Information Security Resources
3.10.6 Alternate Work Sites
Is your organization struggling to understand how to approach the NIST SP 800-171 3.10.6 Security Requirement for Alternate Work Sites? What is allowed and what an assessor may be looking for? In this CMMC Churns, we dive [...]
The Three Types of Evidentiary Objects
Did you know there are three general types of Examination Assessment Objects in NIST SP 800-171A? Well, we looked at all 879 listed Examination Assessment Objects in 171A and realized there are three main types. There is [...]
Your SSP Sucks, Seriously.
Sorry to tell many of you, your NIST SP 800-171 required System Security Plan (SSP) sucks. As the start of CMMC draws nearer, we are now seeing more SSPs by other companies and, well, they miss the [...]
Requirements have Relationships
I’ll bet you didn’t know the Security Requirements in NIST SP 800-171 have relationships. We see people just jumping into NIST SP 800-171 compliance helping organizations and even CMMC Certified Assessors failing to understand how one requirement [...]
Approve, the Forgotten Verb
Did you know one of the most prolific failures for an organization's self-assessments and those seeking certification during a conformity assessment under Cybersecurity is their documentation? Approvals. For some crazy reason organizations think draft documentation, settings that [...]
32 CFR Part 170 Word Document
Here is the MS Word version of the Draft 32 CFR Part 170, CMMC Program rule: PART_170—CYBERSECURITY_MATURITY MODEL_CERTIFICATION_PROGRAM
CMMC Rule, an Executive Summary
The new Cybersecurity Maturity Model Certification (CMMC) rule was published on 22 December 2023. While many of the "in the weeds" details are new and worthy of later discussion, this "As the CMMC Churns" video focuses on [...]
CUI Litmus Test
Find out about the CUI Litmus test if your organization struggling to identify CUI in your environment. Does your organization know the key tenets to identify CUI? If not, this As the CMMC Churns [...]
Assessors and Toddlers
Is your organization getting ready to undergo a formal Conformity Assessment for NIST SP 800-171? If so, you need to watch this video!!! You need to understand the similarities between Assessors and Toddlers. With the uptick in non-voluntary [...]
3.13.7 and Split Tunneling
Are you trying got understand the 3.13.7 and Split Tunneling Security Requirement in NIST SP 800-171 Rev 2 (and draft Rev 3?? Like all of the requirements, there are nuances in the actual Security Requirement, “Prevent remote [...]
NIST SP 800-171 Rev 3 Draft
DO NOT watch this if you are a Defense Industrial Base (DIB) Contractor. You have real work to do by implementing NIST SP 800-171 Revision 2 versus finding out about the NIST SP 800-171 Rev 3 Draft. [...]
4-Ways to Demonstrate Compliance
BREAKING NEWS from "As the CMMC Churns".... There are now 4-Ways to Demonstrate Compliance. The Cyber-AB, with DoD's implicit blessing, is now allowing Authorized C3PAOs to conduct formal NIST SP 800-171 Assessments for organizations both inside and [...]
Overengineering for CMMC
Are you Overengineering for CMMC? Has your business made the implementation of NIST SP 800-171 harder than it needs to be? Are your employees using one device for CUI work and another for normal work? If so, [...]
VM for Remote Workers
VM for Remote Workers underwent a massive shift due to COVID-19 that changed how the United States and the world operate. It impacted operations and drove changes under NIST SP 800-171/CMMC for remote access and remote workers. [...]
Tips about FIPS Part 2
Has 3.13.11, the use of FIPS-validated encryption, sent your organization through the Seven Stages of CMMC Grief? Does the use of FIPS-validated encryption have you befuddled? Tips about FIPS Part 2 continues address the most common DIBCAC [...]
Tips about FIPS Part 1
Has 3.13.11, the use of FIPS validated encryption, sent your organization through the Seven Stages of CMMC Grief? Does the use of FIPS validated encryption have you befuddled? This is Part 1 on Tips about FIPS to [...]
DIBCAC Gaps
Did you know the Defense Industrial Based Cybersecurity Assessment Center (DIBCAC) posted slides about what NIST SP 800-171 requirements were "Other Than Satisfied"? These are the DIBCAC Gaps. In this episode of As [...]
Apple MacOS and CMMC
Apple MacOS and CMMC??? Does your business use Apple MacOS devices? Do you also have to implement NIST SP 800-171 and be CMMC accredited? Good news!!! Apple MacOS devices can be setup to fulfill NIST SP 800-171 and [...]
Documenting Your Scope
Are looking to understand documenting your scope for your SSP? How does the NIST SP 800-171 Scope of Applicability and CMMC Assessment Scope fit in the SSP? In this At the CMMC Churns, we take the Scope [...]
Security Tactics for Specialized Assets
Does your business have CMMC-defined Specialized Assets? Are you struggling to determine how to apply NIST SP 800-171 requirements to them? This As the CMMC Churns episode, Security Tactics for Specialized Assets, is for you. In this [...]
Acq101 and CMMC Rule-Update #1
How will the changes to the CMMC Rule going final affect your business? Acq101 and CMMC Rule-Update #1 is the point of this special edition of As the CMMC Churns will help to clarify. Matt Titcombe, the CEO [...]
To Enclave or not to Enclave, that is the question
To Enclave or not to Enclave, that is the question… In this As the CMMC Churns, we look into enclaving. We also look into the most common pitfalls businesses do when making an enclaving decision--falling back into [...]
NIST SP 800-171 and CMMC Level 2 Assessment Scoping Process Diagram
The process diagram is used to: Classify components per the NIST SP 800-171 Scope of Applicability Then categorize those components per the CMMC Level 2 Assessment Scoping Guide A separate diagram for classifying and categorizing roles will [...]
Twas the night before the CMMC rule drop
A special fireside reading from As the CMMC Churns of Twas the night before the CMMC rule drop. Twas the night before the CMMC rule drop, when all through the C3PAO Not an assessor was stirring, not [...]
Social Contact