Garde1 CMMC resources https://www.garde1.com/resources/cmmc Notes from the Garde1 team on CMMC readiness, DIB security, and what we are building. Wed, 07 Oct 2026 17:51:16 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en-us © 2026 ComplAI Solutions, LLLP <![CDATA[Brilliant at the Basics: why the CIO reached for CSF 2.0]]> https://www.garde1.com/resources/cmmc/brilliant-at-the-basics-csf-2-0 https://www.garde1.com/resources/cmmc/brilliant-at-the-basics-csf-2-0 Wed, 07 Oct 2026 17:04:09 GMT Kyle Fahey <![CDATA[POA&M rules: what you can and cannot leave open]]> https://www.garde1.com/resources/cmmc/cmmc-poam-rules-what-can-stay-open https://www.garde1.com/resources/cmmc/cmmc-poam-rules-what-can-stay-open Thu, 01 Oct 2026 01:45:38 GMT Andrew Erne <![CDATA[How can an MSP offer CMMC readiness without hiring assessors?]]> https://www.garde1.com/resources/cmmc/msp-offer-cmmc-readiness https://www.garde1.com/resources/cmmc/msp-offer-cmmc-readiness Thu, 01 Oct 2026 01:45:38 GMT Andrew Erne <![CDATA[What the Honeywell settlement teaches about your SPRS score]]> https://www.garde1.com/resources/cmmc/honeywell-settlement-sprs-score https://www.garde1.com/resources/cmmc/honeywell-settlement-sprs-score Thu, 01 Oct 2026 01:45:38 GMT Kyle Fahey <![CDATA[What does a C3PAO actually ask for on assessment day?]]> https://www.garde1.com/resources/cmmc/c3pao-assessment-day-what-they-ask https://www.garde1.com/resources/cmmc/c3pao-assessment-day-what-they-ask Thu, 01 Oct 2026 01:45:38 GMT Kyle Fahey <![CDATA[Continuous monitoring is coming to CMMC: what it means for you]]> https://www.garde1.com/resources/cmmc/cmmc-continuous-monitoring https://www.garde1.com/resources/cmmc/cmmc-continuous-monitoring Thu, 01 Oct 2026 01:45:38 GMT Kyle Fahey <![CDATA[How many CMMC controls does Microsoft 365 GCC High cover (vs GCC and Commercial)?]]> https://www.garde1.com/resources/cmmc/microsoft-365-gcc-high-cmmc-controls-covered https://www.garde1.com/resources/cmmc/microsoft-365-gcc-high-cmmc-controls-covered Wed, 30 Sep 2026 17:44:57 GMT Andrew Erne <![CDATA[How many CMMC controls does PreVeil cover?]]> https://www.garde1.com/resources/cmmc/preveil-cmmc-controls-covered https://www.garde1.com/resources/cmmc/preveil-cmmc-controls-covered Wed, 30 Sep 2026 17:44:57 GMT Kyle Fahey <![CDATA[How many CMMC controls does CrowdStrike Falcon cover?]]> https://www.garde1.com/resources/cmmc/crowdstrike-falcon-cmmc-controls https://www.garde1.com/resources/cmmc/crowdstrike-falcon-cmmc-controls Wed, 30 Sep 2026 17:44:57 GMT Kyle Fahey <![CDATA[How many CMMC controls does AWS GovCloud cover?]]> https://www.garde1.com/resources/cmmc/aws-govcloud-cmmc-controls-covered https://www.garde1.com/resources/cmmc/aws-govcloud-cmmc-controls-covered Wed, 30 Sep 2026 17:44:57 GMT Andrew Erne <![CDATA[How many CMMC controls does Google Workspace cover?]]> https://www.garde1.com/resources/cmmc/google-workspace-cmmc-controls-covered https://www.garde1.com/resources/cmmc/google-workspace-cmmc-controls-covered Wed, 30 Sep 2026 17:44:57 GMT Andrew Erne <![CDATA[Does a machine shop have to register for ITAR if it never exports?]]> https://www.garde1.com/resources/cmmc/itar-registration-machine-shop https://www.garde1.com/resources/cmmc/itar-registration-machine-shop Wed, 30 Sep 2026 07:22:16 GMT Andrew Erne <![CDATA[Swiss Automation paid $421,234 over drawing security. What does that mean for your shop?]]> https://www.garde1.com/resources/cmmc/swiss-automation-false-claims-machine-shop https://www.garde1.com/resources/cmmc/swiss-automation-false-claims-machine-shop Wed, 30 Sep 2026 07:22:16 GMT Andrew Erne <![CDATA[Is this drawing CUI? How a machine shop reads the title block]]> https://www.garde1.com/resources/cmmc/is-this-drawing-cui-machine-shop https://www.garde1.com/resources/cmmc/is-this-drawing-cui-machine-shop Wed, 30 Sep 2026 07:22:16 GMT Andrew Erne <![CDATA[How do you get programs to a Windows XP CNC control under CMMC?]]> https://www.garde1.com/resources/cmmc/cnc-program-transfer-old-controls-cmmc https://www.garde1.com/resources/cmmc/cnc-program-transfer-old-controls-cmmc Wed, 30 Sep 2026 07:22:16 GMT Kyle Fahey <![CDATA[Does a machine shop need GCC High? How to decide on Microsoft 365]]> https://www.garde1.com/resources/cmmc/machine-shop-microsoft-365-gcc-high https://www.garde1.com/resources/cmmc/machine-shop-microsoft-365-gcc-high Wed, 30 Sep 2026 07:22:16 GMT Andrew Erne <![CDATA[Who should actually do the CMMC work in a small machine shop?]]> https://www.garde1.com/resources/cmmc/machine-shop-cmmc-who-does-the-work https://www.garde1.com/resources/cmmc/machine-shop-cmmc-who-does-the-work Wed, 30 Sep 2026 07:22:16 GMT Kyle Fahey <![CDATA[Can your ERP and CAM software hold a controlled drawing?]]> https://www.garde1.com/resources/cmmc/machine-shop-software-cui-erp-cam https://www.garde1.com/resources/cmmc/machine-shop-software-cui-erp-cam Wed, 30 Sep 2026 07:22:16 GMT Kyle Fahey <![CDATA[What does CMMC really cost a small machine shop, and is defense work still worth it?]]> https://www.garde1.com/resources/cmmc/cmmc-cost-small-machine-shop https://www.garde1.com/resources/cmmc/cmmc-cost-small-machine-shop Wed, 30 Sep 2026 07:22:16 GMT Kyle Fahey <![CDATA[Can I send a controlled drawing to my plater or heat treater?]]> https://www.garde1.com/resources/cmmc/outside-processors-cui-machine-shop https://www.garde1.com/resources/cmmc/outside-processors-cui-machine-shop Wed, 30 Sep 2026 07:22:16 GMT Andrew Erne <![CDATA[What does my prime's CMMC questionnaire actually require of my shop?]]> https://www.garde1.com/resources/cmmc/prime-supplier-questionnaire-machine-shop https://www.garde1.com/resources/cmmc/prime-supplier-questionnaire-machine-shop Wed, 30 Sep 2026 07:22:16 GMT Kyle Fahey <![CDATA[A controlled drawing just landed in our quote inbox. Now what?]]> https://www.garde1.com/resources/cmmc/quoting-cui-drawings-machine-shop https://www.garde1.com/resources/cmmc/quoting-cui-drawings-machine-shop Wed, 30 Sep 2026 07:22:16 GMT Kyle Fahey <![CDATA[Can machinists share one login on the shop floor PC under CMMC?]]> https://www.garde1.com/resources/cmmc/shop-floor-shared-logins-cmmc https://www.garde1.com/resources/cmmc/shop-floor-shared-logins-cmmc Wed, 30 Sep 2026 07:22:16 GMT Andrew Erne <![CDATA[CMMC for a machine shop: from the Microsoft 365 inbox to the CNC mill]]> https://www.garde1.com/resources/cmmc/cmmc-machine-shop-drawing-to-cnc https://www.garde1.com/resources/cmmc/cmmc-machine-shop-drawing-to-cnc Wed, 30 Sep 2026 06:33:16 GMT Kyle Fahey <![CDATA[Check that the sub's CMMC status covers the shop doing the work]]> https://www.garde1.com/resources/cmmc/field-notes-prime-subcontractor-assurance https://www.garde1.com/resources/cmmc/field-notes-prime-subcontractor-assurance Tue, 29 Sep 2026 06:56:57 GMT Andrew Erne <![CDATA[Your CUI boundary includes the build path]]> https://www.garde1.com/resources/cmmc/field-notes-software-team-build-boundary https://www.garde1.com/resources/cmmc/field-notes-software-team-build-boundary Tue, 29 Sep 2026 06:56:57 GMT Andrew Erne <![CDATA[Put one transfer station between engineering and the CNC cell]]> https://www.garde1.com/resources/cmmc/field-notes-cnc-shop-segmentation https://www.garde1.com/resources/cmmc/field-notes-cnc-shop-segmentation Tue, 29 Sep 2026 06:56:57 GMT Andrew Erne <![CDATA[Five people handle CUI. Build the setup around the five.]]> https://www.garde1.com/resources/cmmc/field-notes-small-cui-team https://www.garde1.com/resources/cmmc/field-notes-small-cui-team Tue, 29 Sep 2026 06:56:57 GMT Kyle Fahey <![CDATA[Two plants share IT, so scope them as one environment]]> https://www.garde1.com/resources/cmmc/field-notes-multi-site-shared-it https://www.garde1.com/resources/cmmc/field-notes-multi-site-shared-it Tue, 29 Sep 2026 06:56:57 GMT Kyle Fahey <![CDATA[Twelve Macs: pick the pairing your MSP already runs]]> https://www.garde1.com/resources/cmmc/field-notes-mac-management-endpoint-pairings https://www.garde1.com/resources/cmmc/field-notes-mac-management-endpoint-pairings Tue, 29 Sep 2026 06:56:57 GMT Andrew Erne <![CDATA[A lean CUI setup for a CAD/CAM programming shop]]> https://www.garde1.com/resources/cmmc/field-notes-cad-cam-programming-shop https://www.garde1.com/resources/cmmc/field-notes-cad-cam-programming-shop Tue, 29 Sep 2026 06:56:57 GMT Kyle Fahey <![CDATA[An instrument PC you can't patch: document it, isolate it, keep a spare]]> https://www.garde1.com/resources/cmmc/field-notes-legacy-test-lab https://www.garde1.com/resources/cmmc/field-notes-legacy-test-lab Tue, 29 Sep 2026 06:56:57 GMT Kyle Fahey <![CDATA[What belongs in my Microsoft 365 CUI boundary?]]> https://www.garde1.com/resources/cmmc/microsoft-365-cui-boundary-cmmc-pause https://www.garde1.com/resources/cmmc/microsoft-365-cui-boundary-cmmc-pause Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Is my contract information FCI or CUI?]]> https://www.garde1.com/resources/cmmc/fci-cui-data-classification https://www.garde1.com/resources/cmmc/fci-cui-data-classification Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How do I submit a CMMC Level 2 self-assessment in SPRS?]]> https://www.garde1.com/resources/cmmc/cmmc-level-2-self-assessment-sprs https://www.garde1.com/resources/cmmc/cmmc-level-2-self-assessment-sprs Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Does changing a security tool or MSP affect my CMMC assessment?]]> https://www.garde1.com/resources/cmmc/cmmc-vendor-change-reassessment https://www.garde1.com/resources/cmmc/cmmc-vendor-change-reassessment Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Do I still need CMMC after the Phase 2 pause?]]> https://www.garde1.com/resources/cmmc/cmmc-july-2026-pause-dfars-7012 https://www.garde1.com/resources/cmmc/cmmc-july-2026-pause-dfars-7012 Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How do CMMC requirements, policies, and evidence fit together?]]> https://www.garde1.com/resources/cmmc/how-to-understand-cmmc https://www.garde1.com/resources/cmmc/how-to-understand-cmmc Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[How do I keep my SSP and SPRS assessment describing the same environment?]]> https://www.garde1.com/resources/cmmc/ssp-sprs-same-scope https://www.garde1.com/resources/cmmc/ssp-sprs-same-scope Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Can one CMMC assessment cover multiple CAGE codes or entities?]]> https://www.garde1.com/resources/cmmc/cmmc-multiple-cage-entities-scope https://www.garde1.com/resources/cmmc/cmmc-multiple-cage-entities-scope Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How do CMMC physical controls work across leased and home offices?]]> https://www.garde1.com/resources/cmmc/cmmc-physical-home-leased-office https://www.garde1.com/resources/cmmc/cmmc-physical-home-leased-office Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[What should I do if I cannot support my SPRS score?]]> https://www.garde1.com/resources/cmmc/unsupported-sprs-score-risk https://www.garde1.com/resources/cmmc/unsupported-sprs-score-risk Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Can I use Google Workspace for CMMC Level 2?]]> https://www.garde1.com/resources/cmmc/google-workspace-cui-boundary-cmmc-pause https://www.garde1.com/resources/cmmc/google-workspace-cui-boundary-cmmc-pause Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How should I answer a prime’s CMMC letter during the pause?]]> https://www.garde1.com/resources/cmmc/respond-prime-cmmc-letter https://www.garde1.com/resources/cmmc/respond-prime-cmmc-letter Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Does a CMMC-ready marketplace app belong in my approved boundary?]]> https://www.garde1.com/resources/cmmc/cmmc-ready-marketplace-app https://www.garde1.com/resources/cmmc/cmmc-ready-marketplace-app Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Which access-control gaps should a small contractor look for first?]]> https://www.garde1.com/resources/cmmc/small-contractor-access-control-gaps https://www.garde1.com/resources/cmmc/small-contractor-access-control-gaps Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[CMMC media protection: CUI on laptops, printers, and USB drives]]> https://www.garde1.com/resources/cmmc/cui-media-laptops-printers https://www.garde1.com/resources/cmmc/cui-media-laptops-printers Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Which CMMC gaps should I fix first?]]> https://www.garde1.com/resources/cmmc/prioritize-cmmc-remediation https://www.garde1.com/resources/cmmc/prioritize-cmmc-remediation Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[What belongs in a subcontractor security exhibit?]]> https://www.garde1.com/resources/cmmc/subcontractor-security-exhibit https://www.garde1.com/resources/cmmc/subcontractor-security-exhibit Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[CMMC certification and readiness costs: build a comparable budget]]> https://www.garde1.com/resources/cmmc/cmmc-readiness-assessment-cost https://www.garde1.com/resources/cmmc/cmmc-readiness-assessment-cost Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[CMMC Levels 1, 2, and 3: what is the difference?]]> https://www.garde1.com/resources/cmmc/cmmc-level-1-level-2-level-3 https://www.garde1.com/resources/cmmc/cmmc-level-1-level-2-level-3 Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Which subcontractors, consultants, and MSPs belong in my CMMC scope?]]> https://www.garde1.com/resources/cmmc/cmmc-subcontractor-consultant-msp-scope https://www.garde1.com/resources/cmmc/cmmc-subcontractor-consultant-msp-scope Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[What does MET look like in a 20-person company?]]> https://www.garde1.com/resources/cmmc/cmmc-met-small-company https://www.garde1.com/resources/cmmc/cmmc-met-small-company Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How does Garde1 take me from scope to a defensible CMMC record?]]> https://www.garde1.com/resources/cmmc/garde1-cmmc-workflow https://www.garde1.com/resources/cmmc/garde1-cmmc-workflow Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[CMMC mock assessment: scope, evidence, findings, and limitations]]> https://www.garde1.com/resources/cmmc/cmmc-mock-assessment-actual-scope https://www.garde1.com/resources/cmmc/cmmc-mock-assessment-actual-scope Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Who owns CMMC work when we use an MSP?]]> https://www.garde1.com/resources/cmmc/msp-cmmc-division-of-labor https://www.garde1.com/resources/cmmc/msp-cmmc-division-of-labor Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Who signs the CMMC annual affirmation, and what are they signing?]]> https://www.garde1.com/resources/cmmc/cmmc-annual-affirmation https://www.garde1.com/resources/cmmc/cmmc-annual-affirmation Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[What is a security baseline, and how do I apply it?]]> https://www.garde1.com/resources/cmmc/security-baseline-how-to-apply https://www.garde1.com/resources/cmmc/security-baseline-how-to-apply Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[What does FedRAMP Moderate or equivalent mean for my CUI cloud?]]> https://www.garde1.com/resources/cmmc/fedramp-moderate-equivalent-cui https://www.garde1.com/resources/cmmc/fedramp-moderate-equivalent-cui Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Do I still need a Level 2 self-assessment after the CMMC pause?]]> https://www.garde1.com/resources/cmmc/level-2-self-assessment-after-pause https://www.garde1.com/resources/cmmc/level-2-self-assessment-after-pause Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How can a small contractor run incident response without its own SOC?]]> https://www.garde1.com/resources/cmmc/small-business-incident-response-no-soc https://www.garde1.com/resources/cmmc/small-business-incident-response-no-soc Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Can employees use personal devices for CUI work?]]> https://www.garde1.com/resources/cmmc/cmmc-remote-work-byod https://www.garde1.com/resources/cmmc/cmmc-remote-work-byod Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[What is a Customer Responsibility Matrix, and what do shared and inherited mean?]]> https://www.garde1.com/resources/cmmc/customer-responsibility-matrix-shared-inherited https://www.garde1.com/resources/cmmc/customer-responsibility-matrix-shared-inherited Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[What audit and logging gaps should I check in a SaaS-heavy company?]]> https://www.garde1.com/resources/cmmc/saas-audit-logging-cmmc https://www.garde1.com/resources/cmmc/saas-audit-logging-cmmc Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[What can a prime contractor require of me during the CMMC pause?]]> https://www.garde1.com/resources/cmmc/cmmc-pause-prime-contractor-flowdowns https://www.garde1.com/resources/cmmc/cmmc-pause-prime-contractor-flowdowns Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Does a shared Microsoft or Google tenant put the whole company in CMMC scope?]]> https://www.garde1.com/resources/cmmc/shared-tenant-cmmc-scope https://www.garde1.com/resources/cmmc/shared-tenant-cmmc-scope Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[Can an identity or admin connection bring another system into CMMC scope?]]> https://www.garde1.com/resources/cmmc/cmmc-identity-admin-paths https://www.garde1.com/resources/cmmc/cmmc-identity-admin-paths Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[CMMC information flow: CUI in email, sharing links, and support tickets]]> https://www.garde1.com/resources/cmmc/cui-email-files-ticketing https://www.garde1.com/resources/cmmc/cui-email-files-ticketing Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How do I map CUI data flows before choosing security tools?]]> https://www.garde1.com/resources/cmmc/map-cui-data-flows-before-tools https://www.garde1.com/resources/cmmc/map-cui-data-flows-before-tools Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Do I need Microsoft 365 Commercial, GCC, or GCC High?]]> https://www.garde1.com/resources/cmmc/microsoft-commercial-gcc-gcc-high-cmmc https://www.garde1.com/resources/cmmc/microsoft-commercial-gcc-gcc-high-cmmc Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[Should my CMMC scope be an enclave or the whole company?]]> https://www.garde1.com/resources/cmmc/cmmc-enclave-vs-whole-company https://www.garde1.com/resources/cmmc/cmmc-enclave-vs-whole-company Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How does SPRS scoring work: 110, 88, and negative scores?]]> https://www.garde1.com/resources/cmmc/sprs-score-110-88-negative https://www.garde1.com/resources/cmmc/sprs-score-110-88-negative Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[How do I set CMMC scope for a company under 150 people?]]> https://www.garde1.com/resources/cmmc/cmmc-scope-small-contractor https://www.garde1.com/resources/cmmc/cmmc-scope-small-contractor Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[When can I claim Conditional or Final CMMC Level 2 Self status?]]> https://www.garde1.com/resources/cmmc/conditional-final-cmmc-level-2-self https://www.garde1.com/resources/cmmc/conditional-final-cmmc-level-2-self Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[What should a 90-day CMMC plan look like if our score lacks a real SSP?]]> https://www.garde1.com/resources/cmmc/90-day-cmmc-remediation-plan https://www.garde1.com/resources/cmmc/90-day-cmmc-remediation-plan Tue, 29 Sep 2026 04:46:27 GMT Andrew Erne <![CDATA[NIST SP 800-171 Rev. 2 vs. Rev. 3: which applies to your CMMC work?]]> https://www.garde1.com/resources/cmmc/nist-800-171-rev-2-vs-rev-3 https://www.garde1.com/resources/cmmc/nist-800-171-rev-2-vs-rev-3 Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey <![CDATA[CMMC evidence: what supports a self-assessment?]]> https://www.garde1.com/resources/cmmc/cmmc-evidence-that-counts https://www.garde1.com/resources/cmmc/cmmc-evidence-that-counts Tue, 29 Sep 2026 04:46:27 GMT Kyle Fahey