Class Deviation Revision 3: Still in the Holding Pattern
A new class deviation is circulating widely. Here is what it actually says, what it does not say, and where things stand on CMMC.
A Lead CCA’s Perspective on Preparing for Your CMMC Certification
By Ned Butler, Lead Certified CMMC Assessor (CCA), Redspin If you’re an Organization Seeking Certification (OSC), you already know what’s on the line: contract eligibility, revenue, reputation, and the CUI protections that ultimately support the...
Where Does Your CUI Actually Go? Why Rev. 3 Wants You to Keep a Register
Learn what NIST SP 800-171 Rev. 3 requires organizations to document about where CUI is stored, processed, and exchanged—and how a living CUI Register can help.
POA&M vs. OPA—Why Organizations Get Them Confused
POA&Ms and Operational Plans of Action aren’t the same thing. Learn when CMMC requires each, how they differ, and the common mistakes assessors see.
How Many DIB Cyber Incidents Go Unreported
Learn about the challenges of unreported DIB cyber incidents and why they pose a significant threat to national security.
Reforming CMMC RFI: Redspin’s Response
Read Redspin’s response to the Reforming CMMC and Reducing Compliance Burden for the DIB RFI, including recommendations for improving CMMC.