Your Source for CMMC and Cybersecurity Intelligence!

August 31, 2026 David Fraley

CMMC FIPS Requirements: Why FIPS-Validated Cryptography Should Not Be Required

CMMC currently requires FIPS-validated cryptography in applicable cases, but that requirement can add cost, complexity, and technology constraints. David Fraley explains why the validation mandate should be reconsidered.

August 26, 2026 David Fraley

Microsoft 365 Security Licensing Explained: Business Premium, E3, E5, and Defender Suite Compared

Microsoft 365 licenses may look similar, but they can support very different security architectures. This guide compares Business Premium, E3, E5, and Defender Suite using SecureITSM’s configuration-based security framework.

August 13, 2026 David Fraley

The False Claims Act Is a Growing Cybersecurity Risk for Defense Contractors

Defense contractors face growing False Claims Act risk when SPRS scores, NIST SP 800-171 implementation, and cybersecurity documentation don't match reality. See what recent DOJ cases mean for contractors.

March 18, 2026 Alison Thompson

800-171 Controls (Simplified)

This blog serves as a focused reference guide to NIST SP 800-171 and 800-171A by presenting each control alongside its corresponding assessment objectives and considerations. The content is structured in a clear, tabular format that maps controls to their verification criteria, enabling readers to understand not just what is required, but how compliance is evaluated. Each entry also identifies whether the control aligns to CMMC Level 1 or Level 2 and includes the associated SPRS point deduction if the control is not met. The result is a practical, audit-aligned resource designed to support organizations in preparing for assessments and understanding the measurable impact of compliance gaps.

February 13, 2026 David Fraley, CTO

What is FCI & CUI

Government contractors face a growing challenge: protecting sensitive federal information from unauthorized access or disclosure. Two key data types — CUI and FCI — carry distinct safeguarding requirements that directly impact compliance and contract eligibility. This blog explains what CUI and FCI are, how they differ, why they matter, how to identify them within your environment, and how CMMC requirements apply to each. Understanding these distinctions is essential for building a compliant, defensible cybersecurity program.

February 7, 2026 David Fraley

National Clean Out Your Computer Day 2026: Linking Digital Hygiene to CMMC Compliance

National Clean Out Your Computer Day 2026 highlights how digital hygiene supports CMMC compliance, protects CUI, and keeps defense contractors audit-ready.

November 14, 2025 David Fraley - CTO

Why CMMC Assessments Are So Hard — and Why They Cost So Much

CMMC compliance has rapidly become one of the most demanding compliance frameworks facing Defense Industrial Base contractors. For small and mid-size organizations—particularly manufacturers, engineering firms, and service providers—the effort required to successfully undergo and obtain CMMC Level 2 authorization is profoundly expensive.

October 7, 2025 David Fraley, CTO

CMMC Level 1 Controls by Assessment Objective

Strong security starts with knowing who and what is allowed into your environment—and limiting everything else. Organizations must identify users, devices, and systems; verify identities; control physical and network access; protect data boundaries; and quickly fix vulnerabilities. By clearly defining access, monitoring activity, and enforcing protections, you reduce risk, protect CUI, and strengthen overall compliance.

September 27, 2025 David Fraley, CTO

Why Organizations Should Partner with an MSP for Security and Compliance

The DoD has finalized the CMMC rule, making cybersecurity compliance mandatory...

September 15, 2025 David F - CTO

The CMMC Final Rule Has Arrived: What It Means for Your Business

The DoD has finalized the CMMC rule, making cybersecurity compliance mandatory for defense contractors. Here’s what it means for your business and how to prepare.

Understanding the New CMMC 2.0 Requirements

May 15, 2025 Jackie F.

NIST SP 800-171 vs. CMMC: Understanding the Differences

A detailed comparison of NIST SP 800-171 and CMMC requirements to help organizations understand their compliance obligations

November 9, 2024 Kyle Lough - Sr. Engineer

Security Operations Center — Ground Zero for CMMC Compliance

With cyber threats evolving rapidly, organizations must prioritize cybersecurity and continuously monitor their security posture. A Security Operations Center (SOC) plays a crucial role in detecting, analyzing, responding to, and mitigating cyber threats. However, not all businesses can afford to establish an in-house SOC due to resource constraints. Fortunately, they can still benefit from a Managed SOC (or SOC as a Service).

October 10, 2024 David Fraley CTO

Microsoft’s Government Cloud Offerings

Microsoft GCC and GCC High are Microsoft cloud environments designed to meet the security and compliance needs of Government agencies, contractors, and suppliers. Contrary to popular belief, BOTH GCC and GCC High are compliant with DFARS 7012 and CMMC 2.0. This means that you will have to consider your overall security and compliance needs when deciding between these two options. To help you decide between these two environments, let’s take a look at the primary differences between these two platforms.

March 9, 2024 David Fraley, CTO

Minimizing MS Subscription Software Licensing

An Effective License Position (ELP) reconciles software entitlements with actual usage to identify compliance risks and eliminate wasted spend. By analyzing purchases, deployments, and usage data, organizations can correct under- or over-licensing. SecureITSM’s four-step methodology helps optimize renewals, reduce audit exposure, and ensure cost-effective, well-governed software investments.

December 9, 2023 David Fraley, CTO

How to Reduce CMMC Level 2 Certification Costs

Achieving CMMC Level 2 certification is a critical requirement for defense contractors handling Controlled Unclassified Information (CUI). However, the cost of compliance can be a significant burden, especially for small to mid-sized businesses. The total expense varies based on company size, existing cybersecurity maturity, and IT infrastructure.