NIST SP 800-171 Archives - Tech Prognosis Blog

CMMC Level 2 Readiness: The Need for Strong IT Audits

April 12, 2026 by Daniel Ihonvbere

CMMC Level 2 Readiness: Why Strong IT Audits Are the Difference Between Compliance and Contract Loss

For defense contractors, CMMC Level 2 is no longer a theoretical requirement—it’s a gatekeeper. As the Department of Defense moves away from self‑attestation toward evidence‑based assessments, organizations handling Controlled Unclassified Information (CUI) must now prove their cybersecurity maturity.

At the core of that proof is one often‑misunderstood capability: the IT audit function.

In our work helping organizations prepare for and pass CMMC Level 2 assessments, we consistently see the same pattern. Companies that treat audits as a last‑minute compliance exercise struggle. Companies that integrate internal and external audit disciplines into their CMMC strategy succeed—and stay compliant long after certification.

This article explains how IT audits directly support CMMC Level 2 readiness, why both internal and external auditors matter, and how audit‑driven programs build real cybersecurity resilience.

Data Flow Mapping for CMMC Level 2 and Your Entire Compliance Strategy

March 24, 2026 by Daniel Ihonvbere

Data Flow Mapping for CMMC Level 2: Why Mapping CUI Flow Determines Your Entire Compliance Strategy

If you can’t see where Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) travel in your workflows, you can’t scope your obligations—period. This data flow mapping guide gives you a clear, repeatable way to map data flows, define system boundaries, and stop misclassification before it derails your contract.

Executive Summary

Controlling how CUI flows inside and outside your environment determines scope, architecture, tooling, and cost.
Design a focused CUI enclave so requirements only follow where CUI actually goes, reducing complexity and spend.
Document, enforce, and evidence approved flow paths to satisfy AC.L2-3.1.3 and pass a CMMC Level 2 assessment.

1. Introduction: Data Flow—the Most Underestimated Requirement

Organizations that pass CMMC Level 2 know exactly where CUI is allowed to go and can prove it never goes anywhere else. Information flow control is not just another checkbox—it shapes your boundary, controls, and cost.

2. What “Data Flow Control” Means in CMMC (AC.L2-3.1.3)

Control the flow of CUI in accordance with approved authorizations. Assessors expect to see:

Defined information flow control policies;
Defined enforcement mechanisms;
Designated sources and destinations for CUI;
Defined authorizations for CUI flow;
Consistent enforcement of those authorizations.

CUI vs. FCI: What Every DoD Contractor Must Get Right Before Chasing CMMC

March 18, 2026March 17, 2026 by Daniel Ihonvbere

Why this article on CUI vs. FCI matters

If you’re a prime, a sub, or an overwhelmed SMB in the Defense Industrial Base (DIB), your CMMC journey starts with one decision: What data are we protecting – Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or both? Get this wrong and everything downstream – scope, controls, budget, tools, even your chances at award – will be off. The good news: you can make this call with clear, objective criteria grounded in FAR 52.204‑21 (FCI) and 32 CFR Part 2002 (CUI), along with DoD and NIST guidance.

Quick CUI vs. FCI definitions (plain English)

FCI (Federal Contract Information)
Information not intended for public release that the Government provides to you or that you generate under a Federal contract to deliver a product or service. If it’s on a public website or simple payment data, it’s not FCI. Think SOWs, deliverable drafts, CO emails, project plans. FCI invokes FAR 52.204‑21 and its 15 basic safeguards.
CUI (Controlled Unclassified Information)
Unclassified information that Federal law/regulation/policy requires or permits safeguarding or limited dissemination. It is created or possessed by the Government, or by you for/on behalf of the Government. CUI is standardized under the government‑wide CUI Program and cataloged in the CUI Registry; DoD also maintains a DoD‑specific registry. In DoD contracts, CUI generally triggers DFARS 252.204‑7012 and NIST SP 800‑171 implementation.

Practical rule of thumb: If it’s just contract‑related but not public, it’s probably FCI. If a law/regulation/policy says it needs protection (e.g., export control, Controlled Technical Information (CTI), Personally Identifiable Information (PII) tied to a DoD purpose), it’s CUI – check the registry category and your contract.

Self‑Attestation vs. Validation: Why CMMC 2.0 Exists

March 3, 2026February 24, 2026 by Daniel Ihonvbere

Self‑Attestation vs. Validation: Why CMMC 2.0 Exists — And What It Means for Today’s Defense Contractors

For years, the Defense Industrial Base (DIB) ran on trust. Contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) would self‑attest that they followed required cybersecurity practices. But as nation‑states and criminal groups shifted tactics, that honor‑system model showed cracks—particularly among smaller, sub‑tier suppliers where much of the sensitive technical work happens. The Department of Defense (DoD) created the Cybersecurity Maturity Model Certification (CMMC) 2.0 to close the gap between “what we think we’re doing” and “what’s actually implemented.” CMMC formalizes validation—in some cases via third‑party assessors—so the DoD can verify protections before and during contract performance.

The program sits on two pillars:

Policy (32 CFR Part 170): establishes CMMC as the program of record (effective Dec. 16, 2024).
Contracting (DFARS amendments): phases CMMC requirements into solicitations and awards starting Nov. 10, 2025, with a multi‑year rollout.

Meanwhile, NIST SP 800‑171 Rev. 3 (May 2024) updated the underlying security requirements for protecting CUI, emphasizing clearer, more specific controls and the use of assessment procedures in 800‑171A.

In this article, I’m your plain‑language guide and advocate. My goal is to:

Demystify self‑attestation vs. validation, without jargon.
Encourage small and mid‑sized businesses: compliance is achievable—step by step.
Clarify how CMMC 2.0 actually works, who needs what, and when.
Guide you to a practical next step (a complimentary 15‑minute discovery call).

Defense Supply Chain and CMMC: Practical Steps for Vendor Security

January 12, 2026 by Daniel Ihonvbere

CMMC 2.0 and Defense Supply Chain Attacks: Practical Steps to Build Resilience Across Your Vendor Ecosystem

Supply chain attacks keep rising because attackers go where trust and access already exist—third-party vendors, managed service providers, and software suppliers. If you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), your security posture is only as strong as your partners’. CMMC 2.0 responds to this reality by placing verifiable expectations on every tier that touches sensitive DoD data. In this post, we’ll break down the threat, connect it to CMMC’s objectives, and share a practical roadmap you can start using today—grounded in inclusive, plain language and real-world scenarios.

Why the Defense Supply Chain Is a Prime Target

The attack surface is huge. Organizations share data with hundreds of vendors, yet few have mature processes to evaluate and improve vendor cybersecurity posture. In 2023, 15% of breaches involved a defense supply chain compromise, and 98% of companies had at least one vendor that experienced a breach. This is a perfect storm of exposure and limited oversight.
High-profile cases illustrate the risk. The SolarWinds Orion compromise showed how malicious code in a trusted update can ripple across government and commercial networks. Likewise, the 2023 third-party breach linked to Infosys McCamish Systems affected more than 57,000 Bank of America-related entities, underscoring how downstream vendors can become a gateway for attackers.

Inclusive takeaway: regardless of your organization’s size, role, or location within the Defense Industrial Base (DIB), defense supply chain risk touches everyone who processes, stores, or transmits FCI/CUI.

CMMC Audit Guide: How to Detect Hidden or Forgotten Systems

March 3, 2026January 6, 2026 by Daniel Ihonvbere

Detecting Concealed, Forgotten, or “Conveniently Omitted” Systems During a CMMC Audit

Hidden assets—forgotten servers, unregistered devices, and unmonitored cloud instances—can derail a CMMC assessment. This practical guide helps you spot them early, align your scope with DoD rules, and prepare for a CMMC audit like a pro.

Why hidden systems matter for a CMMC Audit

In CMMC Level 2, your environment must meet the NIST SP 800‑171 requirements for systems that process, store, or transmit CUI—and certain systems that provide security services to those systems. If your scope misses assets, your controls won’t cover the real environment, which leads to findings. The DoD’s Final CMMC Rule formalizes verification, introduces annual affirmations of ongoing compliance, and ties certification status to contract award and performance—so accuracy isn’t optional. [cmmcaudit.org]