Tagged: small-business
CMMC Class Deviation Revision 3: What to Check in Your Contract
Read the CMMC instructions in Class Deviation 2026-O0025, Revision 3: solicitation amendments, contract modifications, self-assessments, and the NIST baseline.
HIPAA Employee Offboarding Checklist: Email, Files, Chat, and Shared Access
Use an owner, action, and evidence checklist to end healthcare staff access across email, files, chat, integrations, and devices while preserving needed records.
Where Is Your ePHI? An Inventory Checklist Beyond the EHR
Map ePHI beyond your EHR with a practical inventory covering inboxes, spreadsheets, shared files, chat, exports, devices, vendors, and backups.
Is Slack HIPAA Compliant? Plans, BAAs, and Patient Messaging Limits
Understand Slack's HIPAA requirements and patient messaging limits, then evaluate your plan, BAA, connected apps, monitoring, and record-handling workflow.
Is Google Workspace HIPAA Compliant? What a BAA Does and Does Not Cover
Evaluate Google Workspace for HIPAA workflows: BAA acceptance, covered services, third-party apps, sharing decisions, and evidence to keep before using PHI.
Why the Department of War Suspended CMMC Phase II
The Department of War suspended CMMC Phase II and launched a 60-day review focused on lowering barriers while preserving its cybersecurity baseline.
HIPAA Compliant Email: A Practical Guide for Small Healthcare Teams
Evaluate email for ePHI with practical checks for business associate agreements, encryption, recipient access, shared mailboxes, and staff workflows.
HIPAA Business Associate Agreements: Questions for Cloud Vendors
Understand when a cloud vendor needs a BAA and what to review about service scope, subcontractors, incident reporting, data access, and termination.
Supply Chain Risk Management for Small Defense Contractors
A practical SCRM approach for the DIB: rank suppliers by impact, apply lifecycle controls, meet NIST 800-171 and DFARS expectations, and keep evidence auditors can sample.
What Is Shoulder Surfing? Why It Still Matters for CUI
Shoulder surfing is a low-tech attack with high-stakes consequences for defense contractors. How visual exposure of CUI happens, why assessors care, and the controls that actually work.
Building a CMMC-Ready User Provisioning Workflow
How small defense contractors build a user provisioning workflow that survives CMMC Level 2 assessment: access policies, a practical RBAC matrix, lifecycle automation, and audit evidence.
ITAR Controlled Technical Data: A Program Manager's Handling Guide
ITAR controlled technical data changes who can see files, where they live, and how teams collaborate. How to classify, mark, authorize, and handle it.
Critical Infrastructure Protection (CIP) for Small Defense Contractors
Critical infrastructure protection now reaches small DIB contractors. What it means under CMMC and DFARS, and how to build it without enterprise spend.
Compliance Automation Tools for Defense Contractors: A Practical Guide
Compliance automation replaces spreadsheet evidence hunts with continuous monitoring. What these tools do, what they don't, and how to evaluate vendors.
What Is an SSP? The CMMC Level 2 System Security Plan, Explained
An SSP describes how a contractor protects CUI. What it must cover, how to build it from a template, and what makes it credible to a C3PAO.
PreVeil vs GCC High for CMMC: Which Is Right for You?
Comparing PreVeil and GCC High for CMMC compliance: cost, deployment, scope, and operational trade-offs for small defense contractors.
CMMC Compliance Solutions: GCC High vs Enclave for Small Contractors
How small defense contractors should compare CMMC compliance solutions. GCC High vs enclave architectures, total cost of ownership, and what to ask vendors.
What Is a POA&M? A Working Guide for CMMC Level 2 Contractors
A POA&M tracks the security gaps a contractor still needs to close. Here is how to structure one, what belongs on it, and the CMMC Level 2 limits on its use.
What Is DFARS? A Practical Guide for Small Defense Contractors
DFARS sets cybersecurity and CUI handling rules for DoD contractors. Here are the clauses that matter, how they overlap with NIST and CMMC, and what flowdown means.
CMMC Level 2 Access Control Policies: A Working Guide for Small Contractors
Access control is where many small defense contractors discover the gap between owning security tools and running an auditable security system. Here is how to build a policy that holds up.
What Is ITAR Compliance? A Guide for Small Defense Contractors
ITAR controls who can access defense data and where it lives. Here's how it works, how it overlaps with CMMC, and what small contractors need to do.
CMMC Level 2 Requirements: A Practical Guide for Small Defense Contractors
CMMC Level 2 covers 110 NIST 800-171 controls across 14 domains. Here is how small contractors should scope, implement, and prepare for a C3PAO assessment.
ITAR Requirements for Employees: Access Control for Small Defense Contractors
ITAR restricts access to defense technical data to authorized U.S. persons, even when the access happens inside the U.S. Here is how small contractors should structure employee access, onboarding, and remote work controls.
CMMC Email Cost Factors 2026: GCC High vs PreVeil vs Google
Compare the licensing, migration, support, and operating factors that shape CMMC email costs without relying on stale list prices.
Moving from Office 365 to CMMC Email: Plan the Migration
You don't need GCC High to get compliant. Here's how to plan an email migration for CMMC Level 2 without rebuilding your entire Microsoft environment.
CMMC Compliant Email for Small Business: What You Actually Need
Most small defense contractors overpay for compliant email or use tools that don't meet the requirements. Here's what CMMC actually requires and how to evaluate your options.