Written for people who have to act on it.
Plain-English posts, free tools, and sample deliverables. No gated whitepapers.
LATEST · RISK · SEP 27, 2026You Probably Cannot Prove Where Your Software Came From - SLSA In Plain EnglishMost organizations can name their software vendor but can't prove where a build came from. SLSA makes that checkable. What it does, what it won't do, and three questions to ask your team.Read the post →All posts
RISK · SEP 27, 2026You Probably Cannot Prove Where Your Software Came From - SLSA In Plain English
NEWS & RULES · SEP 11, 2026CMMC Phase II Is Paused: Five Things Defense Contractors Should Work on Now
NEWS & RULES · JUL 22, 2026Is CMMC Dead?
SCOPING · MAY 8, 2026Is Your CMMC Scope Correct? Try the Free Scope Checker Tool
GUIDES & TOOLS · MAR 27, 2026How to Write a CMMC Level 2 SSP: What Assessors Actually Look For
GUIDES & TOOLS · MAR 18, 2026Introducing the CMMC Compliance Engine: A Practical System for Getting Assessment-Ready
TECHNICAL · FEB 2, 2026CMMC – You Probably Think You Meet 3.13.6. Your Assessor Might Not Agree.
SCOPING · OCT 23, 2025When ITAR Data Is CUI and When It Is Not
GUIDES & TOOLS · OCT 1, 2025Oh Shit, I Need CMMC – A Subcontractor’s Survival Guide
NEWS & RULES · SEP 15, 2025CMMC IS a Real Boy!
TECHNICAL · MAY 5, 2025Signal, Not Noise: AU 3.3.3
GUIDES & TOOLS · MAR 11, 2025Automation: Comparing Account Inventory to Active Directory Accounts
TECHNICAL · FEB 5, 2025Microsoft Defender vs. Mobile Code
SCOPING · JAN 10, 2025Security Protection Assets and Security Protection Data in CMMC
TECHNICAL · DEC 20, 2024CMMC Practice 3.4.7 – Ports, Protocols, Programs Functions, and Services
ASSESSMENTS · OCT 15, 2024CMMC Level 2 Self-Assessment or Assessment by a CMMC Third Party Assessment Organization?
ASSESSMENTS · OCT 14, 2024The CMMC Rule and Plans of Action & Milestones (POA&M)
NEWS & RULES · OCT 11, 2024The CMMC Rule is FINAL!
TECHNICAL · JUL 29, 2024FIPS 140-2 and CMMC Compliance
RISK · JUL 21, 2024The CrowdStrike Outage: Risk Assessments & Single Points of Failure
ASSESSMENTS · JUL 16, 2024VerySecure UAV’s On-Site CMMC Assessment – Physical Security & related domains
ASSESSMENTS · JUL 11, 2024CMMC Assessment – SI Domain – MakeBelieve Manufacturing
TECHNICAL · JUL 5, 2024Baseline Configurations: The First Step in Configuration Management
TECHNICAL · JUN 24, 2024Multi-factor Authentication (MFA) and How to Thwart Bypass Attacks
GUIDES & TOOLS · JUN 21, 2024Part 2: Your Guide for Continuous Monitoring and Ongoing MaintenanceGUIDES & TOOLS · JUN 20, 2024Your Guide to Continuous Monitoring and Ongoing Maintenance for CMMC
GUIDES & TOOLS · JUN 20, 2024Meeting CMMC Standards – 10 Major Challenges to Overcome for Success No posts match that search. Try a different word or topic.
FREE DOWNLOADS
Checklists and templates, from real engagements.
Checklists and samples are free to download. Fillable templates just need an email address.
FREE CHECKLISTCMMC · 4 PAGES
What Assessors Ask to See
An evidence checklist for NIST SP 800-171 and CMMC Level 2, family by family, from the assessor's side of the table.
Download the PDFFILLABLE TEMPLATECMMC · 5 PAGES
SPRS Score Reality Check
All 110 requirements with SPRS point values and POA&M eligibility, plus room to name the evidence behind each one. Fillable.
FREE CHECKLISTHEALTHCARE · 2 PAGES
10 Questions to Ask About Ransomware
For owners and boards of organizations that handle patient data: what to ask, and what a good answer sounds like.
Download the PDFFILLABLE TEMPLATEHEALTHCARE · 2 PAGES
Ransomware Playbook
Who's in charge, the first hour, who to call, and how to keep seeing patients and billing. Fill it in and print it.
FREE CHECKLISTSUPPLY CHAIN · 2 PAGES
Security Terms for Vendor Contracts
What to put in writing before a vendor touches your data or systems: incident notice, evidence, your right to check.
Download the PDFFILLABLE TEMPLATESUPPLY CHAIN · 3 PAGES
Supplier Security Questionnaire
A short questionnaire to send one supplier, plus a one-page guide for reading the answers. Fillable.
SAMPLE DELIVERABLESUPPLY CHAIN · 3 PAGES
Sample Supplier Security Review
What our supplier review report looks like, for a fictional machine shop with six suppliers. Ratings, gaps, conditions and next steps.
Download the PDFSAMPLE DELIVERABLEHEALTHCARE · 2 PAGES
Sample Leadership Summary
The quarterly summary leadership receives, for a fictional billing company: where things stand, what changed, and what we need from you.
Download the PDF
FREE RESOURCES
Tools and samples you can use today.
NEW POSTS BY EMAILOne email when there's something worth reading.
WRIGHTBRAINEDSECURITY
Book a call
