Complying with CMMC requirements means strong documentation. Some companies choose to put all their documentation in a single System Security Plan (SSP) to reduce the number of controlled documents. However, we recommend a layered documentation approach to segment the security plan and to ensure the needed information gets to the right people. This documentation approach is built upon four layers: a high-level narrative of the security strategy, security policies, detailed co

The CMMC Northeast Summit, hosted at Rhode Island College’s Institute for Cybersecurity and Emerging Technologies with AXIOTROP, their partner sponsor. This event was specifically designed to support Organizations Seeking Assessment (OSAs) by bridging the gap between dense Department of War (DoW) policy and the boots-on-the-ground CMMC execution. Joe Devine, President of AXIOTROP, & Senator Jim Langevin, Former United States Representative, giving opening remarks. Photo by

The Department of War (DoW) has finalized the acquisition rule in Title 48 of the Code of Federal Regulations (CFR), cementing CMMC as an immediate contract requirement. This swift regulatory action, demonstrated by the Office of Information and Regulatory Affairs (OIRA) clearing the rule in just 34 days, underscores the government’s urgency regarding cybersecurity in the defense supply chain. For organizations seeking to protect sensitive data, the timeframe is extremely ti