Tag: CMMC Level 2

  • CMMC Readiness Transformation for a Federal Contractor

    Preparing for CMMC compliance consulting requires more than documentation. Organizations handling Controlled Unclassified Information need to understand their environment, implement applicable controls, document how those controls operate, and prepare evidence for assessment.

    The Challenge

    The client was a federal contractor that needed to move from a non-CMMC-compliant environment toward an assessment-ready security program aligned with CMMC and NIST 800-171.

    The Approach

    We assessed the environment against applicable NIST 800-171 requirements, identified gaps, prioritized remediation, mapped controls to the technology environment, and developed supporting documentation and evidence.

    Implementation

    The engagement included control implementation, security configuration, policy and procedure development, SSP and POA&M support, and evidence preparation. The goal was to connect documentation to actual technical and operational controls.

    Assessment Preparation

    The organization progressed toward an assessment-ready position by connecting controls, documentation, ownership and evidence into a structured compliance program.

    Outcome

    The project moved the contractor from an informal security posture toward a documented, controlled and assessment-focused environment.

    Microsoft technology can also provide a foundation for identity, endpoint, collaboration and data controls. See Microsoft 365 consulting.

    Contact WS Tech Consulting to discuss CMMC readiness.

  • CMMC Level 2: Requirements, Readiness and Assessment Guide

    CMMC Level 2: Requirements, Readiness and Assessment Guide

    CMMC Level 2 is intended for organizations that need to protect Controlled Unclassified Information in applicable defense contracting environments.

    Current Program Status

    As of September 2026, official CMMC guidance states that Phase II requirements were suspended in July 2026 while Phase I self-assessment requirements remain active. Verify current obligations against contracts and official guidance.

    NIST SP 800-171 Alignment

    Under the current framework, Level 2 has been aligned to the 110 security requirements in NIST SP 800-171 Rev. 2. NIST Rev. 3 has superseded Rev. 2 as a NIST publication, but current CMMC materials continue to reference Rev. 2 pending future changes.

    Core Readiness Areas

    • System and CUI scope
    • Access control
    • Identification and authentication
    • Configuration management
    • Audit and accountability
    • Incident response
    • Media protection
    • Personnel security
    • System and communications protection
    • System and information integrity

    Documentation Matters

    See our CMMC SSP guide and POA&M guide.

    Gap Assessment

    A structured CMMC gap assessment can identify missing controls and evidence gaps.

    Microsoft 365 Considerations

    See CMMC and Microsoft 365.

    Explore CMMC compliance consulting or contact WS Tech Consulting.

  • CMMC Gap Assessment: How to Identify Compliance Gaps

    CMMC Gap Assessment: How to Identify Compliance Gaps

    A CMMC gap assessment compares an organization’s current cybersecurity practices and documentation to applicable requirements.

    Start With Scope

    Understand where relevant information is stored, processed and transmitted and which systems provide security protection.

    Review Technical Controls

    Examine identity, access, endpoints, network security, configuration, logging, monitoring and data protection.

    Review Documentation

    Compare actual practices with the System Security Plan, policies, procedures and supporting evidence.

    Identify Evidence Gaps

    Evidence can include configurations, screenshots, logs, policies, procedures, tickets and reports.

    Prioritize Remediation

    A remediation roadmap should identify dependencies, owners, technical work, policy changes and documentation updates.

    Microsoft 365

    A gap assessment may include Entra ID, Intune, Defender, Purview, SharePoint and OneDrive. See Microsoft 365 consulting and CMMC Microsoft 365.

    Next Steps

    A gap assessment can feed an updated SSP and POA&M.

    Learn more about CMMC compliance consulting.

  • CMMC and NIST SP 800-171: What’s the Difference?

    CMMC and NIST SP 800-171: What’s the Difference?

    CMMC and NIST SP 800-171 are closely related, but they are not the same thing.

    What Is NIST SP 800-171?

    NIST SP 800-171 provides security requirements for protecting CUI in certain nonfederal systems and organizations. Rev. 2 contained 110 security requirements. NIST has since superseded Rev. 2 with Rev. 3.

    What Is CMMC?

    CMMC is the defense-sector program used to establish and verify cybersecurity requirements in applicable contracting environments. Under the current framework, CMMC Level 2 references NIST SP 800-171 Rev. 2.

    Why the Revision Difference Matters

    NIST Rev. 3 is current, while CMMC Level 2 materials continue to reference Rev. 2. Follow applicable contracts and current official guidance.

    See the official CMMC page and NIST resources.

    What Businesses Should Do

    1. Confirm contractual requirements.
    2. Identify CUI and system scope.
    3. Assess implementation.
    4. Maintain documentation.
    5. Track remediation.
    6. Monitor program changes.

    Read our NIST SP 800-171 compliance guide, gap assessment guide, and Level 2 guide.

  • CMMC System Security Plan (SSP): What Businesses Need to Know

    CMMC System Security Plan (SSP): What Businesses Need to Know

    A System Security Plan is a foundational document for organizations working with NIST SP 800-171 and CMMC.

    What an SSP Should Describe

    • System boundaries
    • Environment and architecture
    • CUI flows and locations
    • Responsible systems and services
    • Implementation of security requirements
    • Roles and responsibilities
    • Relevant policies and procedures

    Why Accuracy Matters

    An SSP should reflect the actual environment. Generic documentation that does not match real configurations creates assessment risk.

    SSP and CUI Scope

    Read our CUI guide.

    SSP and POA&M

    Outstanding work may need tracking through a POA&M where permitted.

    Microsoft Environment Documentation

    For Microsoft environments, SSP documentation may need to describe identity, endpoints, cloud services, data protection, logging and monitoring. See CMMC and Microsoft 365.

    Keep the SSP Current

    Treat the SSP as a living document and update it when architecture, services or CUI handling change.

    Our CMMC compliance consulting services can support SSP development and remediation planning.

  • CMMC POA&M: Plan of Action and Milestones Explained

    CMMC POA&M: Plan of Action and Milestones Explained

    A Plan of Action and Milestones is used to document identified cybersecurity deficiencies and actions planned to correct them.

    What a POA&M Tracks

    • Identified deficiency
    • Required remediation
    • Responsible owner
    • Dependencies
    • Target completion date
    • Status and evidence

    Not a Substitute for Implementation

    A remediation plan does not mean a requirement is implemented.

    Connect POA&M to the SSP

    The SSP describes the environment, while the POA&M tracks unresolved work where permitted.

    Prioritize Remediation

    Consider impact, security risk, dependencies, technical complexity and assessment timing.

    Use the Gap Assessment

    A CMMC gap assessment can identify work that needs remediation.

    Microsoft Remediation

    Common work can involve identity, MFA, Conditional Access, endpoint configuration, logging, data protection and permissions. Explore Microsoft 365 security consulting.

    Visit CMMC Compliance Consulting.

  • What Is CMMC? A Business Guide to CMMC Compliance

    What Is CMMC? A Business Guide to CMMC Compliance

    The Cybersecurity Maturity Model Certification (CMMC) program is designed to strengthen cybersecurity across organizations that support defense contracts and handle certain federal information.

    Why CMMC Exists

    Defense contractors and subcontractors can possess sensitive federal information in nonfederal systems. CMMC establishes a framework for verifying cybersecurity practices associated with applicable contract requirements.

    CMMC Levels

    CMMC includes different levels based on the type of information and cybersecurity requirements involved. Organizations should determine which requirements apply based on their contracts, information and scope.

    Current CMMC Status in 2026

    Official CMMC guidance states that Phase II requirements were suspended on July 13, 2026, while Phase I self-assessment requirements remain in place. Monitor the official CMMC program page for updates.

    CMMC and NIST SP 800-171

    CMMC Level 2 has been tied to NIST SP 800-171 Rev. 2 under the current framework. Learn more in our CMMC and NIST SP 800-171 comparison.

    What Is CUI?

    Controlled Unclassified Information requires safeguarding or dissemination controls under applicable law, regulation or policy. See our CUI and CMMC guide.

    How Businesses Prepare

    1. Understand contract requirements.
    2. Identify systems and information in scope.
    3. Perform a gap assessment.
    4. Develop or update the SSP.
    5. Track remediation.
    6. Implement controls.
    7. Organize evidence.

    Microsoft 365 and CMMC

    Microsoft 365 can be part of a regulated environment, but configuration, licensing, identity, endpoint controls and information handling must be evaluated carefully. Read our CMMC and Microsoft 365 guide.

    Start with CMMC compliance consulting or contact WS Tech Consulting.