Which CMMC level do I need?
Five questions on your information, clauses and role give the CMMC level, the assessment type and what applies today.
Scoping & CUI
4 tools, 7 guides, 3 comparisons
Scoping is the cheapest work in CMMC and the work that sets the price of everything after it. A shop that knows where its CUI arrives, where it sits and where it leaves can draw a small boundary and secure what is inside it. A shop that does not ends up securing the whole building.
Start with what the information is, then follow it: the drawing that came in by email, the CAM file on the programming PC, the traveller on the bench.
Tools
CMMC scoping worksheet
List every asset, sort it into the 32 CFR 170.19 Level 2 categories, and export the inventory for your SSP.
ITAR compliance checklist
A printable self-check for small manufacturers: DDTC registration, USML, deemed exports, encryption, licences, records.
Is it CUI?
Six questions on one drawing, spec, email or CAM file give CUI, FCI, public or ask, with the rule for each step.
Comparisons
- Best CMMC enclave options for small contractorsSix ways to put CUI in a small box, from an encrypted file app to one hardened laptop, read against DFARS 7012 and 32 CFR 170.19.6 vendors compared
- ITAR compliance software for small manufacturersFour trade compliance suites and two technical-data tools read against the ITAR: screening, USML, licences, records.6 vendors compared
- FCI vs CUI: which one does your shop hold?FCI from FAR 52.204-21, CUI from 32 CFR 2002, where ITAR technical data fits, and the CMMC level each one triggers.
Guides
- What is CUI?Controlled unclassified information from 32 CFR 2002 and the CUI Registry: categories, Basic vs Specified, who decides, handling.11 min read
- DFARS 252.204-7012 explained, paragraph by paragraphThe safeguarding clause for a small shop: NIST SP 800-171 Rev 2, FedRAMP Moderate cloud, 72-hour reports and 90-day images.16 min read
- What is NIST SP 800-171?The CUI standard explained: what it covers, Rev 2 vs Rev 3 and its parameters, why DoD binds Rev 2, and how 800-171A feeds SPRS.15 min read
- CUI training for a small contractor's staffWhat NIST SP 800-171 3.2.1 to 3.2.3 ask, the free NARA and DoD training, and a staff plan with a printable record.12 min read
- DDTC registration under the ITARWho must register under 22 CFR 122, the exemptions, the DS-2032 in DECCS, the fee tiers, renewal and the five-day rule.13 min read
- What is ITAR compliance?Why no ITAR certificate exists, compliant vs registered, and the six duties the rule puts on a small manufacturer.16 min read
- CUI marking requirementsHow to mark and read CUI: banner, designation block, portion marks, SP-CTI, dissemination controls, email, drawings and media.13 min read
Other topics
- Assessment & SPRSSelf-assessments, the SPRS score and getting ready for an assessor, worked through in plain English.4 tools, 12 guides, 4 comparisons
- SSP, POA&M & policiesThe system security plan, the plan of action and milestones, and the policies behind them: what goes in each and how to keep them current.3 tools, 3 guides, 2 comparisons
- Vendors & cloudCloud suites, email and file sharing, enclaves and service providers, compared on what the rule asks of them.2 guides, 8 comparisons