Vendors & cloud
2 guides, 8 comparisons
Most small shops do not run their own email, file sharing or enclave; they buy one, and the requirements follow the data into the vendor's service.
These comparisons read each vendor's own documentation against what the rule asks of that kind of product, and say so plainly where a vendor does not state something.
Comparisons
- Microsoft GCC High alternatives for small defense contractorsGCC High and five other ways to hold CUI email and files, read against DFARS 7012: FedRAMP status, FIPS, ITAR and incident rules.6 vendors compared
- GCC vs GCC High vs commercial Microsoft 365Which Microsoft cloud fits FCI, CUI and ITAR data: FedRAMP status, DFARS 7012, US-person access and ITAR terms.4 vendors compared
- ITAR-compliant file sharing and cloud storage for small shopsSix places to keep ITAR drawings, read against ITAR and DFARS 7012: FedRAMP listing, FIPS encryption, US data, US-person staff.6 vendors compared
- CMMC and ITAR compliant email for small shopsFive email services read against the rule: FedRAMP status, FIPS encryption, the ITAR carve-out and 7012 incident reporting.5 vendors compared
- CMMC-compliant MSPs: what the provider must meet itselfFive managed service providers read against 32 CFR 170.19: own CMMC status, responsibility matrix, US persons, 72-hour help.5 vendors compared
- ITAR-compliant file transfer for primes and suppliersSFTP and managed file transfer services read against ITAR and DFARS 7012: FedRAMP listing, FIPS encryption, US-person staff and logs.4 vendors compared
- CMMC-compliant ERP for machine shops that hold CUISix job-shop ERPs read against DFARS 7012 and NIST 800-171: FedRAMP status, on-prem option, US-person hosting, MFA and logs.6 vendors compared
- Password managers for CMMC, checked for FedRAMP and FIPSFour password managers read against the rule: FedRAMP listing, FIPS 140 certificate on NIST's list, MFA, offboarding, logs.4 vendors compared
Guides
- What is GCC High?Microsoft 365 GCC High for a small defense shop: who can buy it, what it covers, what changes, and when it is not the answer.13 min read
- FedRAMP Moderate equivalency: what DoD asks of your cloudThe DoD memo behind DFARS 7012's cloud rule: the 24-document body of evidence, who answers for what, 20x classes, and six checks.14 min read
Other topics
- Scoping & CUIFind where CUI lives in a small shop, draw the boundary around it, and sort every laptop, share and machine into or out of scope.4 tools, 7 guides, 3 comparisons
- Assessment & SPRSSelf-assessments, the SPRS score and getting ready for an assessor, worked through in plain English.4 tools, 12 guides, 4 comparisons
- SSP, POA&M & policiesThe system security plan, the plan of action and milestones, and the policies behind them: what goes in each and how to keep them current.3 tools, 3 guides, 2 comparisons