31 guides · Page 1 of 4
Microsoft's own placemat says GCC High fully covers 52 of the 110 CMMC Level 2 requirements, shares 57, and leaves you 1. It publishes no count for GCC or Commercial. What the 52 really buy you.
Andrew ErnePreVeil's matrix says it handles 37 of the 110 CMMC Level 2 requirements. You share 65 and own 8. Its "102 of 110" is the first two numbers added together.
Kyle FaheyAWS says 21 of the 110 CMMC Level 2 requirements are fully inheritable, 79 are shared, and 10 are yours. The 21 are AWS's buildings, disks, and hardware, so most of the work lands on you.
Andrew ErneGoogle's CMMC guide says Workspace fully handles 42 of the 110 CMMC Level 2 requirements. You share 58 and own 9 outright, and 15 of the "shared" ones have nothing in Workspace to share.
Andrew ErneMost shops can answer the CUI question in under a minute by reading four places on the print. Here is where to look, what each mark means, and what to do when the print says too much or too little.
Andrew ErneYour controls run XP, Windows 7 or DOS, and programs still have to reach them. Pick one transfer method, keep the machines, time-box the builder's remote access, and write the controller up the way the rule allows.
Kyle FaheyCMMC doesn't require GCC High. Count the people who open prints, then pick one of four routes. A decision rule, real prices, and the questions to ask a reseller.
Andrew Erne"CMMC-ready" and "GovCloud" don't answer the question. What each shop-software vendor actually claims, where each type of software lands, and six questions to send any vendor.
Kyle FaheyThe Pentagon's CMMC cost estimates leave out the part that costs money. Here's what a 5 to 50 person shop actually pays, where it goes, how to shrink it, and an honest rule for deciding whether to stay.
Kyle FaheyFrom the operating environment
Working designs for the shop floor, development teams, shared IT, and supplier risk. Choices, tradeoffs, and the checks that make them credible.
Note 01 · Shop floor
Office PCs get no route to controllers, programs move through one transfer station, and vendors get a timed MFA session. Five firewall rules and how to test them.
Andrew ErneNote 02 · Lean setups
Three managed CAM workstations, no cloud CAD on CUI jobs, and the overflow programmer held until they're covered. Follow one job to find every copy.
Kyle FaheyNote 03 · Hard controls
Check the repo host's FedRAMP tier, lock one ephemeral runner group to the defense repo, then run a canary string through the pipeline to find the leaks.
Andrew ErneNote 04 · Lean setups
Five managed computers, one GCC or GCC High project site, one delivery route. The tenant rule, the brief for your MSP, and the pilot that failed twice.
Kyle FaheyNote 05 · Product pairings
Intune + Defender if your MSP runs Microsoft, Jamf if you already do. Put it in the tenant where your CUI lives, then reconcile all 12 Macs by serial number.
Andrew ErneNote 06 · Shop floor
Legacy test equipment is a Specialized Asset: listed in your inventory, SSP and diagram, not assessed against the 110. The SSP entry to copy and the restore drill.
Kyle FaheyNote 07 · Primes & risk
A sub's CMMC status only counts if its CMMC UID covers the site doing your job. What 7021 (and 7020 on older contracts) make you check, and the email to send.
Andrew ErneNote 08 · Medium-sized teams
Shared identity, admins and backup make two plants one environment. Scope it once, give each shared job one owner, and retire the acquisition's leftovers.
Kyle Fahey
