ALC - 112

Conducting a NIST 800-171 self-assessment — also known as a CMMC self-assessment or SPRS assessment — is a critical component of DFARS 252.204-7019 compliance. As a contractor, you’ll need to evaluate your organization against all 320 objectives and upload your score to the Supplier Performance Risk System (SPRS).

While gap, readiness, and business-process-mapping assessments are crucial in preparing organizations for CMMC compliance, another type of assessment — the risk assessment — is critical to a holistic security strategy.  

In the DIB world, not all CMMC assessments are created equally — especially when safeguarding our CUI Assets. Understanding the difference between Gap and Readiness Assessments isn’t just essential but can also be crucial. 

Should Our Strategy Shift from Cloud First to On-Premises Due to the DoD’s Recent Memo on FedRAMP Moderate Equivalence Requirements?  

As we move further into a regulation-dominated digital era where privacy and information security are becoming critical to business success, should we expect companies doing business with the DoD to reconsider “Cloud First” for traditional on-premises solutions or data centers?  

On 10 January 2024, The National Institute of Standards and Technology (NIST) shared critical updates to Special Publication 800-171, Revision 3.  

Back in September, we wrote a blog about the Cybersecurity Maturity Model Certification (CMMC) program. In it, we explained how the Department of Defense introduced CMMC in 2019 to strengthen cybersecurity standards for Department of Defense (DoD) contractors.