CMMC can show up on a bid even if you have never thought of your business as a government contractor. I recently had this happen to a small business client who was asked whether they were CMMC Level 1, 2 or 3 and had no idea what the question meant. In this article, I explain FCI, CUI and CMMC in plain language, with examples that make sense for small businesses.

Small government contractors working toward CMMC Level 1 or Level 2 still have to turn cybersecurity requirements into technical controls that actually work. I explain how I approach CMMC technical implementation at SNL-Tech Services, from understanding the existing IT environment and hardening servers, Active Directory and networks to protecting CUI, documenting the environment and maintaining those controls over time.