Security and access
Find your next step
RSS feed18 guides · Page 1 of 2
Brilliant at the Basics: why the CIO reached for CSF 2.0
Twenty items, one framework, and a CIO who talks like an operator. What the campaign the CIO published alongside the review tells you to do before the task force report lands.
Kyle Fahey- Program status
Continuous monitoring is coming to CMMC: what it means for you
The DoD CIO and the Cyber AB both want CMMC to move past point-in-time checks. No rule or memo requires it yet. What was said, what's guesswork, and the ongoing duties you already have.
Kyle Fahey - Cloud and vendors
How many CMMC controls does CrowdStrike Falcon cover?
Falcon helps with 71 of the 110 CMMC Level 2 requirements, and you inherit none of them. It's a security tool, not a cloud that holds your CUI, so every one of the 71 is still yours to set up and prove.
Kyle Fahey - Machine shops
Can your ERP and CAM software hold a controlled drawing?
"CMMC-ready" and "GovCloud" don't answer the question. What each shop-software vendor actually claims, where each type of software lands, and six questions to send any vendor.
Kyle Fahey - Machine shops
A controlled drawing just landed in our quote inbox. Now what?
One RFQ with a controlled drawing puts a mailbox, a laptop, and a phone in scope before anyone has quoted a dollar. Here is how a shop quotes defense work without dragging the whole office in, and what to do with drawings nobody should have sent.
Kyle Fahey - Machine shops
Can machinists share one login on the shop floor PC under CMMC?
Machinists won't type a password at the kiosk, and management agrees. A shared login still fails the requirement. Here are the fast sign-in options that pass, and the floor rules for phones, travelers and visitors.
Andrew Erne - Scope & CUI boundaries
Is my contract information FCI or CUI?
Marked, or named as CUI in the contract: Level 2, 110 requirements. Other nonpublic contract info is FCI: Level 1, 15. How to tell, and the email to send the prime.
Kyle Fahey - Program status
Do I still need CMMC after the Phase 2 pause?
Yes. The pause cancelled the November 2026 certificate deadline, not the security work. What stopped, what still applies, and how to spend money now.
Kyle Fahey - Daily operations
How do CMMC physical controls work across leased and home offices?
The landlord's lobby and your cloud provider's data center don't cover your suite or a home desk. What 3.10.1–3.10.6 ask of you, and the home rules to paste into policy.
Kyle Fahey
