How Do I Map Evidence to Each CMMC Practice?
A step-by-step method for linking proof to each of the 110 CMMC Level 2 practices.
Latest
The CMMC Review Window Closed. What Happens While Decisions Are Being Drafted?
The CMMC Reform Task Force finished its 60-day review and is now drafting recommendations. Certifications kept being issued in the meantime. Here is what to do now.
Read the articleWhat Do Assessors Prefer: Screenshots or System Exports?
Why CMMC assessors accept screenshots but give more weight to live system exports, and what to collect for each control.
The CMMC Audit Paused. Should You Pause Collecting Evidence?
Redspin's 2026 DIB study, released October 1, finds 78.2% of defense contractors kept moving toward CMMC certification during the pause. Here is what the data says to do.
How Often Should We Refresh Our CMMC Evidence?
What 32 CFR Part 170, DFARS 252.204-7019, and NIST SP 800-171A require on CMMC evidence freshness, plus a refresh schedule by evidence type.
Did the CMMC Phase 2 Suspension Mean We Can Stop Doing 800-171?
The July 13 pause removed third-party assessments as a condition of award, not the underlying rules. In September, DOJ collected $2,042,518 from a contractor over 800-171 gaps. Here is what still applies and what to do now.
Doing CMMC Evidence by Hand vs Collecting It Automatically
Manual screenshots versus automated collection for CMMC evidence, compared honestly. Our position: past a tiny scope, automated collection from the live tenant is the sane path, and PolicyCortex is built for exactly that on Azure.
What Counts as Evidence for CMMC Level 2?
What assessors accept as proof for each of the 110 CMMC Level 2 practices.