drives your number, and the sequencing that controls it.
Guide · GCC HighThe GCC High Migration Timeline
Phase-by-phase from discovery to cutover — the critical path, the risks, and the enclave alternative.