16 guides · Page 1 of 2
Honeywell paid $2,042,518 over one network that allegedly fell short of NIST SP 800-171. Three months earlier, a company that posted a perfect 110 was scored at -170. What both cases say about your number.
Kyle FaheyThe DoD CIO and the Cyber AB both want CMMC to move past point-in-time checks. No rule or memo requires it yet. What was said, what's guesswork, and the ongoing duties you already have.
Kyle FaheyThe whole SPRS path, from getting the PIEE role to the Affirm button, plus the check that stops you from submitting a score your evidence can't back up.
Kyle FaheyAn assessor checks that four things agree: the requirement, your policy, the setting that enforces it, and the record that proves it ran. One worked example.
Andrew ErneFreeze what you submitted, list the answers you can't prove, and call counsel before you change the record. The order matters.
Andrew ErneEight engineers approved, nine accounts in the folder, and a backup app nobody owns. Start there, then admin roles and departures. A quarterly review in an hour.
Kyle FaheyOne requirement, AC.L2-3.1.1, worked end to end at a 20-person shop: six objectives, one expired guest account, and why five of six is still NOT MET.
Kyle FaheyAnswer questions about your company once. Garde1 builds your scope, writes the SSP and 14 policies, reads evidence from your tools, scores all 110 requirements, and hands you the fixes.
Kyle FaheyAsk what a mock examines, how missing proof is handled, and how fixes are verified. Separate useful preparation findings from official assessment results.
Andrew ErneFrom the operating environment
Working designs for the shop floor, development teams, shared IT, and supplier risk. Choices, tradeoffs, and the checks that make them credible.
Note 01 · Shop floor
Office PCs get no route to controllers, programs move through one transfer station, and vendors get a timed MFA session. Five firewall rules and how to test them.
Andrew ErneNote 02 · Lean setups
Three managed CAM workstations, no cloud CAD on CUI jobs, and the overflow programmer held until they're covered. Follow one job to find every copy.
Kyle FaheyNote 03 · Hard controls
Check the repo host's FedRAMP tier, lock one ephemeral runner group to the defense repo, then run a canary string through the pipeline to find the leaks.
Andrew ErneNote 04 · Lean setups
Five managed computers, one GCC or GCC High project site, one delivery route. The tenant rule, the brief for your MSP, and the pilot that failed twice.
Kyle FaheyNote 05 · Product pairings
Intune + Defender if your MSP runs Microsoft, Jamf if you already do. Put it in the tenant where your CUI lives, then reconcile all 12 Macs by serial number.
Andrew ErneNote 06 · Shop floor
Legacy test equipment is a Specialized Asset: listed in your inventory, SSP and diagram, not assessed against the 110. The SSP entry to copy and the restore drill.
Kyle FaheyNote 07 · Primes & risk
A sub's CMMC status only counts if its CMMC UID covers the site doing your job. What 7021 (and 7020 on older contracts) make you check, and the email to send.
Andrew ErneNote 08 · Medium-sized teams
Shared identity, admins and backup make two plants one environment. Scope it once, give each shared job one owner, and retire the acquisition's leftovers.
Kyle Fahey
