112Cyber Resource Center
Guidance from Certified CMMC Assessors
Network Diagrams and Data Flow Diagrams: Mapping Your CMMC Boundary
Where does CMMC actually apply in your organization? You can’t implement CMMC until you know which parts of your organization are subject to its requirements.
CMMC Implementation: 4 Critical Steps to Getting Started
Just getting started with CMMC preparation? Before you can implement a single security control, you need a clear understanding of your environment. Most organizations underestimate
The Biggest CMMC Questions Contractors Are Still Asking
CMMC isn’t always straightforward. Understanding all 110 NIST 800-171 controls can be difficult, and understanding how they apply in your own unique environment can trip
POA&Ms and OPAs: What Are They & When Are They Used?
If you’ve spent any time preparing for NIST 800-171 or DFARS 70-12 compliance, you’ve probably come across the terms POA&M and OPA. While they may
Suspension of CMMC Phase II and What It Means for You
On July 13th, 2026, at 3:30PM EST, the Department of War (DoW) released a memorandum for senior Pentagon leadership with a subject of “Implementing Department
CMMC Recertification: What Qualifies as a “Significant Change” Requiring a Second C3PAO Assessment
Earning CMMC certification takes a significant investment of time, resources, and effort. Once an organization clears its C3PAO Assessment, there’s a natural sense of relief
How to Pass the Most Failed CMMC Controls
If your organization handles Controlled Unclassified Information (CUI) and is working toward CMMC Level 2 certification, understanding where organizations most commonly fail is half the
C3PAO Interview Checklist: 10 Evaluation Criteria
Not all C3PAOs are created equal. Before you sign an engagement, these are the questions that separate credible assessors from expensive mistakes — organized by
A Guide to External Service Providers (ESP) and CMMC Certifications
In the Defense Industrial Base (DIB), External Service Providers (ESPs) are becoming increasingly common. ESPs, also commonly referred to as Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), or
FIPS Encryption Requirements in CMMC and NIST SP 800-171
When handling Controlled Unclassified Information (CUI), compliance with NIST SP 800-171 and the CMMC framework mandates strict data protection measures—including the use of FIPS-validated encryption