William Price, Lead CMMC Certified Assessor, Author at A3 Vallum Consulting

By William Price, Lead CMMC Certified Assessor OSC — Managing my MSPs/subs No Comments

Red Flags When Vetting a CMMC MSP: W2, “Compliance in a Box,” and Other Tells

Specific things CMMC MSPs say in discovery calls that should make you put your pen down — the W2 ISSM demand, the "compliance in a box" pitch, the "rip out your tools" recommendation, and more.

By William Price, Lead CMMC Certified Assessor OSC — Should I pursue CMMC? No Comments

Should You Pursue CMMC Before You Have a DoD Contract?

Pursuing CMMC certification before you have a DoD contract makes sense in three scenarios: First, you have a real pipeline of CMMC-required opportunities with award dates inside 18 to 24 months, Second, you are deliberately entering the defense market and have budgeted CMMC as a known cost of entry, or Third, you are positioning for acquisition by a defense prime. Outside those cases, cold-starting is often a mistake, especially if your basic IT security maturity is weak, your business does not actually touch CUI, or you cannot fund a $50K to $500K+ readiness investment over 9 to 18 months. CMMC is a contract-execution requirement under DFARS 252.204-7021, not a market-entry credential. For many companies, the right move is to build a CUI-capable environment, implement the 110 NIST SP 800-171 R2 controls, document a self-assessment SPRS score, and defer the C3PAO assessment until a contract justifies it.

By William Price, Lead CMMC Certified Assessor OSC — How do I implement? No Comments

Can You Store CUI in Microsoft 365 Commercial Instead of GCC High?

Microsoft 365 Commercial cannot lawfully store CUI. DFARS 7012(b)(2)(ii)(D) requires FedRAMP Moderate or equivalent for any cloud service handling covered defense information, and the M365 productivity services in Commercial (Exchange Online, SharePoint Online, OneDrive for Business, Teams) are not FedRAMP Moderate authorized. M365 Commercial works for FCI under Level 1. For CUI under Level 2, the Microsoft path is GCC where there is no ITAR or GCC High where there is ITAR since these data centers are U.S. persons operated. The common "Microsoft Commercial is FedRAMP High" objection confuses Azure Commercial, the IaaS, with M365 Commercial, the productivity suite. Different products, different FedRAMP scopes.

By William Price, Lead CMMC Certified Assessor OSC — What do I document? No Comments

What Goes In a CMMC System Security Plan That Survives a C3PAO Review

The CMMC SSP that survives a C3PAO review is an objective-level document, paired with an evidence matrix that points the assessor to the relevant artifacts for each of the ~320 NIST SP 800-171A objectives. NIST SP 800-171 sets the floor; 32 CFR and the CMMC Assessment Process v2.0 layer additional requirements on top. ESP/CSP documentation, the Customer Responsibility Matrix, and Pre-Assessment Form completeness. For a small contractor with a contained CUI scope, a defensible SSP can easily run up to 80 to 150 pages.

By William Price, Lead CMMC Certified Assessor OSC — How do I implement?, OSC — What do I document? No Comments

The CMMC Verb Test: How to Decode What Your Assessor Is Actually Looking For

The CMMC Level 2 Assessment Guide does not score 110 controls — it scores ~320 individual NIST SP 800-171A objectives, and each objective contains a single verb that tells the assessor exactly what evidence type is required. Documentation verbs (“defined,” “specified,” “documented,” “established,” “identified”) demand written artifacts. Operational verbs (“monitored,” “implemented,” “enforced,” “performed,” “tested”) demand live evidence — logs, configs, dated records. Context-dependent verbs (“controlled,” “authorized,” “reviewed”) require both. A policy can never satisfy an operational verb; a log can never satisfy a documentation verb. Match the evidence to the verb and you have 80% of the readiness work done.

By William Price, Lead CMMC Certified Assessor OSC — Am I in scope?, OSC — Managing my MSPs/subs No Comments

Overmarked CUI: How to Request Decontrol Under 32 CFR 2002.20 (And Why It Shrinks Your CMMC Scope)

When a customer marks a document “CUI” that does not meet the definition under 32 CFR Part 2002, that document is overmarked — and accepting it expands your CMMC scope into systems that should never have been pulled in. A CCA on the decontrol process, when to use it, and the worked example that saved a manufacturer six figures of unnecessary architecture.

William Price, Lead CMMC Certified Assessor

William Price, Lead CMMC Certified Assessor

Red Flags When Vetting a CMMC MSP: W2, “Compliance in a Box,” and Other Tells

Should You Pursue CMMC Before You Have a DoD Contract?

Can You Store CUI in Microsoft 365 Commercial Instead of GCC High?

What Goes In a CMMC System Security Plan That Survives a C3PAO Review

The CMMC Verb Test: How to Decode What Your Assessor Is Actually Looking For

Overmarked CUI: How to Request Decontrol Under 32 CFR 2002.20 (And Why It Shrinks Your CMMC Scope)

Heather Smith

Categories

Latest Posts

Red Flags When Vetting a CMMC MSP: W2, “Compliance in a Box,” and Other Tells

Should You Pursue CMMC Before You Have a DoD Contract?

Can You Store CUI in Microsoft 365 Commercial Instead of GCC High?

Subscribe Newsletter

Comany Information

Key Services

Quick Links