Daily operations
Run the safeguards: devices, access, logs, incidents, physical protection, and MSP handoffs.
Find your next step
RSS feed11 guides · Page 1 of 2
- Daily operations
What is a security baseline, and how do I apply it?
A baseline is the written list of settings a set of devices must run. Pilot it on three laptops, check every device, and count only what you can prove.
Andrew Erne - Daily operations
CMMC information flow: CUI in email, sharing links, and support tickets
Map authorized digital routes, test with synthetic data, review forwarding and sharing, and keep evidence of the routes and gaps you actually checked.
Kyle Fahey - Daily operations
Who owns CMMC work when we use an MSP?
Your MSP runs the tools. You decide who gets access, check the result, and sign the annual affirmation. Six lines to add to your MSP agreement before renewal.
Andrew Erne - Daily operations
CMMC certification and readiness costs: build a comparable budget
Separate readiness, implementation, subscriptions and assessment fees. Build a scope-based budget and compare quotes without treating estimates as market guarantees.
Kyle Fahey - Daily operations
What should a 90-day CMMC plan look like if our score lacks a real SSP?
Two weeks finding the facts, three fixing access and scope, four running the routines, four re-scoring. The week-by-week plan and the gates between phases.
Andrew Erne - Daily operations
Which access-control gaps should a small contractor look for first?
Eight engineers approved, nine accounts in the folder, and a backup app nobody owns. Start there, then admin roles and departures. A quarterly review in an hour.
Kyle Fahey - Daily operations
What audit and logging gaps should I check in a SaaS-heavy company?
Entra sign-in logs last 7 days on the free tier. Purview Audit keeps 180 days, Google Workspace 6 months. Know your numbers, then prove you can find last month's event.
Andrew Erne - Daily operations
How can a small contractor run incident response without its own SOC?
Name two people, get your DoD medium-assurance certificate before you need it, and rehearse the first hour. DFARS 7012 gives you 72 hours to report to DC3.
Kyle Fahey - Daily operations
CMMC media protection: CUI on laptops, printers, and USB drives
Follow controlled copies through the shop, separate requirements from example settings, and use a blank inventory and printable handling checklist.
Kyle Fahey
