CMMC Registered Practitioner (RPA) advisoryCyber AB RPA
CMMC readiness with a scoped enclave — not a firm-wide freeze
Navigating CMMC for the Defense Industrial Base starts with honest scoping. Staff who handle Controlled Unclassified Information work inside a dedicated enclave; the rest of the practice stays on the ordinary stack. We design it, remediate it, and sit with you through readiness — as an RP/RPA, not a slide shop.
Registered Practitioner advisory for the Defense Industrial Base
CMMC is a unified standard designed to protect contractors handling sensitive federal data. Manage IT NY helps you scope a dedicated enclave for Controlled Unclassified Information, close NIST 800-171 gaps, and prepare assessment evidence — without turning the entire firm into a compliance freeze.
We provide guidance, gap analysis, and remediation support as a Cyber AB Registered Practitioner Advanced firm. Formal certification remains the domain of authorized C3PAOs — our job is to maximize your readiness with honest assessments and controls you can operate.
Navigating CMMC compliance for the Defense Industrial Base
Select a program stage to review requirements, focus areas, mandates, and assessment expectations — in the same order as our Registered Practitioner advisory outline.
The Cybersecurity Maturity Model Certification (CMMC) is a unified standard designed to protect the Defense Industrial Base (DIB) from evolving cyber threats. It ensures that contractors handling sensitive federal data have the maturity to safeguard it against unauthorized disclosure. By verifying the implementation of specific cybersecurity practices, CMMC builds a resilient supply chain for the Department of War.
To safeguard the nations digital infrastructure by detecting, preventing, and responding to cyber threats.
To create a secure, resilient, and trusted digital environment for individuals, and government institutions.
Foundational Safeguarding & FAR 52.204-21
Level 1 is the 15 security requirements in FAR 52.204-21. 32 CFR § 170.14 adopts that list. Older guides show 17 practices because the visitor, access-log, and access-device phrases are one FAR requirement split three ways.
- Access Control: 4 requirements, including authorized users and limited external connections.
- Identification and Authentication: 2 requirements, identifying users and verifying them before access.
- Media Protection: 1 requirement, sanitizing FCI media before disposal or reuse.
- Physical Protection: 2 requirements. One of them is the visitor, access-log, and access-device duty.
- System and Communications Protection: 2 requirements, protecting communications and separating public systems.
- System and Information Integrity: 4 requirements, covering flaws, malicious-code protection, updates, and scans.
Protecting Federal Contract Information (FCI).
Codified in FAR 52.204-21, which mandates the basic safeguarding of contractor information systems.
Requires an annual self-assessment and formal affirmation in the Supplier Performance Risk System (SPRS).
CMMC Level 2: Advanced Data Protection
Implementing 110 security practices to safeguard sensitive Controlled Unclassified Information.
Compliance is driven by DFARS 252.204-7012 requiring adequate information security.
Strictly adhering to the 14 families of federal security requirements.
High-priority contracts require independent verification by an authorized C3PAO auditor.
Maintaining capabilities to detect, analyze, and report cyber security incidents.
Developing documented procedures that govern organizational access and data handling.
Scoping & Boundary Definition
We identify all people, technology, and facilities that process, store, or transmit FCI and CUI.
Defining a clear "Security Domain" allows us to isolate sensitive data, reducing the audit footprint and overall compliance costs.
Identifying External Service Providers (ESPs) and Cloud Service Providers (CSPs) to ensure their FedRAMP or CMMC equivalence.
Gap Analysis & Readiness Review
We perform a deep-dive technical and administrative audit of your current environment against the 110 NIST controls.
- NIST 800-171 Control Audit
- SPRS Score Calculation
- Remediation Roadmap Development
As an RP, I provide a detailed readiness report that highlights "Red/Yellow/Green" status for every required practice.
- NIST 800-171 Control Audit
- SPRS Score Calculation
- Remediation Roadmap Development
We calculate your current summary score to ensure accurate reporting to the Department of War.
- NIST 800-171 Control Audit
- SPRS Score Calculation
- Remediation Roadmap Development
SSP & POA&M Development
We author the mandatory 200+ page document detailing how your organization meets every CMMC requirement.
For CMMC Level 2, we document a prioritized list of remediation tasks for eligible controls that are not yet fully implemented. While the Department of War allows these specific items to be resolved within a 180-day window for final certification, it is critical to note that high-impact "critical" controls are not eligible for a POA&M and must be fully met at the time of assessment.
CMMC Level 1 requires 100% compliance at the time of assessment; POA&Ms are not permitted for L1.
Technical Remediation & Implementation
Closing the gaps identified in the analysis through technical configuration and security deployments.
Implementing robust MFA, Zero Trust architecture, and encrypted communication tunnels (VPN/IPsec).
Configuring the centralized logging and auditing systems required to detect and report cyber incidents to the Department of War.
Continuous Monitoring & Annual Affirmation
CMMC is not a "one-and-done" audit; we implement the governance required to maintain your security posture.
We facilitate the yearly requirement for a senior company official to affirm continuous compliance in SPRS.
Keeping your SSP, network diagrams, and policy sets updated as your business grows and federal regulations evolve.
What the CMMC Platform keeps at each level
Level 1 is the 15 requirements in FAR 52.204-21 for Federal Contract Information. Level 2 is the 110 requirements in NIST SP 800-171 Revision 2 for Controlled Unclassified Information. The CMMC Platform runs the workflows, documents, and evidence for the level named in the contract’s DFARS 252.204-7021 blank.
| Platform topic | Level 1 | Level 2 |
|---|---|---|
| Control Matrix | In this level. The 15 requirements in FAR 52.204-21, scored for systems that handle Federal Contract Information. | In this level. The 110 requirements in NIST SP 800-171 Revision 2, scored for systems that handle CUI. |
| Evidence Vault | In this level. Proof for those 15 requirements, kept for the annual affirmation in SPRS. | In this level. Proof for the 110 requirements, including the pack an assessor reads. |
| SSP | Not in this level. A System Security Plan is not a Level 1 deliverable. | In this level. A living System Security Plan that describes how the 110 requirements are met. |
| Policies | Not in this level. Level 1 does not require a policy library. The 15 safeguards run on the in-scope systems. | In this level. Policies that state how the organization meets NIST SP 800-171 Revision 2. |
| Procedures | Not in this level. Written procedures are not one of the 15 Level 1 requirements. | In this level. The steps people follow to protect CUI and to keep the evidence current. |
| Responsibility Matrix | In this level. Who operates the in-scope systems, and which official submits the annual SPRS affirmation. | In this level. Who owns each part of the CUI program, including duties shared with cloud and service providers. |
| Diagrams | In this level. The systems that process, store, or transmit FCI. That picture is the scope in 32 CFR § 170.19. | In this level. The CUI enclave boundary, including where CUI is stored and where it moves. |
| Risk Register | Not in this level. Level 1 has no open-risk list. Each of the 15 requirements is met, or the level is not met. | In this level. Risks tied to the 110 requirements, including gaps the rule allows onto a POA&M. |
| POA&M | Not in this level. 32 CFR § 170.15 does not allow a plan of action and milestones at Level 1. | In this level. A plan of action only for the Level 2 gaps the rule allows to stay open. |
| Visitor logs | In this level. FAR 52.204-21 requires visitors to be escorted and visitor activity to be monitored and logged. | In this level. The same physical-access record for the spaces where CUI is handled. |
| Incident response | Not in this level. The 15 requirements cover flaws and malicious code. A full incident-response program is Level 2. | In this level. Incident handling and exercises for the CUI environment, including the DFARS reporting path. |
| Shipping chain of custody | Not in this level. Level 1 does not require a shipping log. Media disposal is a separate requirement. | In this level. A record of each handoff when CUI leaves in a shipment. |
| Data destruction custody | In this level. FAR 52.204-21 requires FCI media to be sanitized or destroyed before disposal or reuse. | In this level. The same proof for CUI media, under the fuller media-protection requirements. |
| Security protection stack | In this level. The tools that carry out the 15 safeguards, including access control, boundary monitoring, and malicious-code protection. | In this level. The security protection assets in the CUI scope. A cloud in that stack needs FedRAMP Moderate, or equivalent, when it handles CUI. |
| Work from home | In this level. The computer that opens Federal Contract Information is in scope under 32 CFR § 170.19 and must meet the 15 requirements in FAR 52.204-21. The home network is not the system. | In this level. CUI stays on the enclave computer. The remote session is watched, encrypted, and brought in through a managed entry point. The home network is not the enclave. |
| Which computer holds the data | In this level. Every computer that processes, stores, or transmits FCI is in the assessment. A personal phone or home computer that also opens FCI must be limited or kept out. A second computer helps only when FCI is moved off everyday email and files. | In this level. People who handle CUI use a dedicated enclave computer. A separate commercial computer that cannot reach CUI stays outside the assessment. One computer that can open both pulls the commercial side into scope. |
| Encryption | Not in this level. Not one of the 15. FAR 52.204-21 does not require FIPS encryption of FCI at rest or in transit. Communications that carry FCI are still watched and protected at the boundary. | In this level. Cryptography used to protect CUI must be FIPS-validated. That covers CUI at rest, CUI in transit, CUI on mobile computers, and the remote session (NIST SP 800-171 Revision 2). |
| Flow-down requirement and management | In this level. 32 CFR § 170.23 flows Level 1 to subcontractors whose systems handle Federal Contract Information. | In this level. The same duty when a subcontractor handles CUI, including DFARS 252.204-7012 and the level named in the contract. |
| Labels and signage | Not in this level. Level 1 does not require CUI labels or signs. FCI is protected from public release. | In this level. Labels and signs so people can see where CUI is stored, handled, and discussed. |
| CRMA | Not in this level. Contractor Risk Managed Assets are a Level 2 scope category. Level 1 scope is the systems that handle FCI. | In this level. Assets that can, but are not intended to, process CUI, listed and managed as Contractor Risk Managed Assets. |
| Training and Awareness | Not in this level. Security awareness training is not one of the 15 FAR requirements. | In this level. Training for people who handle CUI, with completion stored as evidence. |
| SPRS score | In this level. The affirming official posts the annual Level 1 self-assessment. 32 CFR § 170.15. | In this level. The Level 2 result, self-assessed or from a C3PAO, is posted in SPRS against the 110 requirements. |
| Vendors | In this level. A vendor that can reach FCI is inside the Level 1 scope and the flow-down. | In this level. A vendor that can reach CUI is inside the Level 2 scope, with the NIST SP 800-171 flow-down. |
| External service providers | In this level. A provider that stores or transmits FCI must meet the 15 safeguards for that work. | In this level. A provider that handles CUI must meet NIST SP 800-171 Revision 2. A cloud provider in that role needs FedRAMP Moderate or equivalent. |
| Cloud service providers | In this level. A commercial cloud may hold FCI when it meets FAR 52.204-21. GCC and FedRAMP are not required. | In this level. A cloud that handles CUI needs FedRAMP Moderate or equivalent under DFARS 252.204-7012. |
Control Matrix
Level 1
In this level. The 15 requirements in FAR 52.204-21, scored for systems that handle Federal Contract Information.
Level 2
In this level. The 110 requirements in NIST SP 800-171 Revision 2, scored for systems that handle CUI.
Evidence Vault
Level 1
In this level. Proof for those 15 requirements, kept for the annual affirmation in SPRS.
Level 2
In this level. Proof for the 110 requirements, including the pack an assessor reads.
SSP
Level 1
Not in this level. A System Security Plan is not a Level 1 deliverable.
Level 2
In this level. A living System Security Plan that describes how the 110 requirements are met.
Policies
Level 1
Not in this level. Level 1 does not require a policy library. The 15 safeguards run on the in-scope systems.
Level 2
In this level. Policies that state how the organization meets NIST SP 800-171 Revision 2.
Procedures
Level 1
Not in this level. Written procedures are not one of the 15 Level 1 requirements.
Level 2
In this level. The steps people follow to protect CUI and to keep the evidence current.
Responsibility Matrix
Level 1
In this level. Who operates the in-scope systems, and which official submits the annual SPRS affirmation.
Level 2
In this level. Who owns each part of the CUI program, including duties shared with cloud and service providers.
Diagrams
Level 1
In this level. The systems that process, store, or transmit FCI. That picture is the scope in 32 CFR § 170.19.
Level 2
In this level. The CUI enclave boundary, including where CUI is stored and where it moves.
Risk Register
Level 1
Not in this level. Level 1 has no open-risk list. Each of the 15 requirements is met, or the level is not met.
Level 2
In this level. Risks tied to the 110 requirements, including gaps the rule allows onto a POA&M.
POA&M
Level 1
Not in this level. 32 CFR § 170.15 does not allow a plan of action and milestones at Level 1.
Level 2
In this level. A plan of action only for the Level 2 gaps the rule allows to stay open.
Visitor logs
Level 1
In this level. FAR 52.204-21 requires visitors to be escorted and visitor activity to be monitored and logged.
Level 2
In this level. The same physical-access record for the spaces where CUI is handled.
Incident response
Level 1
Not in this level. The 15 requirements cover flaws and malicious code. A full incident-response program is Level 2.
Level 2
In this level. Incident handling and exercises for the CUI environment, including the DFARS reporting path.
Shipping chain of custody
Level 1
Not in this level. Level 1 does not require a shipping log. Media disposal is a separate requirement.
Level 2
In this level. A record of each handoff when CUI leaves in a shipment.
Data destruction custody
Level 1
In this level. FAR 52.204-21 requires FCI media to be sanitized or destroyed before disposal or reuse.
Level 2
In this level. The same proof for CUI media, under the fuller media-protection requirements.
Security protection stack
Level 1
In this level. The tools that carry out the 15 safeguards, including access control, boundary monitoring, and malicious-code protection.
Level 2
In this level. The security protection assets in the CUI scope. A cloud in that stack needs FedRAMP Moderate, or equivalent, when it handles CUI.
Work from home
Level 1
In this level. The computer that opens Federal Contract Information is in scope under 32 CFR § 170.19 and must meet the 15 requirements in FAR 52.204-21. The home network is not the system.
Level 2
In this level. CUI stays on the enclave computer. The remote session is watched, encrypted, and brought in through a managed entry point. The home network is not the enclave.
Which computer holds the data
Level 1
In this level. Every computer that processes, stores, or transmits FCI is in the assessment. A personal phone or home computer that also opens FCI must be limited or kept out. A second computer helps only when FCI is moved off everyday email and files.
Level 2
In this level. People who handle CUI use a dedicated enclave computer. A separate commercial computer that cannot reach CUI stays outside the assessment. One computer that can open both pulls the commercial side into scope.
Encryption
Level 1
Not in this level. Not one of the 15. FAR 52.204-21 does not require FIPS encryption of FCI at rest or in transit. Communications that carry FCI are still watched and protected at the boundary.
Level 2
In this level. Cryptography used to protect CUI must be FIPS-validated. That covers CUI at rest, CUI in transit, CUI on mobile computers, and the remote session (NIST SP 800-171 Revision 2).
Flow-down requirement and management
Level 1
In this level. 32 CFR § 170.23 flows Level 1 to subcontractors whose systems handle Federal Contract Information.
Level 2
In this level. The same duty when a subcontractor handles CUI, including DFARS 252.204-7012 and the level named in the contract.
Labels and signage
Level 1
Not in this level. Level 1 does not require CUI labels or signs. FCI is protected from public release.
Level 2
In this level. Labels and signs so people can see where CUI is stored, handled, and discussed.
CRMA
Level 1
Not in this level. Contractor Risk Managed Assets are a Level 2 scope category. Level 1 scope is the systems that handle FCI.
Level 2
In this level. Assets that can, but are not intended to, process CUI, listed and managed as Contractor Risk Managed Assets.
Training and Awareness
Level 1
Not in this level. Security awareness training is not one of the 15 FAR requirements.
Level 2
In this level. Training for people who handle CUI, with completion stored as evidence.
SPRS score
Level 1
In this level. The affirming official posts the annual Level 1 self-assessment. 32 CFR § 170.15.
Level 2
In this level. The Level 2 result, self-assessed or from a C3PAO, is posted in SPRS against the 110 requirements.
Vendors
Level 1
In this level. A vendor that can reach FCI is inside the Level 1 scope and the flow-down.
Level 2
In this level. A vendor that can reach CUI is inside the Level 2 scope, with the NIST SP 800-171 flow-down.
External service providers
Level 1
In this level. A provider that stores or transmits FCI must meet the 15 safeguards for that work.
Level 2
In this level. A provider that handles CUI must meet NIST SP 800-171 Revision 2. A cloud provider in that role needs FedRAMP Moderate or equivalent.
Cloud service providers
Level 1
In this level. A commercial cloud may hold FCI when it meets FAR 52.204-21. GCC and FedRAMP are not required.
Level 2
In this level. A cloud that handles CUI needs FedRAMP Moderate or equivalent under DFARS 252.204-7012.
A check means that topic is part of the level. A dash means it is not.
Where CMMC programs stall
Four readiness friction points we clear first
Registered Practitioner advisory turns unscoped CUI, thin SPRS scores, missing SSP evidence, and one-and-done myths into a scoped, operable plan.
CUI everywhere
Most contractors discover Controlled Unclassified Information lives in more mailboxes, shares, and SaaS apps than the last slide claimed — and a firm-wide freeze is the expensive default.
110 practices, thin evidence
CMMC Level 2 expects 110 security practices aligned to NIST 800-171. Without a current-state audit and SPRS score, you cannot tell red from green before a C3PAO arrives.
SSP and POA&M still blank
Assessors expect a living System Security Plan and a prioritized Plan of Action & Milestones. Critical controls cannot hide behind a 180-day promise.
One-and-done audit myth
CMMC is not a certificate you hang and forget. Annual affirmation in SPRS and continuous monitoring are part of staying in the supply chain.
What our RPA advisory covers
Readiness support inside the CMMC ecosystem
Gap analysis, SSP and POA&M authorship, enclave scoping, Zero Trust remediation, and continuous monitoring — delivered under the Cyber AB Code of Professional Conduct.
RP / RPA advisory
Cyber AB registered practitioner
Steve Greenberg is a CMMC Registered Practitioner Advanced, trained and registered with The Cyber AB to provide specialized consulting and readiness support — integrity and technical accuracy first.
Gap analysis & SPRS
Current-state against 110 controls
Deep-dive technical and administrative audit, red/yellow/green readiness reporting, and an accurate SPRS summary score for DoD reporting.
SSP & POA&M
Assessment-ready documentation
We author the System Security Plan and a prioritized Plan of Action & Milestones for eligible Level 2 gaps — with clear notes on controls that cannot wait.
Enclave scoping
Isolate CUI without freezing the firm
A dedicated environment for the people and systems that touch CUI — identity, devices, and logging that match the assessment you are walking toward.
Technical remediation
MFA, Zero Trust, and logging
Close gaps with access controls, encrypted paths, and centralized audit logging required to detect and report cybersecurity incidents.
Continuous monitoring
Annual affirmation support
Governance to maintain posture year-round, facilitate SPRS affirmations, and keep SSP, diagrams, and policies current as regulations evolve.
Ethics, scope, and answers leaders ask first
Consulting versus assessment, CoPC integrity, POA&M limits, and what an Enclave Box actually means for your firm.
A CMMC enclave is a smaller, dedicated environment for Controlled Unclassified Information. Staff who need CUI work there; the rest of the practice stays on the ordinary stack. “Enclave box” here means approach — identity, network, and process walls — not a gadget on a price list.
No. As a Registered Practitioner, Manage IT NY provides guidance, gap analysis, and remediation support. Formal CMMC certification assessments are the exclusive domain of authorized C3PAOs. We cannot consult for an organization and then participate in its formal certification assessment.
We adhere to the Cyber AB Code of Professional Conduct: honest assessments without exaggeration, rigorous protection of CUI and FCI encountered during consulting, and immediate disclosure of potential conflicts of interest to the client and The Cyber AB.
DoD allows certain eligible items to be resolved within a 180-day window for final certification, but high-impact critical controls are not eligible for a POA&M and must be fully met at the time of assessment. Level 1 requires 100% compliance at assessment; POA&Ms are not permitted for L1.
That is the point of an enclave: the people and systems that touch CUI, not every mailbox in the firm. If your contract requires more, we will say that early — shrinking the scope is often the first honest step.
CMMC without freezing the whole firm
Scope first, then prove the controls
Defense contractors need Level 2 maturity for Controlled Unclassified Information — driven by DFARS 252.204-7012 and NIST 800-171 — without putting every intern workstation under the same control set. We turn that pressure into a scoped enclave and assessment-ready evidence.
Unscoped CUI and thin readiness
Enclave design plus RP readiness
CMMC certification is determined solely by an independent C3PAO and DoD authorities. Manage IT NY provides RP/RPA consulting and readiness support; we do not perform formal certification assessments.
Advisory themes for defense contractors
DIB program navigation, DFARS and NIST alignment, assessment prep, and incident-ready logging — browse by theme.
Navigating CMMC for the Defense Industrial Base
CMMC verifies that contractors handling sensitive federal data have the maturity to safeguard it. We translate program language into a scoped plan your operations team can execute — Level 1 foundational safeguarding through Level 2 advanced CUI protection.
Readiness assessmentDFARS 252.204-7012 and NIST 800-171 alignment
Level 2 compliance is driven by DFARS requirements for adequate information security and the 14 families of NIST 800-171. We map your environment to those practices and close gaps with controls you can operate day to day.
System hardeningReady for self-assessment or C3PAO review
Level 1 requires annual self-assessment and SPRS affirmation. High-priority Level 2 contracts need independent verification by an authorized C3PAO. We prepare evidence, SSP, and remediation status so you walk in with facts.
Schedule a one-on-one with an RPA consultantDetect, analyze, and report
Level 2 expects incident response capability and enforceable security policies. We configure centralized logging and Zero Trust access so you can detect, analyze, and report cybersecurity incidents as required.
EDR / MDR1 / 4