Red Flags When Vetting a CMMC MSP: W2, “Compliance in a Box,” and Other Tells
Specific things CMMC MSPs say in discovery calls that should make you put your pen down — the W2 ISSM demand, the "compliance in a…
Should You Pursue CMMC Before You Have a DoD Contract?
Pursuing CMMC certification before you have a DoD contract makes sense in three scenarios: First, you have a real pipeline of CMMC-required opportunities with award…
Can You Store CUI in Microsoft 365 Commercial Instead of GCC High?
Microsoft 365 Commercial cannot lawfully store CUI. DFARS 7012(b)(2)(ii)(D) requires FedRAMP Moderate or equivalent for any cloud service handling covered defense information, and the M365…
What Goes In a CMMC System Security Plan That Survives a C3PAO Review
The CMMC SSP that survives a C3PAO review is an objective-level document, paired with an evidence matrix that points the assessor to the relevant artifacts…
16 Apr 24
By William Price, Lead CMMC Certified Assessor
OSC — How do I implement? , OSC — What do I document?
No Comment
By William Price, Lead CMMC Certified Assessor
OSC — How do I implement? , OSC — What do I document?
No Comment
The CMMC Verb Test: How to Decode What Your Assessor Is Actually Looking For
The CMMC Level 2 Assessment Guide does not score 110 controls — it scores ~320 individual NIST SP 800-171A objectives, and each objective contains a…
16 Apr 24
By William Price, Lead CMMC Certified Assessor
OSC — Am I in scope? , OSC — Managing my MSPs/subs
No Comment
By William Price, Lead CMMC Certified Assessor
OSC — Am I in scope? , OSC — Managing my MSPs/subs
No Comment
Overmarked CUI: How to Request Decontrol Under 32 CFR 2002.20 (And Why It Shrinks Your CMMC Scope)
When a customer marks a document “CUI” that does not meet the definition under 32 CFR Part 2002, that document is overmarked — and accepting…
Recent Articles & Guides
Red Flags When Vetting a CMMC MSP: W2, “Compliance in a Box,” and Other Tells
Specific things CMMC MSPs say in discovery calls that should make you put your pen down — the W2 ISSM…
Should You Pursue CMMC Before You Have a DoD Contract?
Pursuing CMMC certification before you have a DoD contract makes sense in three scenarios: First, you have a real pipeline…
Can You Store CUI in Microsoft 365 Commercial Instead of GCC High?
Microsoft 365 Commercial cannot lawfully store CUI. DFARS 7012(b)(2)(ii)(D) requires FedRAMP Moderate or equivalent for any cloud service handling covered…
What Goes In a CMMC System Security Plan That Survives a C3PAO Review
The CMMC SSP that survives a C3PAO review is an objective-level document, paired with an evidence matrix that points the…
The CMMC Verb Test: How to Decode What Your Assessor Is Actually Looking For
The CMMC Level 2 Assessment Guide does not score 110 controls — it scores ~320 individual NIST SP 800-171A objectives,…
Overmarked CUI: How to Request Decontrol Under 32 CFR 2002.20 (And Why It Shrinks Your CMMC Scope)
When a customer marks a document “CUI” that does not meet the definition under 32 CFR Part 2002, that document…
NeoSystems Closure
What public reports say happened at NeoSystems on Friday, May 1, 2026 — and how A³ Vallum is set up…
Building a CMMC Customer Responsibility Matrix Your Client’s Assessor Will Actually Accept
A CCA's guide to the CMMC Customer Responsibility Matrix — what assessors actually look for, why marketing-grade SRMs fail, and…
MSPs Don’t Have to Be CMMC Certified: The ESP Paths Under the Rule
MSPs are not required to hold their own CMMC certification to serve DoD contractors. Per 32 CFR § 170.19(c)(2), the…
CUI in Microsoft Teams, SharePoint, and OneDrive: Scoping Guide for GCC High
The Microsoft 365 GCC High tenant becomes a CUI Asset under the CMMC Scoping Guide Level 2 the moment any…
Does Your MSP Need to Be CMMC Certified to Keep Your DoD Contract?
An MSP serving a DoD contractor with CMMC requirements is not required by 32 CFR Part 170 to hold its…
CMMC for MSPs: The Practical 2026 Guide to Compliance, Risk and the White Label Strategy
MSPs serving DoD contractors are now part of the CMMC compliance boundary whether they like it or not. Under DFARS…
You Are a Target: Complete SMB CMMC Guide [Part 1]
Small defense contractors are the highest-value, lowest-defended targets in the supply chain — and the CMMC rule (32 CFR Part…
