Guides
24 guides in 4 topics
Each guide takes one rule, clause or decision and reads it for a small defense shop: what the text says, what is in force today, and what to do on Monday. Every rule is quoted from its primary source with the date we read it.
- What is CUI?Controlled unclassified information from 32 CFR 2002 and the CUI Registry: categories, Basic vs Specified, who decides, handling.11 min read
- DFARS 252.204-7012 explained, paragraph by paragraphThe safeguarding clause for a small shop: NIST SP 800-171 Rev 2, FedRAMP Moderate cloud, 72-hour reports and 90-day images.16 min read
- What is NIST SP 800-171?The CUI standard explained: what it covers, Rev 2 vs Rev 3 and its parameters, why DoD binds Rev 2, and how 800-171A feeds SPRS.15 min read
- CUI training for a small contractor's staffWhat NIST SP 800-171 3.2.1 to 3.2.3 ask, the free NARA and DoD training, and a staff plan with a printable record.12 min read
- DDTC registration under the ITARWho must register under 22 CFR 122, the exemptions, the DS-2032 in DECCS, the fee tiers, renewal and the five-day rule.13 min read
- What is ITAR compliance?Why no ITAR certificate exists, compliant vs registered, and the six duties the rule puts on a small manufacturer.16 min read
- CUI marking requirementsHow to mark and read CUI: banner, designation block, portion marks, SP-CTI, dissemination controls, email, drawings and media.13 min read
- CMMC status today: Phase 2 suspended, what still appliesWhat binds today, every CMMC date with its source, a quarter plan for small shops, and the triggers that would change the status.11 min read
- What is CMMC compliance?The CMMC program in plain words: three levels, who needs which, who assesses, SPRS, POA&Ms and what binds today.13 min read
- How to get CMMC certifiedThe path in 8 steps, from scoping to SPRS and the affirmation, with what applies today while Phase 2 is suspended.17 min read
- CMMC Level 2 requirements by familyThe 110 NIST SP 800-171 Rev 2 requirements by family: point weights, the 88 Conditional minimum, the six never on a POA&M.19 min read
- CMMC Level 1 requirements (FAR 52.204-21)The 15 FAR 52.204-21 safeguards explained for a small shop, the evidence to keep, and the yearly SPRS self-assessment.16 min read
- DFARS 252.204-7019 and -7020: the SPRS score clausesThe two SPRS score clauses for a small shop: the Basic self-assessment, the 3-year clock, Medium and High, and what the deviation changes.15 min read
- CMMC requirements for small businessesWhat CMMC asks of a 5 to 50 person shop today: no size exemption, Level 1 or 2 (Self), DoD's own cost figures and free help.13 min read
- What is a CMMC RPO?What a Registered Practitioner Organization can and cannot do, RPO vs C3PAO, and how to check a Marketplace listing.13 min read
- What is a C3PAO?What C3PAO stands for, what a CMMC third-party assessor does, how one is authorized, and its role while Phase 2 is suspended.12 min read
- CMMC deadline: the dates that bind your shop todayThe phase dates as Part 170 wrote them, what the suspension changed, the clocks that still run, and a helper for your SPRS dates.9 min read
- SPRS login and how to submit your SPRS scorePIEE access, the SPRS Cyber Vendor User role, a NIST Basic score or a CMMC self-assessment, the affirmation and the CMMC UID.18 min read
- NIST 800-171 controls by familyAll 110 Rev 2 requirements in NIST's words, by family: CMMC ids, basic or derived, Rev 3 names. Searchable, with a link per row.14 min read
- What is a POA&M?What a plan of action and milestones holds, what 32 CFR 170.21 lets you leave open and for how long, and what a good row looks like.12 min read
- What is a system security plan?What NIST 3.12.4 asks the SSP to describe, what goes in each part, what an assessor reads in it, and why no current SSP means no score.13 min read
- NIST SP 800-88 media sanitization for a machine shopClear, purge or destroy under NIST SP 800-88 Rev 2, the decision flow, 800-171 3.8.3, and a printable certificate.17 min read
- What is GCC High?Microsoft 365 GCC High for a small defense shop: who can buy it, what it covers, what changes, and when it is not the answer.13 min read
- FedRAMP Moderate equivalency: what DoD asks of your cloudThe DoD memo behind DFARS 7012's cloud rule: the 24-document body of evidence, who answers for what, 20x classes, and six checks.14 min read