If you’ve spent any time preparing for NIST 800-171 or DFARS 70-12 compliance, you’ve probably come across the terms POA&M and OPA. While they may sound similar, they serve very different purposes during the certification or self-attestation process. Knowing when each one applies—and just as importantly, when it doesn’t—can help organizations avoid unnecessary delays, misunderstandings, […]
Earning CMMC certification takes a significant investment of time, resources, and effort. Once an organization clears its C3PAO Assessment, there’s a natural sense of relief — even accomplishment. That CMMC Status can last up to three years, but two events bring recertification back onto the calendar sooner: reaching the end of the standard three-year cycle, […]
In the Defense Industrial Base (DIB), External Service Providers (ESPs) are becoming increasingly common. ESPs, also commonly referred to as Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), or Cloud Service Providers (CSPs), have become especially beneficial for small and medium-sized businesses where hiring a full-time compliance employee may not be practical. ESP services can range from full system management and support to […]
2025 was the year CMMC stopped being theoretical and started impacting contracts, costs, and careers. For defense contractors, certification is no longer just compliance; it’s a competitive edge, a risk mitigation strategy, and an operational imperative in an era of elevated requirements for organizations in the Defense Industrial Base (DIB). But it didn’t start that way. January 2025 was still a time of uncertainty and what felt like […]
2025 was a year of undeniable progress when it came to the establishment and enforcement of CMMC (Cybersecurity Maturity Model Certification). As we left 2025 and CMMC moved from anticipated requirement to full-on enforcement, one thing became clear: the companies that made the most CMMC progress weren’t just guessing—they were informed. Over the past year, our most-read and most-shared CMMC guides reflected the real questions […]
You’re more than aware of CMMC’s ever-changing nature—we sure are! From publication dates, commentary periods, and everything between, it’s hard to keep up. That’s why we wanted to give you a heads up on the latest in DoD Land. On top of CMMC-specific changes, certain updates in the Department of Defense (DoD) can understandably […]
Risk assessments are an integral part of CMMC compliance and information security. Here’s what you need to know to be successful.
With the DoD’s new memo tightening FedRAMP requirements for cloud services, it may be time to develop a new approach.