Getting through a CMMC assessment and staying compliant afterwards: running a Level 2 self-assessment, evidence assessors accept, specialized assets such as OT and test equipment, and maintaining status between assessments.
Running a CMMC Level 2 (Self) assessment: the SP 800-171A objectives and scoring rules, what goes into SPRS, the Conditional status and POA&M closeout, evidence retention, affirmations, what happens if the SSP is missing, and DoD's cost estimate.
What counts as evidence in a CMMC assessment: final-form documents only, examine, interview and test methods, sampling, demonstrations assessors expect, hashing and six-year retention, fixing gaps during the assessment, and how operational plans of action and enduring exceptions are scored.
How CMMC treats operational technology, IoT, test equipment, Government furnished equipment and restricted systems: documented but not assessed at Level 2, excluded at Level 1, in scope or segregated at Level 3, and how enduring exceptions are written into the SSP.
Keeping a CMMC status current for three years: annual affirmations, what counts as a change that needs reassessment, security impact analysis, operational plans of action for new deficiencies, ongoing control monitoring, and DoD's right to reassess.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.