Plain-English answers to the questions we hear most about CMMC, NIST 800-171, and SPRS — plus the latest security and compliance news that actually affects you. No email required to read any of it.
Two critical vulnerabilities in the PHP runtime itself — not in any specific application — mean a perfectly secure WordPress or custom site can still be exposed. Here's what to check right now.
Microsoft's October 13 release was one of the largest Patch Tuesdays of the year. The .NET Framework update (KB5127684 and its counterparts) is worth moving to the top of the queue.
The Department of War paused the CMMC Phase 2 rollout in July 2026 for a program review. Here's exactly what's on hold, what hasn't changed, and what contractors should still be doing right now.
Every self-assessment starts at a maximum of 110 points. Each of the 110 NIST SP 800-171 security requirements is worth 5, 3, or 1 points based on its security impact, and you lose the points for any requirement that isn't fully implemented — which is why scores can run negative. There's no partial credit for being “mostly” done on a given control, with a few narrow, documented exceptions.
No. A Plan of Action & Milestones documents your path to closing a gap, but it doesn't restore the points for a control that isn't actually implemented yet. The only exceptions are narrowly defined — temporary deficiencies with an active remediation plan, or isolated, documented exceptions in your SSP. A POA&M is necessary, but it isn't a substitute for doing the work.
There's no single official passing threshold published by the DoD — but a low or negative score invites scrutiny, and increasingly, primes set their own minimum expectations for subcontractors regardless of what the government requires directly. The safest target is simply an accurate score backed by a credible, funded plan to close whatever gap remains.
Often, yes. CMMC and NIST 800-171 requirements flow down through the supply chain contractually. A subcontractor that never deals with the DoD directly can still be required to meet a specific level if the information it handles came from a prime contract that requires it.
We're building a free, self-service SPRS score calculator and a short CMMC-level quiz, matching the DoD's actual assessment methodology point-for-point. Check back here, or follow the blog, for when they go live.
Work through the 110 NIST SP 800-171 requirements and get your current self-assessment score, broken down the way the DoD actually scores it. Coming soon.
A few quick questions about your contracts and the information you handle, to figure out roughly which CMMC level applies to you. Coming soon.
General resources only go so far. Tell us about your contracts and setup, and we'll give you a straight answer.
