Category: Cybersecurity & Compliance

  • CMMC Level 2: Requirements, Readiness and Assessment Guide

    CMMC Level 2: Requirements, Readiness and Assessment Guide

    CMMC Level 2 is intended for organizations that need to protect Controlled Unclassified Information in applicable defense contracting environments.

    Current Program Status

    As of September 2026, official CMMC guidance states that Phase II requirements were suspended in July 2026 while Phase I self-assessment requirements remain active. Verify current obligations against contracts and official guidance.

    NIST SP 800-171 Alignment

    Under the current framework, Level 2 has been aligned to the 110 security requirements in NIST SP 800-171 Rev. 2. NIST Rev. 3 has superseded Rev. 2 as a NIST publication, but current CMMC materials continue to reference Rev. 2 pending future changes.

    Core Readiness Areas

    • System and CUI scope
    • Access control
    • Identification and authentication
    • Configuration management
    • Audit and accountability
    • Incident response
    • Media protection
    • Personnel security
    • System and communications protection
    • System and information integrity

    Documentation Matters

    See our CMMC SSP guide and POA&M guide.

    Gap Assessment

    A structured CMMC gap assessment can identify missing controls and evidence gaps.

    Microsoft 365 Considerations

    See CMMC and Microsoft 365.

    Explore CMMC compliance consulting or contact WS Tech Consulting.

  • CMMC Gap Assessment: How to Identify Compliance Gaps

    CMMC Gap Assessment: How to Identify Compliance Gaps

    A CMMC gap assessment compares an organization’s current cybersecurity practices and documentation to applicable requirements.

    Start With Scope

    Understand where relevant information is stored, processed and transmitted and which systems provide security protection.

    Review Technical Controls

    Examine identity, access, endpoints, network security, configuration, logging, monitoring and data protection.

    Review Documentation

    Compare actual practices with the System Security Plan, policies, procedures and supporting evidence.

    Identify Evidence Gaps

    Evidence can include configurations, screenshots, logs, policies, procedures, tickets and reports.

    Prioritize Remediation

    A remediation roadmap should identify dependencies, owners, technical work, policy changes and documentation updates.

    Microsoft 365

    A gap assessment may include Entra ID, Intune, Defender, Purview, SharePoint and OneDrive. See Microsoft 365 consulting and CMMC Microsoft 365.

    Next Steps

    A gap assessment can feed an updated SSP and POA&M.

    Learn more about CMMC compliance consulting.

  • CMMC and NIST SP 800-171: What’s the Difference?

    CMMC and NIST SP 800-171: What’s the Difference?

    CMMC and NIST SP 800-171 are closely related, but they are not the same thing.

    What Is NIST SP 800-171?

    NIST SP 800-171 provides security requirements for protecting CUI in certain nonfederal systems and organizations. Rev. 2 contained 110 security requirements. NIST has since superseded Rev. 2 with Rev. 3.

    What Is CMMC?

    CMMC is the defense-sector program used to establish and verify cybersecurity requirements in applicable contracting environments. Under the current framework, CMMC Level 2 references NIST SP 800-171 Rev. 2.

    Why the Revision Difference Matters

    NIST Rev. 3 is current, while CMMC Level 2 materials continue to reference Rev. 2. Follow applicable contracts and current official guidance.

    See the official CMMC page and NIST resources.

    What Businesses Should Do

    1. Confirm contractual requirements.
    2. Identify CUI and system scope.
    3. Assess implementation.
    4. Maintain documentation.
    5. Track remediation.
    6. Monitor program changes.

    Read our NIST SP 800-171 compliance guide, gap assessment guide, and Level 2 guide.

  • NIST SP 800-171 Compliance: A Practical Guide for Businesses

    NIST SP 800-171 Compliance: A Practical Guide for Businesses

    NIST SP 800-171 addresses protection of Controlled Unclassified Information in certain nonfederal systems and organizations.

    What NIST SP 800-171 Covers

    The publication addresses access control, training, audit, configuration, identity, incident response, maintenance, media, personnel, physical protection, risk, security assessment, communications protection and system integrity.

    Rev. 2 and Rev. 3

    NIST SP 800-171 Rev. 3 superseded Rev. 2 as the current NIST publication. However, current CMMC Level 2 materials continue to reference Rev. 2. Follow applicable contracts and current program guidance.

    Start With CUI and Scope

    Identify systems that process, store or transmit CUI or protect those systems.

    Develop an Accurate SSP

    The System Security Plan should describe the environment and implementation.

    Use Gap Assessment and Remediation

    A gap assessment identifies areas requiring remediation or evidence.

    Microsoft 365

    Microsoft services can support security capabilities, but technology selection alone does not establish compliance. See Microsoft 365 consulting and CMMC and Microsoft 365.

    Read CMMC vs NIST SP 800-171 and CMMC Level 2.

  • CMMC System Security Plan (SSP): What Businesses Need to Know

    CMMC System Security Plan (SSP): What Businesses Need to Know

    A System Security Plan is a foundational document for organizations working with NIST SP 800-171 and CMMC.

    What an SSP Should Describe

    • System boundaries
    • Environment and architecture
    • CUI flows and locations
    • Responsible systems and services
    • Implementation of security requirements
    • Roles and responsibilities
    • Relevant policies and procedures

    Why Accuracy Matters

    An SSP should reflect the actual environment. Generic documentation that does not match real configurations creates assessment risk.

    SSP and CUI Scope

    Read our CUI guide.

    SSP and POA&M

    Outstanding work may need tracking through a POA&M where permitted.

    Microsoft Environment Documentation

    For Microsoft environments, SSP documentation may need to describe identity, endpoints, cloud services, data protection, logging and monitoring. See CMMC and Microsoft 365.

    Keep the SSP Current

    Treat the SSP as a living document and update it when architecture, services or CUI handling change.

    Our CMMC compliance consulting services can support SSP development and remediation planning.

  • CMMC POA&M: Plan of Action and Milestones Explained

    CMMC POA&M: Plan of Action and Milestones Explained

    A Plan of Action and Milestones is used to document identified cybersecurity deficiencies and actions planned to correct them.

    What a POA&M Tracks

    • Identified deficiency
    • Required remediation
    • Responsible owner
    • Dependencies
    • Target completion date
    • Status and evidence

    Not a Substitute for Implementation

    A remediation plan does not mean a requirement is implemented.

    Connect POA&M to the SSP

    The SSP describes the environment, while the POA&M tracks unresolved work where permitted.

    Prioritize Remediation

    Consider impact, security risk, dependencies, technical complexity and assessment timing.

    Use the Gap Assessment

    A CMMC gap assessment can identify work that needs remediation.

    Microsoft Remediation

    Common work can involve identity, MFA, Conditional Access, endpoint configuration, logging, data protection and permissions. Explore Microsoft 365 security consulting.

    Visit CMMC Compliance Consulting.

  • CMMC and Controlled Unclassified Information (CUI): What Businesses Need to Know

    CMMC and Controlled Unclassified Information (CUI): What Businesses Need to Know

    Controlled Unclassified Information is one of the most important concepts in CMMC and NIST SP 800-171 planning.

    Why CUI Affects CMMC Scope

    Systems that process, store or transmit CUI—and systems that provide security protection—can affect compliance scope.

    Map CUI Flows

    Document how CUI enters the organization, where it is stored, who accesses it, how it is shared and how it leaves or is destroyed.

    Control Access

    Access should be limited according to business need and applicable requirements.

    Protect CUI in Microsoft 365

    Evaluate licensing, configuration, data location, permissions and security requirements before placing CUI into a service.

    See CMMC and Microsoft 365 and Microsoft 365 consulting.

    CUI and the SSP

    Your System Security Plan should accurately describe relevant systems and boundaries.

    Start With Scope Before Buying Tools

    Understand the CUI environment and applicable requirements before choosing technology.

    Our CMMC compliance consulting approach starts with environment, scope, requirements and gaps.

  • CMMC and Microsoft 365: Security and Compliance Considerations

    CMMC and Microsoft 365: Security and Compliance Considerations

    Microsoft 365 is widely used for identity, email, collaboration, files, endpoint management and information protection. For defense contractors, those capabilities can become part of a CMMC-focused environment when architecture, licensing, configuration and operational practices are aligned to requirements.

    Microsoft Entra ID

    Entra ID can provide identity, authentication, MFA, Conditional Access and administrative controls.

    Microsoft Intune

    Intune can help manage devices, configuration, compliance policies and application access.

    Microsoft Defender

    Defender technologies can support endpoint detection, protection and security operations depending on licensing and architecture.

    Microsoft Purview

    Purview can support information protection, sensitivity labeling, DLP, retention, audit and governance.

    SharePoint and OneDrive

    Document storage and collaboration require attention to permissions, sharing, CUI scope and information governance. See SharePoint consulting and OneDrive migration.

    Microsoft Sentinel

    Sentinel can support centralized monitoring, detection and response. Logging and monitoring should connect to documented incident response processes.

    Technology Does Not Equal Compliance

    Microsoft products can support security requirements, but compliance depends on configuration, operation, documentation and evidence.

    Connect Microsoft 365 to CMMC Readiness

    Start with a gap assessment, understand CUI scope, maintain an SSP and track remediation.

    Explore Microsoft 365 consulting, Microsoft 365 security consulting, or CMMC compliance consulting.

    Talk with WS Tech Consulting about Microsoft 365 security and CMMC readiness.

  • What Is CMMC? A Business Guide to CMMC Compliance

    What Is CMMC? A Business Guide to CMMC Compliance

    The Cybersecurity Maturity Model Certification (CMMC) program is designed to strengthen cybersecurity across organizations that support defense contracts and handle certain federal information.

    Why CMMC Exists

    Defense contractors and subcontractors can possess sensitive federal information in nonfederal systems. CMMC establishes a framework for verifying cybersecurity practices associated with applicable contract requirements.

    CMMC Levels

    CMMC includes different levels based on the type of information and cybersecurity requirements involved. Organizations should determine which requirements apply based on their contracts, information and scope.

    Current CMMC Status in 2026

    Official CMMC guidance states that Phase II requirements were suspended on July 13, 2026, while Phase I self-assessment requirements remain in place. Monitor the official CMMC program page for updates.

    CMMC and NIST SP 800-171

    CMMC Level 2 has been tied to NIST SP 800-171 Rev. 2 under the current framework. Learn more in our CMMC and NIST SP 800-171 comparison.

    What Is CUI?

    Controlled Unclassified Information requires safeguarding or dissemination controls under applicable law, regulation or policy. See our CUI and CMMC guide.

    How Businesses Prepare

    1. Understand contract requirements.
    2. Identify systems and information in scope.
    3. Perform a gap assessment.
    4. Develop or update the SSP.
    5. Track remediation.
    6. Implement controls.
    7. Organize evidence.

    Microsoft 365 and CMMC

    Microsoft 365 can be part of a regulated environment, but configuration, licensing, identity, endpoint controls and information handling must be evaluated carefully. Read our CMMC and Microsoft 365 guide.

    Start with CMMC compliance consulting or contact WS Tech Consulting.