Index of CMMC Audit Topics and Articles

General CMMC information (non-technical)

New to CMMC? Start here

CMMC Basics – the Full Details

CMMC Level 1 certification and preparation (how-to)

CMMC Compliance FAQs – Organizations seeking certification

CMMC Glossary, Terms, and Definitions. Who’s who in CMMC

What is FCI in CMMC and how does it affect scope?

CMMC “allowable cost” discussion and thoughts

DFARS 252.204-7012 or 252.204-7021 enforces NIST 800-171

How to submit a NIST SP 800-171 self assessment to SPRS


Cybersecurity topics (for practitioners)

How to read and use the CMMC. Geared towards internal cybersecurity team members.

Policy templates and tools for CMMC and 800-171. Most popular page on the site. Free and no-registration resources that you will want to include in your cybersecurity program.

How to become a CMMC auditor or certifier

CMMC Auditor Training Resources

Review of CMMC Registered Practitioner Training

Getting started with DFARS 252.204-7012

Getting started with NIST SP 800-171

Introducing the CMMC Kill Chain – Zero to full compliance


Practice and Process deep-dives (for practitioners)

CMMC, CUI, and Cloud Vendors – do you need FedRAMP? Deep dive on DFARS requirement to use only FedRAMP Moderate + clouds (or equivalent), and why this is important.

Remote Management & Access Tools for 800-171 and CMMC. Deep dive on choosing a compliant remote management toolset for your helpdesk.

CMMC PS.2.127 Personnel Screening and US Citizen discussion. Considerations for building a screening program, discusses marijuana use in legalized states and citizenship requirements in the CMMC.

CMMC ML.2.999 Developing an effective CMMC Policy. Video from CMU SEI (co-authors of the CMMC Model) about developing good policies to support Maturity Level 2 and above

CMMC ML.4.996 Review and measure [DOMAIN NAME] activities for effectiveness. Video from CMU SEI (co-authors of the CMMC Model) about their intention for Maturity Level 4.

Address 19 CMMC Practices with Cybersecurity Training. Article describing how a cybersecurity training program either fully meets or contributes to meeting 19 different practice requirements within the CMMC.


CMMC News Updates and Related Articles

CMMC News Rollup October 6, 2020. DFARS Interim rule, Registered Practitioner track update, CUI Resources from DoD

September 28, 2020: CMMC News Roundup. DFARS Interim rule, OxBridge Lessons-Learned paper.

September 9, 2020: CMMC News Roundup. Incident handling tips, CMMC-AB “Sponsorship” drama, scoping your CMMC assessment, M365 GCC High features.

August 26, 2020: CMMC News Rollup. DAU webinar introduces CMMC requirements for MSPs, first pathfinder assessments started

August 15, 2020: When is a conformity assessment not a conformity assessment? (hint – it is CMMC). Guest article about CMMC hurdles

August 10, 2020: CMMC Provisional Auditor program opt-ins. Provisional assessors invited to apply (closed now)

July 31, 2020: CMMC Rollout Status – Taking stock

July 30, 2020: CMMC news round-up

June 29, 2020: A Practitioner’s thoughts on CMMC

June 22, 2020: CMMC news: CMMC AB opens registration for C3PAOs and Assessors

May 22, 2020: CMMC News – Auditor Training Update

May 21, 2020: CMMC News

February 4, 2020: CMMC Version 1.0 Released – Analysis for DoD contractors