WRIGHTBRAINEDSECURITY
Book a call
Scoping & Boundary
- How do I determine if a system is in scope for CMMC?
- What is a Security Protection Asset (SPA) under CMMC?
- Does my CRM (Salesforce, HubSpot, Dynamics) need to be CMMC compliant?
- What's the difference between CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets?
- Can I use enclaving to reduce my CMMC assessment scope?
- Are my developers' laptops in scope if they don't handle CUI directly?
- Is my Active Directory or Entra ID in scope for CMMC if it authenticates users to CUI systems?
- Does CMMC apply to my company if we only handle FCI, not CUI?
Level Selection
SSP & POA&M
- What does a CMMC-ready System Security Plan (SSP) need to include?
- Can I have open POA&M items at my CMMC assessment and still pass?
- Which CMMC controls can NOT be on a POA&M?
- What is the CMMC minimum passing score?
- How long do I have to close out POA&M items after assessment?
- Do I need to upload my self-assessment score to SPRS?
Evidence
- What evidence do CMMC assessors actually look for?
- How fresh does my evidence need to be for a CMMC assessment?
- What are the three evidence methods in NIST 800-171A and which do I need for each control?
- How should I name and organize my CMMC evidence files?
- Are screenshots acceptable as CMMC evidence?
- Can I use AI-generated or auto-generated reports as CMMC evidence?
Assessment Process & C3PAO
CUI Handling
ESP / Shared Responsibility
Specific Controls
- What MFA configuration meets CMMC IA.L2-3.5.3?
- What does CMMC require for audit logging and retention?
- What does CMMC require for vulnerability scanning and patching?
- What incident response capabilities does CMMC require?
- Can employees use personal devices (BYOD) under CMMC?
- What does CMMC require for security awareness training?
- How do I demonstrate FIPS 140-2 (or 140-3) validated cryptography to an assessor?
- What does CMMC require for physical security (PE domain)?
- What is required for configuration baselines and change management?
// READY WHEN YOU ARE
Is your security posture keeping you up at night?
Thirty minutes, no slide deck. Tell us what you're up against and we'll tell you honestly whether we can help.