In my last article, I talked about a landscaping client who unexpectedly ran into CMMC while working on a bid. They were asked whether their company was CMMC Level 1, Level 2 or Level 3, and they had no idea how to answer the question. Once a small business figures out that CMMC Level 1 may apply, the next question is usually pretty straightforward. What do I actually have to do? CMMC Level 1 has 15 cybersecurity requirements. On paper, that sounds manageable, especially when

If you own a small business that currently performs work for the Department of War (DoW), or you are considering bidding on DoW contracts for the first time, CMMC Level 1 is something worth understanding before an opportunity lands in front of you. I have seen how quickly this can come up. A client of mine was working on a bid when they came across a question asking for their CMMC level. They own a landscaping company and had never had a reason to think about CMMC before. Now

CMMC can show up on a bid even if you have never thought of your business as a government contractor. I recently had this happen to a small business client who was asked whether they were CMMC Level 1, 2 or 3 and had no idea what the question meant. In this article, I explain FCI, CUI and CMMC in plain language, with examples that make sense for small businesses.

Small government contractors working toward CMMC Level 1 or Level 2 still have to turn cybersecurity requirements into technical controls that actually work. I explain how I approach CMMC technical implementation at SNL-Tech Services, from understanding the existing IT environment and hardening servers, Active Directory and networks to protecting CUI, documenting the environment and maintaining those controls over time.