Cybersecurity Maturity Model Certification (CMMC) Unlocked

Mastering NIST SP 800-171 Audit and Accountability (AU) Controls

Explore the Audit and Accountability (AU) domain of NIST SP 800-171 with actionable strategies for compliance in defense contracting. Dive into the essentials of system audit logs, open-source accountability tools, and best practices for working with MSSPs. Learn how to create a robust monitoring program to detect and respond to unauthorized activity while meeting regulatory demands.

Training and Awareness Essentials for NIST SP800-171 Controls

Explore how awareness and training align with NIST SP800-171 security controls. We break down each control, connect them to specific CDSE course catalog options, and discuss assessment objectives crucial for defense contractors and cybersecurity teams.

System Security Plan Templates Demystified

Explore the essentials of the NIST SP800-171 System Security Plan (SSP), the key requirements from NIST SP800-53r5, and recommended sections to create a plan that's truly fit for your organization. We'll break down what must be included, what can be added for clarity, and how to make your SSP a practical tool for security and compliance.

Building a Bulletproof Incident Response Plan

This episode dives into the essentials of incident response plans required by NIST standards, explores best practices and testing, and highlights how to leverage providers like Vertek and your MSSP for superior readiness. Our hosts break down actionable steps, useful examples, and real-world MSSP integration strategies, making your compliance journey clear and manageable.

Real-World Cyber Incident Response Beyond the Tabletop

Explore how Bridgewater State University's Cyber Range revolutionizes cybersecurity training, making incident response testing more immersive than traditional tabletop exercises. Hear insights on simulating real attacks, following NIST guidance, and how organizations can use this environment for CMMC and real-world readiness.

Demystifying DoD Cloud Security: SRGs, STIGs, and CMMC Alignment

This episode unpacks how the DoD's cloud security requirements come together across SRGs, STIGs, and CMMC, clarifying regulatory foundations, Impact Levels, and the real-world implications for cloud service providers and mission owners. The hosts decode recent changes, practical responsibilities, and the intersection of CMMC with FedRAMP, NIST, and DFARS. Whether you’re a DoD contractor, a cloud service provider, or a compliance leader, get the plain-English guidance you need to understand the nuances of today’s cloud compliance landscape.

Deep Dive: NIST Risk Assessment & Prioritization Process

Join Eric, Ruby, Paul, and Roz as they break down the NIST IR 8286 series and SP 800-30 guidance for cybersecurity risk assessment. This episode explores how to set enterprise risk appetite, create and score risk scenarios (including threats and vulnerabilities), use business impact analysis for prioritization, and aggregate, monitor, and report risks for executive risk decisions. The team uses relatable examples and practical case studies to show how to turn risk analysis into real-world, risk-based decisions.

Supporting Documentation and Procedures for Access Control Compliance

This episode explores the essential supporting documents and general procedures needed for the Access Control Family under CMMC. Learn which records are vital, how to structure compliant procedures, and practical tips for streamlined documentation. Hear real-world insights and specific examples from seasoned practitioners and compliance experts.

Aligning the AI Risk Management Framework with CUI Risk Assessment Requirements

This episode breaks down how the NIST AI Risk Management Framework (AI RMF 1.0) supports a robust, continual approach to AI risk assessment, with a special focus on how to meet NIST SP 800-171 rev 2 control 3.11.1 for assessing risk to CUI. We connect specific core functions of the AI RMF—Govern, Map, Measure, and Manage—to compliance requirements and practical periodic risk reviews in organizations running or deploying AI systems.

Incident Response Interlaced: DFARS 252.204-7012 and NIST SP800-171

Explore how incident response requirements from DFARS 252.204-7012 and NIST SP800-171 complement and amplify each other. Our experts dissect what each demands, how they mesh in practice, and what that means for defense contractors. This episode highlights actionable steps and noticeable pitfalls, with real-life examples from industry and government.

CMMC Rollout Countdown and the Road to 2025

What does the final year before full CMMC implementation look like? In this episode, we explore the definitive schedule, key requirements, and what defense contractors should expect as the November 10, 2025 effective date for DFARS 204.75 approaches.

How Long and How Much? Realistic Timelines and Costs for CMMC & NIST SP 800-171 Compliance

This episode unpacks the complete journey to CMMC/NIST SP 800-171 compliance, breaking down the phases, expected timelines, and real-world costs using authoritative federal guidance and hands-on field experience. Drawing from key federal regulations and the Critical Prism Defense whitepaper, we deliver facts and planning models for organizations at any starting point.

What Happens Next for 48 CFR 204.75: Timeline to CMMC Enforcement

The team unpacks the next phases now that 48 CFR Subpart 204.75 has cleared OIRA review, mapping out what’s ahead for activation and enforcement—including the practical timeline to a live, enforceable CMMC rule. Special focus is given to rulemaking milestones, contract impacts, and how the DoD’s phase-in policy shapes when CMMC compliance becomes required for defense contractors.

Self-Assess or Certify: The New DoD CUI Assessment Split

This episode breaks down the Department of Defense’s recent decision on when contractors can self-assess for CMMC Level 2, and when a third-party assessment is required. The hosts clarify how the NARA and DoD CUI registries impact assessment requirements, and explain why ACAT categories are no longer the dividing line.

Unpacking MSSP Challenges in CMMC Environments

Eric, Ruby, Paul, and Roz explore the unique CMMC compliance complexities that arise when a Managed Security Service Provider (MSSP) delivers a Security Operations Center (SOC), SIEM, and SOAR—especially when CUI and privileged access are in play. Using real examples and asset categories from the latest CMMC scoping guides, the hosts dig into scoping, asset classification, and responsibilities.

CMMC Scoping guides

Review of CMMC Scoping guides. In this episode we dive into the CMMC L2 Scoping guide and provide a summary of the categories and details within.

Risk Assessments and Meeting NIST SP 800-171 Control 3.11.1

Dive into how risk assessments underpin NIST SP 800-171 compliance, with a focus on control 3.11.1. Our expert hosts break down what assessors look for, walk through real-world approaches, and share lessons learned from the field.

Unlocking Federal Rulemaking and CMMC Implementation

Dive into the federal rulemaking process and how it shapes cybersecurity requirements for defense contractors. This episode explores how the 32 CFR 170 rule went from concept to implementation, and previews how the forthcoming 48 CFR 204 changes may follow that path. Hear practical insights relevant for anyone in federal compliance, cybersecurity, and defense acquisition.

Continuous Compliance in Action

Explore how continuous CMMC monitoring transforms cybersecurity for defense contractors and compliance teams. Discover essential strategies, real-time tools, and practical steps for maintaining readiness in a dynamic threat landscape.

CMMC 2.0 Rollout and Realities

Explore the phased rollout of CMMC 2.0, how the new rules impact defense contractors, and what it takes to maintain compliance. Our hosts break down the assessment process, key requirements, and real-world implications—plus, share surprising insights and practical examples from the field.

Safeguarding CUI and Data Rights

This episode uncovers how organizations in the defense sector can identify, handle, and protect Controlled Unclassified Information (CUI), Covered Defense Information (CDI), and Controlled Technical Information (CTI). We examine contract requirements, marking guidance, and the latest resources to help contractors navigate CMMC compliance and data rights management.