CMMC Phase II Is Suspended — What Small Contractors Still Must Do
What the July 2026 suspension changed, what it didn't, and the steps to take now.
Insights
Practical guidance on CMMC, security compliance, and AI governance — written for small and mid-sized organizations.
Every article lists its sources and is reviewed by our security leadership.
CMMC & NIST 800-171
Defense contractor requirements: CMMC levels, NIST SP 800-171, DFARS, SPRS scores, SSPs, and POA&Ms.
CMMC Level 2 Readiness Guide: From Scoping to Assessment
The full Level 2 roadmap in eight phases — what to do, in what order, and what you should have at the end of each.
CMMC Level 1 vs. Level 2: Which One Applies to You?
FCI vs. CUI, 15 vs. 110 requirements, and how assessments differ.
CMMC Level 2 Requirements: All 14 Families Explained
The 110 requirements of NIST SP 800-171 Rev. 2, family by family, plus scoring, POA&M limits, and how Level 2 is assessed.
What Is CUI? A Plain-English Guide for Contractors
How to recognize Controlled Unclassified Information, how it's marked, and what protecting it requires of your business.
DFARS 252.204-7012 Explained
What the clause requires — NIST SP 800-171, 72-hour incident reporting, cloud rules, and flowdown — in plain English.
What Is an SPRS Score (and How to Calculate It)?
How the 110-point NIST SP 800-171 score works, the 1-, 3-, and 5-point weights, the 88-point threshold, and where the score is required.
POA&M Guide: What a Plan of Action and Milestones Needs (with Template)
What goes in each POA&M entry, CMMC's 80% and 180-day rules, and a template you can copy.
System Security Plan (SSP): What It Is and What Goes In It
What NIST SP 800-171 requires in an SSP, a section-by-section outline, and the mistakes assessors find most often.
What Is a C3PAO? How CMMC Assessments Work
Who C3PAOs are, how they're vetted, what happens during a Level 2 certification assessment, and how a readiness consultant differs.
How Much Does CMMC Certification Cost?
DoD's official cost estimates for each CMMC level, what they leave out, and how to keep your total cost down.
CMMC Enclaves: When Scoping Down Makes Sense
How CMMC scoping works, when a CUI enclave reduces cost and effort, and the trade-offs to weigh first.
CMMC Self-Assessment: How to Do It (and Affirm It) Correctly
A step-by-step guide to Level 1 and Level 2 self-assessments, SPRS entries, POA&M rules, and affirmations.
CMMC vs. NIST 800-171: How They Fit Together
NIST 800-171 is the what; CMMC is the proof. How the requirements, the DFARS clauses, and FedRAMP connect.
NIST 800-171 Compliance Checklist
Scoping, the 14 requirement families, documentation, and SPRS: a step-by-step checklist for small defense contractors.
NIST SP 800-171 Rev. 3: What Changed and When It Applies
97 requirements, 17 families, organization-defined parameters, and why DoD contractors still implement Rev. 2.
vCISO & Compliance
Building a security program without a full-time CISO: risk, policies, questionnaires, and audits.
vCISO vs. Full-Time CISO: Cost, Scope, and When to Switch
What each model costs, what each one actually does, and the signals that it's time to move from fractional to full-time.
How to Scope a vCISO Engagement: Outcomes, Roles, and Cost
A practical framework for defining what your vCISO owns, how you work together, how you measure progress, and what drives the price.
How to Answer Security Questionnaires: SIG, CAIQ, and Custom Forms
Why customers send security questionnaires, how SIG and CAIQ work, and how to build a reusable answer library that speeds up every deal.
Cybersecurity Risk Register: What It Is and How to Build One
What a risk register is, the fields to include, a sample entry, and how to keep it useful instead of a forgotten spreadsheet.
Incident Response Plan Template for Small Businesses
What an incident response plan must cover, a fill-in template you can adapt today, and the extra reporting steps defense contractors owe DoD under DFARS 252.204-7012.
HIPAA Security Risk Assessment: A Practical Guide
What 45 CFR 164.308(a)(1)(ii)(A) actually requires, a step-by-step method based on HHS guidance, and the documentation that holds up when OCR asks for it.
How Much Does ISO 27001 Certification Cost?
The real cost components of ISO 27001 certification over the full three-year cycle, what makes them go up or down, and how to budget without surprises.
ISO 27001 vs. SOC 2: Which Do Your Customers Want?
How ISO 27001 certification and SOC 2 reports differ, which customers ask for which, and how to prepare for one without wasting work on the other.
Vendor Risk Management for Small Businesses
How to inventory your vendors, tier them by risk, review the ones that matter, and keep the process light enough for a small team to run.
Information Security Policy Template: The Core Policy Set
The policies a small or mid-sized organization actually needs, what goes in each, and a section-by-section template for the top-level information security policy.
AI Security & Governance
Adopting AI and agentic tools safely: governance, policy, and secure design.
AI Acceptable Use Policy: What to Include
The 12 sections a practical AI acceptable use policy needs — from approved tools and data rules to AI agents, incident reporting, and enforcement.
ISO/IEC 42001 Explained: AI Management Systems for Mid-Sized Companies
What ISO/IEC 42001 requires, how it relates to ISO 27001 and the NIST AI RMF, how certification works, and a practical path to readiness.
AI Governance for Small and Mid-Sized Businesses
A right-sized AI governance program for growing businesses: ownership, an AI inventory, policy, risk review, and oversight, without enterprise overhead.
OWASP Top 10 for LLM Applications: A Guide for Business Leaders
Each of the ten OWASP LLM risks in plain English, the business questions to ask, and how the newer OWASP Top 10 for Agentic Applications fits in.
Need help applying this?
Tell us what you're facing — a CMMC requirement, a customer questionnaire, an audit, or no security program at all. We'll reply within one business day with a recommended next step.