CMMC has become a strict, rigorous set of regulations for contractors working with the Defense Department. It is a clear map of maturity and capabilities; its implementation of NIST 800-171 controls; and its call for complete compliance before certification make CMMC audits challenging for many unprepared businesses. Unlike other frameworks, CMMC doesn’t allow documents like a Plan of Action and Milestones (POA&M) to stand in for actual compliance. 

CMMC 2.0 seems to change that. Here, we will discuss a POA&M and what it means within the CMMC framework. 

Read More

In cybersecurity and compliance, terms like “framework” and “regulations” are often used interchangeably. As such, non-specialists might struggle to understand how different guidelines and regulatory bodies fit together to support cybersecurity. For example, the National Institute for Standards and Technology (NIST) provides several documents outlining guidelines and compliance requirements. However, in terms of larger frameworks, it provides two major examples: the Risk Management Framework (RMF) and the Cybersecurity Framework (CSF).

This article will cover the latter of these two, how they fit into government-sponsored cybersecurity concerns and what that means for your organization. 

Read More

Working with federal agencies can be a big boon for enterprise and SMB service providers. Not only are they working in a lucrative and challenging space, but they can also provide critical infrastructural support to the operation and defense of our country. The regulations, however, can prove a nightmare. For example, should you adhere to FISMA vs. FedRAMP? What is NIST? Who can I work with to help me get started? 

Here, we’ll answer one of the more basic and important questions: What is the difference between FedRAMP and FISMA authorization? Depending on the type of services you offer, you could be working through a set of similar, yet slightly modified, regulatory obligations. 

Read More