Assessments
Find your next step
RSS feed21 guides · Page 1 of 3
- Self-assessment & SPRS
POA&M rules: what you can and cannot leave open
Only 47 of the 110 requirements can ever sit on a CMMC POA&M, you need 88 points to use one, and the 180-day clock doesn't stop. What the rule allows, and what happens when it runs out.
Andrew Erne - Self-assessment & SPRS
What the Honeywell settlement teaches about your SPRS score
Honeywell paid $2,042,518 over one network that allegedly fell short of NIST SP 800-171. Three months earlier, a company that posted a perfect 110 was scored at -170. What both cases say about your number.
Kyle Fahey - Evidence & SSP
What does a C3PAO actually ask for on assessment day?
Your SSP, scope, inventory, diagram, provider matrices, and proof for each objective, then a live demonstration. And the usual reasons a requirement fails.
Kyle Fahey - Machine shops
Swiss Automation paid $421,234 over drawing security. What does that mean for your shop?
What analysts called the first cyber False Claims Act settlement below the prime tier started with the shop's own quality manager. What DOJ alleged, how it connects to your SPRS score, and what to do if the number you posted is wrong.
Andrew Erne - Machine shops
What does my prime's CMMC questionnaire actually require of my shop?
Four primes, four portals, one set of facts. What each questionnaire asks, what you actually owe under 32 CFR 170.23, and a worksheet that keeps every answer consistent.
Kyle Fahey - Self-assessment & SPRS
How do I submit a CMMC Level 2 self-assessment in SPRS?
The whole SPRS path, from getting the PIEE role to the Affirm button, plus the check that stops you from submitting a score your evidence can't back up.
Kyle Fahey - Self-assessment & SPRS
Does changing a security tool or MSP affect my CMMC assessment?
Usually not. Swaps inside the same boundary are covered by your annual affirmation. Network expansion or an acquisition needs a new assessment. Mind the cutover gap.
Kyle Fahey - Evidence & SSP
How do I keep my SSP and SPRS assessment describing the same environment?
Your SSP, workbook, and SPRS entry must name the same system, CAGEs, providers, and devices. How SSPs drift and how to catch it before you submit.
Andrew Erne - Scope & CUI boundaries
Can one CMMC assessment cover multiple CAGE codes or entities?
Yes, when the entities share one environment run by the same people. SPRS lets you list every covered CAGE in your SAM hierarchy. Separate systems, separate assessments.
Kyle Fahey
