Documents
Find your next step
RSS feed9 guides
- Machine shops
Can I send a controlled drawing to my plater or heat treater?
Most outside processors can do the job from a spec, not a drawing. When one can't, here's what you flow down, how to check their status, and what to do when they refuse.
- Machine shops
What does my prime's CMMC questionnaire actually require of my shop?
Four primes, four portals, one set of facts. What each questionnaire asks, what you actually owe under 32 CFR 170.23, and a worksheet that keeps every answer consistent.
Kyle Fahey - Program status
How do CMMC requirements, policies, and evidence fit together?
An assessor checks that four things agree: the requirement, your policy, the setting that enforces it, and the record that proves it ran. One worked example.
Andrew Erne - Evidence & SSP
How do I keep my SSP and SPRS assessment describing the same environment?
Your SSP, workbook, and SPRS entry must name the same system, CAGEs, providers, and devices. How SSPs drift and how to catch it before you submit.
Andrew Erne - Primes & contracts
How should I answer a prime’s CMMC letter during the pause?
A reply you can paste: the work covered, your environment and CMMC UID, your SPRS status and date, the clause you need to see, and your next date.
Kyle Fahey - Primes & contracts
What belongs in a subcontractor security exhibit?
Name the work, the environment that handles it, the CMMC status in SPRS, and who calls whom inside 72 hours. Keep the DFARS flowdowns intact. A one-page exhibit to adapt.
- Primes & contracts
What can a prime contractor require of me during the CMMC pause?
Three layers: what DoD requires through your contract clauses, what you already signed, and what the prime simply prefers. Only the first two bind you.
- Daily operations
What should a 90-day CMMC plan look like if our score lacks a real SSP?
Two weeks finding the facts, three fixing access and scope, four running the routines, four re-scoring. The week-by-week plan and the gates between phases.
Andrew Erne - Program status
NIST SP 800-171 Rev. 2 vs. Rev. 3: which applies to your CMMC work?
CMMC Level 2 and DFARS 7012 still use Rev. 2's 110 controls. What Rev. 3 changed, why it doesn't apply yet, and the one thing worth doing now.
Kyle Fahey
