Work through the decisions behind your scope, score, and safeguards. Practical guides from the Garde1 team, with examples you can use.
Yes. The pause cancelled the November 2026 certificate deadline, not the security work. What stopped, what still applies, and how to spend money now.
Kyle Fahey
Scope is what touches CUI plus what protects it, sorted into five categories the rule defines. How to draw the line, and one 24-person shop's scope, asset by asset.
Kyle Fahey
The whole SPRS path, from getting the PIEE role to the Affirm button, plus the check that stops you from submitting a score your evidence can't back up.
Kyle FaheyCMMC for CNC and job shops: drawings, programs, machines, platers, and primes.
13 guidesWhat applies now, which revision to use, and what each CMMC level means.
5 guidesFollow the information through people, systems, locations, and providers.
9 guidesWork through scoring, eligibility, submission, affirmation, and corrections.
10 guidesCompare Microsoft, Google Workspace, VDI, and the commitments behind a service.
10 guidesBuild a record that connects your environment, responsibilities, and operating evidence.
7 guidesUnderstand the request, identify its basis, and answer with facts you can support.
3 guidesRun the safeguards: devices, access, logs, incidents, physical protection, and MSP handoffs.
11 guidesCMMC Level 1 for contractors who handle only FCI: the 15 requirements, the yearly affirmation, and what primes ask for.
5 guidesFrom the operating environment
Working designs for the shop floor, development teams, shared IT, and supplier risk. Choices, tradeoffs, and the checks that make them credible.
Note 01 · Shop floor
Office PCs get no route to controllers, programs move through one transfer station, and vendors get a timed MFA session. Five firewall rules and how to test them.
Andrew ErneNote 02 · Lean setups
Three managed CAM workstations, no cloud CAD on CUI jobs, and the overflow programmer held until they're covered. Follow one job to find every copy.
Kyle Fahey69 guides · Page 1 of 8
Yes. The pause cancelled the November 2026 certificate deadline, not the security work. What stopped, what still applies, and how to spend money now.
Kyle FaheyTwenty items, one framework, and a CIO who talks like an operator. What the campaign the CIO published alongside the review tells you to do before the task force report lands.
Kyle FaheyThe whole SPRS path, from getting the PIEE role to the Affirm button, plus the check that stops you from submitting a score your evidence can't back up.
Kyle FaheyThree layers: what DoD requires through your contract clauses, what you already signed, and what the prime simply prefers. Only the first two bind you.
Follow one CUI drawing through your tenant. Every place it lands, and every admin who can reach it, is in your boundary. Two SharePoint settings close most of the leaks.
Andrew ErneYes. Keep CUI in Workspace Enterprise Plus with Assured Controls Plus, or keep it out of Workspace entirely. What to buy, what Google does and doesn't commit to, and the Chromebook test that catches the leaks.
Kyle FaheyFCI only: stay on Commercial. Technical drawings or ITAR data: GCC High. Other CUI: GCC, which Microsoft backs for DFARS 7012. How to tell from your own drawings, and what buying and moving really take.
Andrew ErneMarked, or named as CUI in the contract: Level 2, 110 requirements. Other nonpublic contract info is FCI: Level 1, 15. How to tell, and the email to send the prime.
Kyle FaheyCMMC Level 2 and DFARS 7012 still use Rev. 2's 110 controls. What Rev. 3 changed, why it doesn't apply yet, and the one thing worth doing now.
Kyle Fahey
