CMMC, one layer down

The path

1. Stage 1Does this affect me?

   Does CMMC apply to my business?

   • Do I Need CMMC Level 1 or Level 2?A plain-language guide to telling CMMC Level 1 from Level 2: what each covers, what decides which one your contracts require, and where to confirm it.

2. Stage 2What do I handle?

   Do I have CUI? Which level?

   • What Is CUI? A Plain-Language GuideWhat Controlled Unclassified Information is, how it differs from Federal Contract Information, and how to work out whether your business handles it.
   • CMMC Scoping and Enclaves, ExplainedHow CMMC scoping decides which people, systems and locations an assessment covers, and when an enclave can shrink that boundary for a small business.

3. Stage 3Choosing a path

   DIY, RPO, or tool? What does it cost?

   • CMMC Options and Costs: DIY, RPO, MSP, or a Tool?The main ways small contractors get CMMC done, what each one involves, where the costs come from, and how to choose the right mix for your situation.
   • How to Choose a CMMC RPO (Registered Provider Org)What a Registered Provider Organization does and does not do for CMMC, how to check one is legitimate, the questions to ask, and the red flags to avoid.

4. Stage 4Doing the work

   What goes in an SSP and a POA&M?

   • SPRS Scores and CMMC Self-Assessments, ExplainedWhat SPRS is, how the NIST SP 800-171 score is calculated, how CMMC self-assessments are reported and affirmed, and how to keep your score honest and current.
   • What Is a System Security Plan (SSP)?What a System Security Plan is, why CMMC Level 2 cannot be assessed without one, what goes in it, and the common mistakes that make one fall apart under review.
   • What Is a POA&M? Plans of Action Under CMMCWhat a Plan of Action and Milestones is, what CMMC allows on one at each level, the 80% and 180-day rules for conditional status, and what a good one contains.
   • CMMC Evidence Basics: What to Keep and HowWhat counts as evidence for a CMMC assessment, how assessors use it, how to organize it by requirement, how long to keep it, and how to avoid new CUI risk.

5. Stage 5Staying compliant

   How do I stay compliant?

   • Staying CMMC Compliant After Your AssessmentYour CMMC status is a dated snapshot, but your affirmation covers every day after it. What has to keep happening between assessments, and how to keep on track.