Cybersecurity & Compliance

Passed (or survived) a CMMC Level 2 assessment? Pull back the curtain: which evidence did assessors spend the most time on? Common deep-dives: access control implementation, audit log review, incident response evidence, and System Security Plan accuracy. The pattern: they trust artifacts over assertions — screenshots, logs, and signed documents beat narratives. What surprised you most about your assessment?

CUI is the tripwire for CMMC Level 2 — if you handle it, the 110 controls apply. CUI categories span export control, critical infrastructure, defense, and more; the NARA CUI registry is the authoritative list. Practical test: does the contract mark data as CUI, or does the agency's handling guidance say so? When in doubt, ask the contracting officer in writing. How do you determine CUI in your contracts?

A Plan of Action & Milestones (POA&M) is how you document controls you haven't fully implemented — and assessors expect to see them done right. Each POA&M needs the specific control, the gap, the remediation plan, milestones with dates, and an owner. What kills assessments: vague POA&Ms with no dates, or POA&Ms used to hide permanent non-compliance. How are you managing yours — spreadsheet, GRC tool, or something else?

The number everyone wants: real CMMC costs for a small contractor. Honest ranges: Level 1 self-assessment can be done for low five figures with good hygiene; Level 2 typically runs $50K-$150K+ including gap remediation, documentation, and the C3PAO assessment — before ongoing maintenance. Biggest cost drivers: scope creep (enclaves cut this), missing evidence, and starting late. What's your actual spend — and what would you do cheaper the second time?

Not every DoD contract needs CMMC Level 2. Level 1 (17 basic safeguarding practices, annual self-assessment) covers contracts handling Federal Contract Information only. Level 2 (110 NIST 800-171 practices, third-party assessment for most) applies when Controlled Unclassified Information is involved. The contract's solicitation states the required level — check it before spending a dollar on the wrong one. Which level are your contracts requiring?

CMMC flow-down means your compliance is only as strong as your weakest sub. Smart primes are now screening subs on cybersecurity before teaming — questionnaires, evidence requests, even joint assessment planning. How are you evaluating sub cyber posture? Subs: are primes asking you for evidence yet?

Not every DoD contract needs CMMC Level 2. Level 1 (17 basic safeguarding practices, annual self-assessment) covers contracts handling Federal Contract Information only. Level 2 (110 NIST 800-171 practices, third-party assessment for most) applies when Controlled Unclassified Information is involved. The contract's solicitation states the required level — check it before spending a dollar on the wrong one. Which level are your contracts requiring?

CMMC flow-down means your compliance is only as strong as your weakest sub. Smart primes are now screening subs on cybersecurity before teaming — questionnaires, evidence requests, even joint assessment planning. How are you evaluating sub cyber posture? Subs: are primes asking you for evidence yet?

An incident response plan isn't a document — it's a rehearsed capability. Assessors look for defined roles, communication trees, detection and analysis procedures, and evidence of tabletop exercises. Most small contractors fail here on evidence, not intent. Have you run a tabletop exercise this year? What broke?

FedRAMP authorization opens the entire federal market to your SaaS product — but the price tag (often $1M+ and 12-18 months) kills most small vendors before they start. Alternatives: FedRAMP Ready, agency authorizations, or partnering with an already-authorized platform. SaaS founders: did you pursue FedRAMP, and would you do it again?