Long-form guides for contractors doing the work.
Five substantive guides covering the topics that come up most in scoping conversations — CMMC itself, the NIST baseline, the Microsoft tenant decision, SPRS scoring, and the OT/ICS edge case where standard CMMC consultants stop short.
Guides
CMMC Overview & Timeline
What CMMC is, who needs it, the three levels, and the November 2026 Phase 2 deadline that matters for most contractors.
NIST SP 800-171 Walkthrough
All 110 controls grouped by family, what each family covers, and where most contractors actually fall short.
GCC High vs GCC vs Commercial
When you need each tier, what it costs, and the ITAR/EAR factors that force the decision. The most common scoping mistake explained.
SPRS Scoring Deep-Dive
How the -203 to 110 scoring works, what each control is worth, and how the 88-point conditional Level 2 threshold actually behaves.
OT & ICS for CMMC
Where standard CMMC scoping falls short for manufacturing and industrial environments. NIST SP 800-82, ISA/IEC 62443, and the architectural moves that work.
Scoping OT & ICS for CMMC
The plant floor is where most CMMC programs are scoped wrong. The five asset categories, why OT pulls CUI into scope, and how to right-size the boundary.
More references
— Done reading