Tag: CMMC compliance

  • CMMC Level 2: Requirements, Readiness and Assessment Guide

    CMMC Level 2: Requirements, Readiness and Assessment Guide

    CMMC Level 2 is intended for organizations that need to protect Controlled Unclassified Information in applicable defense contracting environments.

    Current Program Status

    As of September 2026, official CMMC guidance states that Phase II requirements were suspended in July 2026 while Phase I self-assessment requirements remain active. Verify current obligations against contracts and official guidance.

    NIST SP 800-171 Alignment

    Under the current framework, Level 2 has been aligned to the 110 security requirements in NIST SP 800-171 Rev. 2. NIST Rev. 3 has superseded Rev. 2 as a NIST publication, but current CMMC materials continue to reference Rev. 2 pending future changes.

    Core Readiness Areas

    • System and CUI scope
    • Access control
    • Identification and authentication
    • Configuration management
    • Audit and accountability
    • Incident response
    • Media protection
    • Personnel security
    • System and communications protection
    • System and information integrity

    Documentation Matters

    See our CMMC SSP guide and POA&M guide.

    Gap Assessment

    A structured CMMC gap assessment can identify missing controls and evidence gaps.

    Microsoft 365 Considerations

    See CMMC and Microsoft 365.

    Explore CMMC compliance consulting or contact WS Tech Consulting.

  • CMMC POA&M: Plan of Action and Milestones Explained

    CMMC POA&M: Plan of Action and Milestones Explained

    A Plan of Action and Milestones is used to document identified cybersecurity deficiencies and actions planned to correct them.

    What a POA&M Tracks

    • Identified deficiency
    • Required remediation
    • Responsible owner
    • Dependencies
    • Target completion date
    • Status and evidence

    Not a Substitute for Implementation

    A remediation plan does not mean a requirement is implemented.

    Connect POA&M to the SSP

    The SSP describes the environment, while the POA&M tracks unresolved work where permitted.

    Prioritize Remediation

    Consider impact, security risk, dependencies, technical complexity and assessment timing.

    Use the Gap Assessment

    A CMMC gap assessment can identify work that needs remediation.

    Microsoft Remediation

    Common work can involve identity, MFA, Conditional Access, endpoint configuration, logging, data protection and permissions. Explore Microsoft 365 security consulting.

    Visit CMMC Compliance Consulting.

  • CMMC and Controlled Unclassified Information (CUI): What Businesses Need to Know

    CMMC and Controlled Unclassified Information (CUI): What Businesses Need to Know

    Controlled Unclassified Information is one of the most important concepts in CMMC and NIST SP 800-171 planning.

    Why CUI Affects CMMC Scope

    Systems that process, store or transmit CUI—and systems that provide security protection—can affect compliance scope.

    Map CUI Flows

    Document how CUI enters the organization, where it is stored, who accesses it, how it is shared and how it leaves or is destroyed.

    Control Access

    Access should be limited according to business need and applicable requirements.

    Protect CUI in Microsoft 365

    Evaluate licensing, configuration, data location, permissions and security requirements before placing CUI into a service.

    See CMMC and Microsoft 365 and Microsoft 365 consulting.

    CUI and the SSP

    Your System Security Plan should accurately describe relevant systems and boundaries.

    Start With Scope Before Buying Tools

    Understand the CUI environment and applicable requirements before choosing technology.

    Our CMMC compliance consulting approach starts with environment, scope, requirements and gaps.

  • CMMC and Microsoft 365: Security and Compliance Considerations

    CMMC and Microsoft 365: Security and Compliance Considerations

    Microsoft 365 is widely used for identity, email, collaboration, files, endpoint management and information protection. For defense contractors, those capabilities can become part of a CMMC-focused environment when architecture, licensing, configuration and operational practices are aligned to requirements.

    Microsoft Entra ID

    Entra ID can provide identity, authentication, MFA, Conditional Access and administrative controls.

    Microsoft Intune

    Intune can help manage devices, configuration, compliance policies and application access.

    Microsoft Defender

    Defender technologies can support endpoint detection, protection and security operations depending on licensing and architecture.

    Microsoft Purview

    Purview can support information protection, sensitivity labeling, DLP, retention, audit and governance.

    SharePoint and OneDrive

    Document storage and collaboration require attention to permissions, sharing, CUI scope and information governance. See SharePoint consulting and OneDrive migration.

    Microsoft Sentinel

    Sentinel can support centralized monitoring, detection and response. Logging and monitoring should connect to documented incident response processes.

    Technology Does Not Equal Compliance

    Microsoft products can support security requirements, but compliance depends on configuration, operation, documentation and evidence.

    Connect Microsoft 365 to CMMC Readiness

    Start with a gap assessment, understand CUI scope, maintain an SSP and track remediation.

    Explore Microsoft 365 consulting, Microsoft 365 security consulting, or CMMC compliance consulting.

    Talk with WS Tech Consulting about Microsoft 365 security and CMMC readiness.

  • What Is CMMC? A Business Guide to CMMC Compliance

    What Is CMMC? A Business Guide to CMMC Compliance

    The Cybersecurity Maturity Model Certification (CMMC) program is designed to strengthen cybersecurity across organizations that support defense contracts and handle certain federal information.

    Why CMMC Exists

    Defense contractors and subcontractors can possess sensitive federal information in nonfederal systems. CMMC establishes a framework for verifying cybersecurity practices associated with applicable contract requirements.

    CMMC Levels

    CMMC includes different levels based on the type of information and cybersecurity requirements involved. Organizations should determine which requirements apply based on their contracts, information and scope.

    Current CMMC Status in 2026

    Official CMMC guidance states that Phase II requirements were suspended on July 13, 2026, while Phase I self-assessment requirements remain in place. Monitor the official CMMC program page for updates.

    CMMC and NIST SP 800-171

    CMMC Level 2 has been tied to NIST SP 800-171 Rev. 2 under the current framework. Learn more in our CMMC and NIST SP 800-171 comparison.

    What Is CUI?

    Controlled Unclassified Information requires safeguarding or dissemination controls under applicable law, regulation or policy. See our CUI and CMMC guide.

    How Businesses Prepare

    1. Understand contract requirements.
    2. Identify systems and information in scope.
    3. Perform a gap assessment.
    4. Develop or update the SSP.
    5. Track remediation.
    6. Implement controls.
    7. Organize evidence.

    Microsoft 365 and CMMC

    Microsoft 365 can be part of a regulated environment, but configuration, licensing, identity, endpoint controls and information handling must be evaluated carefully. Read our CMMC and Microsoft 365 guide.

    Start with CMMC compliance consulting or contact WS Tech Consulting.