ALC - 112

As the CMMC Final Ruling and Implementation progresses, many organizations are left wondering what to expect in the coming months, and 2025. Recently, it was confirmed that the CMMC Final Rule is near completion and was submitted for final review. In the waiting period for publication, we wanted to provide a quick guide on what organizations need to know and how to prepare for the upcoming developments!  

First, this blog is not about rushing you to select a C3PAO because the sky is falling. This is, however, a blog about choosing the right C3PAO so you don’t feel as if the sky is about to fall on you. 

Conducting a NIST 800-171 self-assessment — also known as a CMMC self-assessment or SPRS assessment — is a critical component of DFARS 252.204-7019 compliance. As a contractor, you’ll need to evaluate your organization against all 320 objectives and upload your score to the Supplier Performance Risk System (SPRS).

While gap, readiness, and business-process-mapping assessments are crucial in preparing organizations for CMMC compliance, another type of assessment — the risk assessment — is critical to a holistic security strategy.  

In the DIB world, not all CMMC assessments are created equally — especially when safeguarding our CUI Assets. Understanding the difference between Gap and Readiness Assessments isn’t just essential but can also be crucial. 

Should Our Strategy Shift from Cloud First to On-Premises Due to the DoD’s Recent Memo on FedRAMP Moderate Equivalence Requirements?  

As we move further into a regulation-dominated digital era where privacy and information security are becoming critical to business success, should we expect companies doing business with the DoD to reconsider “Cloud First” for traditional on-premises solutions or data centers?