Stop Fumbling Through Your CMMC Assessment
Practice-by-practice guidance for small defense contractors, written by someone who has actually been in the assessment room. Plain English. No vendor pitch. No "schedule a call."
The problem nobody talks about
You probably already have most of what you need to pass. The tools are there. The policies exist somewhere. Maybe your MSP handles half of it.
But when the assessor asks "how does your organization handle least privilege for administrative accounts?" can you answer that in two sentences? Can you point to exactly where your SSP defines it and show evidence it's happening?
That's where most small contractors fall apart. They have the controls. They just never practiced translating what they do into what the assessor needs to hear.
This site covers the hardest practices to explain, the ones where I've seen the most people stumble, with the kind of guidance you'd get from someone sitting next to you in the assessment room.
Browse by family
110 practices across 14 families. Pick a family to see every practice guide in it.
Who writes this
This site is built by people who have spent years helping small defense contractors prepare for and survive Level 2 assessments. We've been in the room when the assessor asks to see your privileged accounts live and your SSP doesn't match what's on screen.
We don't sell MSSP services. Nobody pays us to recommend their product. The practice guides on this site are the actual product. This information should exist somewhere that isn't paywalled or buried in a 200-page PDF.
More about usDon't know where to begin?
Two starting points depending on where you are.