Getting started
Find your next step
RSS feed14 guides · Page 1 of 2
Brilliant at the Basics: why the CIO reached for CSF 2.0
Twenty items, one framework, and a CIO who talks like an operator. What the campaign the CIO published alongside the review tells you to do before the task force report lands.
Kyle Fahey- Machine shops
Does a machine shop have to register for ITAR if it never exports?
If you make even one part on the U.S. Munitions List, you register with the State Department, whether or not anything leaves the country. What it costs, how to file, and the foreign-national question most shops miss.
Andrew Erne - Machine shops
Is this drawing CUI? How a machine shop reads the title block
Most shops can answer the CUI question in under a minute by reading four places on the print. Here is where to look, what each mark means, and what to do when the print says too much or too little.
Andrew Erne - Machine shops
Does a machine shop need GCC High? How to decide on Microsoft 365
CMMC doesn't require GCC High. Count the people who open prints, then pick one of four routes. A decision rule, real prices, and the questions to ask a reseller.
Andrew Erne - Machine shops
Who should actually do the CMMC work in a small machine shop?
In most small shops CMMC lands on whoever is nearest: the bookkeeper, the co-op, or the quality manager. How to pick the right person, give them the hours, and hire outside help without paying for a binder.
Kyle Fahey - Machine shops
What does CMMC really cost a small machine shop, and is defense work still worth it?
The Pentagon's CMMC cost estimates leave out the part that costs money. Here's what a 5 to 50 person shop actually pays, where it goes, how to shrink it, and an honest rule for deciding whether to stay.
Kyle Fahey - Machine shops
CMMC for a machine shop: from the Microsoft 365 inbox to the CNC mill
Follow one controlled drawing through a machine shop, from the email it arrives in to the chips on the floor. What's in scope at each stop, what to change, and what it costs to get wrong.
Kyle Fahey - Program status
Do I still need CMMC after the Phase 2 pause?
Yes. The pause cancelled the November 2026 certificate deadline, not the security work. What stopped, what still applies, and how to spend money now.
Kyle Fahey - Program status
How do CMMC requirements, policies, and evidence fit together?
An assessor checks that four things agree: the requirement, your policy, the setting that enforces it, and the record that proves it ran. One worked example.
Andrew Erne
