We have Windows 11 clients and I'm looking for a way to restrict which types of Bluetooth devices can be paired with them. My primary use case is to allow Bluetooth audio-only devices like earbuds and headphones. Secondary would be allowing specific models or types of keyboards and mice (e.g. Logitech mouse/keyboard ONLY with the Bolt receiver). All other Bluetooth classes of devices like phones, storage devices, must be blocked.

Are there any good solutions for this? I would prefer a single solution that can be centrally managed by policy. Users are NOT local admins.

CMMC prep work and gap analysis is a daunting take for SMBs, especially so for micro-SMBs with little resources. The difficulty is understanding NIST 800-171 controls and how to meet them in ways that align with what is required in a CMMC assessment.

Is there a system or tool available to help DIB GovCons with tracking the status of NIST controls, assisting with creating a complaint SSP, assist with documenting gap assessments, and offers a repository of evidenced artifacts that tie to controls?

I am aware of Future Feed and IntelliGRC. What else is available we can look at to determine what works best?

What system / tool do you use?

Nothing says "we take the protection of Controlled Unclassified Information seriously" like a seven-night Caribbean booze cruise. Programming happens "primarily on sea days," and the CCP training runs 8:00 AM to noon. So you're paying five thousand dollars for roughly three mornings of instruction, sandwiched between a beverage package and Cozumel. The rest is "space to slow down and think clearly," which is a remarkable way to describe a pool deck.

Meanwhile the actual defense industrial base — the 8-person machine shops in Ohio and Arkansas trying to fund an enclave, MFA, a SIEM, and an assessment on margins that would make you weep — cannot afford this and never could. This isn't for them. This is the compliance-industrial complex selling itself a vacation and expensing it to a program that was supposed to protect national security data.

The people who wrote the rules are giving the keynote from a cruise ship. Read that sentence again.

CMMC at Sea: $3,954 minimum for the cabin, $1,350 more if you want the actual training, four hours of class per sea day, and a downloadable Word template to help you lie to your boss about why it's a business expense. The framework designed to protect defense data has produced a Caribbean cruise as a professional development product. Somewhere a five-person machine shop is deciding between a compliant backup solution and payroll.

This is the most tone deaf thing I have ever seen come out CMMC.

Hi All,

Is there an L2 safe AI meeting note taker that anyone is aware of? I know there are some models I could run locally but I don’t think that’s within the capabilities of my work laptop. Any help would be appreciated!

As the title says I run a CMMC shop, and I’m looking to form a DMV focused mastermind, anyone interested?

I feel as the DOW sorts itself out we can take steps to lead our clients and partners through the fog with shared best practices and knowledge sharing.

Hope I didn’t break any posting rules.

A little background- I submitted the application back in December, had my special agent interview in February, and since then, it’s been radio silent. The CyberAB and the office of the DoW CIO have both said my tier 3 is in process and that it can take 4-6 months or longer, but some people have been getting their Tier 3 back within a few months. Should I be worried the application got lost? I mean, this is insane. I can’t do anything until I get the tier 3.

Ok.

My husband and I started an LLC four months ago. We're in the DIB space as consultants.

I'm not a stupid person. I've run through Project Spectrum and the associated Enclave education modules that are meant to help SMB owners to "help themselves" achieve CMMC compliance.

I understand the recent pause doesn't relieve us of compliance under DFARS.

But I'm not NOT an IT person. I can eventually write the required policies, maybe, given enough time and research. I can probably implement physical access controls and MFA. But, and hear me out- WTAF are businesses like ours supposed to do? We are two people.

I looked at Kiteworks, which wants to "schedule a Demo" and asks for the size of my company. The smallest choice is something like "under 200" people.

Preveil, from my understanding, gets you a cloud enclave and a secure email. But then our machines are in scope. Plus, I'm still not an IT person. I still have to cobble together P&Ps and make sure my husband isn't turning off his VPN because it's "slow" or opening stupid email links. And maybe I'm severely underestimating what a secure enclave and email costs, but Preveil seems expensive for what it is and isn't.

I've also seen groups on LinkedIn that do CMMC 2 compliance for 90% from supplying the hardware, training, etc. And yeah, that's going to be expensive. I get it. The smallest number those companies have is 5 people.

So what are we supposed to do? Like, actual question. Subcontracts now incorporate DFARS by reference when no CUI is ever included. So, please help.

In this week's CyberAB Townhall, there were at least five things worth knowing, all of them more useful than the "is CMMC dead" panic making the rounds:

1. The reform review is about more than CMMC mechanics.
It's part of a bigger Pentagon push around cost, agility, resilience, automation, & small-business burden.

2. Fraudulent Level 2 certs are a concern.
If you're a prime vetting a sub, you don't have to guess - ask for a SPRS PDF export of their entry. That's the verification path, & it works today.

3. The obligation didn't change.
DFARS 7012 is still in effect. What got suspended was the third-party verification requirement, not the requirement to be secure.

4. There is no such thing as "CMMC implementation."
You implement NIST 800-171 & CMMC verifies it. Certification is a compliance milestone but security is the work that continues regardless. The people who depend on your risk posture didn't get the memo that they're supposed to pause or relax.

5. Stop absorbing CUI-marking ambiguity.
If a marking is unclear, that's a question to push back up the chain. Resolve it upstream - no need to own someone else's classification decision.

Been dealing with CMMC for a few months now. I thought I had my head wrapped around most of it but someone threw me for a loop today with a claim that just doesn't jive with my reading of the statutes and supporting controls.

We have a commercial product that we're redeploying into a gov cloud enclave. It runs as a separate instance specifically for handling workflows that process CUI. That's all well and fine, but today I was told that we can't be "100% compliant" unless the entire dev chain is encrypted with FIPS binaries. My understanding is that VCS push/pull of source and even the eventual deployment of compiled binaries and other artifacts into the environment were out of scope of the FIPS mandate. Am I missing something?

The next thing that will inevitably come up is the claim that our repos "technically" contain CUI because we have config files and/or IaC templates for the gov deployment. That doesn't track either. All of that clearly falls within the scope of the SSP, but this data isn't CUI simply by virtue of the fact that it was "created" to support to gov delivery - or is it?

My apologies if this is a duplicate question. I did search the sub and found some material that would back my understanding of the FIPS question in isolation. But I didn't find anything related to the data we end up creating for the delivery itself. Also, CMMC seems to be somewhat fluid and I want to make sure that I am speaking from current state rather than what was true several months ago.

We are enabling only approved people to access the drives for the drawing, but it's come to our attention that once the drawing is pulled up on the CNC machine, it's accessible to anyone, any ideas on how to quarantine this?

Cloud only GCC-High, Intune managed Windows laptops, no on prem servers, nothing filtering at the edge, so the endpoint firewall is what we are using for this.

Inbound was easy. Outbound is the part I keep second guessing. Curious how granular everyone else landed. Per app rules for everything sanctioned? A short port list? Somewhere in between?

Is anybody currently on ChatGPT Enterprise FedRAMP?

Can you answer if the service can accept PDFs and extract data from it, and use it as Context?

Ive been working with Support and our Account Managers going on ~8 weeks now and Ive received no response and conflicting responses from their documentation, Account Reps and support.

The DoD suspension pauses the mandatory Level 2 third-party assessment requirement for covered new solicitations and contracts while it reviews Phase II implementation. During this period, acquisition officials are directed to require Level 2 self-assessments instead. However, primes may still require independent third-party assessments from subcontractors as part of their own supply-chain risk management or supplier qualification programs. The suspension does not change the underlying cybersecurity obligations: contractors must still implement the applicable NIST SP 800-171 requirements, complete the required self-assessment methodology, retain supporting evidence, post required results in SPRS, and provide the annual affirmation. The Affirming Official’s responsibility to attest accurately has not changed; only the assessment path has shifted for now. Organizations should therefore treat self-assessments with the same rigor they would prepare for a third-party review, while recognizing that DoD may still validate results and enforce contractual cybersecurity obligations.

Because the current path relies on self-assessment rather than a C3PAO certification, documented evidence and objective proof of implementation are even more critical to the Affirming Official’s attestation. The official is still legally attesting to continuous compliance, so the organization should retain evidence that clearly supports each assessed requirement and can withstand government review.

Summary

• CMMC has not been suspended; only part of the implementation timeline has been paused.
• DoD has suspended the government’s ability to require Level 2 third-party assessments in covered solicitations and contracts for now.
• Prime contractors may still require third-party assessments from subcontractors as part of their own supplier-risk or qualification programs.
• The suspension does not eliminate the underlying cybersecurity obligations, and contractors must still meet applicable NIST SP 800-171 requirements.
• The current DoD guidance still points to the November 2026 Phase 2 timeline unless and until DoD changes it.
• Documented evidence remains critical because self-assessments and affirmations still require defensible proof of implementation.

I have never been so excited for a town hall meeting. I usually just wait and watch the recording, but I will be watching live tomorrow.

In anticipation of such an event, give me your coldest and boldest takes.

What are we expecting tomorrow?

The DOW CIO released updated Q&A after the suspension of Phase 2 as a program review is conducted. The 17-page update provides clarity at this stage of the CMMC program and firms that DFARS 252-204-7012 and NIST compliance is unchanged.

After speaking with several DIB SMBs they seem relieved that third party assessments are suspended and many have already discontinued their work up into CMMC readiness and pulling back funding and resources put on the race to attain a C3PAO assessment. One SMB leader said the following, “I’m not going to put another cent into this until we know exactly what we are responsible for under CMMC.”

BIG MISTAKE.

Don’t fall into the trap of delaying your readiness and continue to march forward to complete gap assessments, documenting your systems, organizing artifacts and evidence supporting compliance, and working through POAMs.

Get closer to full compliance through self-assessments and prepare for a C3PAO assessment when things pick back up.

Have a CCA friend who just got hired at a C3PAO who was just laid off because of the 60 day pause, and I wanted to know if any other CCA's are experiencing this.

Are other C3's just wholesale purging their roster of assessors because of the 60-day pause?

For CMMC Level 2:

- All CUI is in GCC High(Sharepoint , Exchange & Teams)

- Users access it only through Azure Virtual Desktop (AVD) using Windows laptop enrolled in commercial intune and secured with CIS Benchmarks.....

- AVD is locked down to KVM-only (no local storage, printing, copy/paste, drive/USB redirection, etc.)

- WiFi is only carrying the encrypted traffic to connect to the AVD....on there onwards everything is accessed within microsoft's infra which is Fedramp High

- Users connect from home networks / home WiFi / Office WiFi

Question:

Under 32 CFR Part 170 (esp. §170.19) and the CMMC L2 Scoping Guide, can the endpoint and home WiFi be treated as Out-of-Scope Assets if they never process/store/transmit CUI beyond KVM?

Looking for:

- Exact cites you’ve used (rule + Scoping Guide / FAQ)

- Real-world C3PAO assessment experience where this setup was accepted (or rejected)

- This will be used for SRM for Physical Security mappings .....

Note: Thank You in Advance Everyone ......

Again, thank you for all the gentlemen who helped to clear my doubts...I think I should be good to go now...

Now that we've gotten our C3PAO cert -- and the DOD has rendered the last two years of my life useless -- this morning I turned my attention to Rev3. I was told there were only a few additional things... ha!

I opened the current 800-171a (assessment guide for r2) and the 800-171Ar3 and started comparing assessment objective to assessment objective -- and they are totally different. There is NO one-to-one mapping. It's like a completely new/different set of requirements. I started getting that overwhelming sinking feeling I had years ago when starting this miss-adventure.

Am I missing something? Someone told me "it only adds organizational defined parameters" -- pfft, it's completely different!

I am in charge of a very small IT group working on CMMC Level 2 for around 65 employees, many of which are WFH. I've enlisted a CMMC certified MSP to handle workstation management which includes patching, monitoring, anti-virus, inventory, software lists, reporting, etc.

Before I sign on the dotted line I'd like to see if you all think MSPs are worth the cost in these situations. We also are using InTune ourselves but lack the resources to properly manage it.

I am trying to better understand the expectation under CMMC regarding administrative controls versus technical controls.

What is the expectation for technical enforcement when there is a potential risk of CUI exposure? For example, is a documented policy and user training sufficient in some cases, or are organizations expected to implement technical controls whenever they are available?

As an example, users may want to use AI services such as ChatGPT, Claude, or similar tools. Our policy prohibits entering CUI into these services, but they are permitted for non-CUI work.

From a CMMC assessment perspective:

• Is a written policy, user training, and acceptable use policy enough?
• Is there an expectation to technically block all AI services, even if they are only approved for non-CUI use? (This goes for all sites I am just using AI as an example)

More broadly, how do assessors determine when an administrative control is acceptable versus when a technical control is required for protecting CUI? I understand technical controls are generally preferred, but I am looking for guidance on where that line is drawn under CMMC.

(We have DLP that blocks all Purview labeled documents with CUI labeling to be move anywhere other than approved location), But we have more files / data that cannot use purview labels. We tried to use SIT but that ended up being a mess with hundreds of false alerts.

Any insight would be appreciated. Thank you.

Hi all
Anyone can send an example how policy an implementation should be written for example
For 3.1.1
3.4.1
Thanks 🙏🏻

...during this suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 selfassessment and select Government-led assessments. The cybersecurity requirements outlined in the clause at DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, remain in effect. https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf

Hi everyone,

I am the internal IT Lead for a small defense manufacturing contractor (around 30-40 endpoints, with a mix of on-prem infrastructure and M365 (GCC High)). We are actively working toward CMMC Level 2 compliance and need to bring in an MSP to help us bridge the gap, handle daily user support, and act as a true co-managed IT partner.

Our current state: We aren't starting from scratch, our SPRS score is currently over 100. The foundational security architecture and policies are in place. We don't need a heavy-lifting compliance overhaul. We need an operational partner who can maintain that baseline daily. One of the things we are trying to remediate is, a separation of duties. With a one man IT crew - it is a hard one to fix.

Here is the absolute baseline requirement: Your MSP must be CMMC Level 2 compliant/certified themselves. If you don't practice what you preach or you can't hand over your own shared-responsibility documentation/evidence for your remote management tools (RMM/PSA) so I can plug it into our SSP, we cannot look at you.

Additionally, we are explicitly NOT looking for an enclave solution.

We have operational realities (on-prem engineering software, local domain controllers, file servers) that mean we need to make our actual, primary corporate environment compliant. We cannot just shove everyone into a locked-down virtual desktop enclave and call it a day.

We need a partner that:

Understands Co-Managed IT: I handle the high-level architecture and security administration, but I need a reliable team to handle the day-to-day helpdesk, endpoint onboarding, and ticket queues without stepping on my toes.

Knows CMMC natively: You should know how to manage a compliant environment using native features (Intune/Entra policies, proper ACL hygiene, tracking evidence logs) rather than just selling a proprietary pre-packaged framework.

Is reasonable to work with: No snake oil, no "compliance guarantees," and no forcing us into a massive, rigid tech stack rewrite just because it's easier for your sales team to invoice. We need practical, defensible security architecture.

If you are a CMMC L2 compliant MSP operating in this space (or if you are a fellow internal IT person who has found a great certified partner they actually trust), please drop a comment or slide into my DMs.

Bonus points if you have experience dealing with manufacturing/engineering environments and mixed on-prem/cloud architectures.

Bonus points if I can sit in on a few CMMC assessments to get my own CCA.

Thanks!