Train the person who owns compliance.

You don't need to be the expert on everything. You need to know the regulation well enough, and your own policies backwards and forwards.

Lessons

• →Why consultants alone fail at audit time
• →Owner vs. consultant: who does what
• →Reporting progress to leadership in business terms

Do this week

Level 1 covers FCI with 17 practices. Level 2 covers CUI with 110 controls from NIST 800-171 and a third-party C3PAO audit. Level 3 is for the most critical programs.

Lessons

• →FCI vs. CUI in plain English
• →The 14 control families
• →How SPRS scoring works (−203 to 110)
• →Phase 1 (Nov 2025) and Phase 2 (Nov 2026) timeline

Do this week

Incorrect scoping is the biggest gotcha in industry. Get the boundary right before writing a single policy.

Lessons

• →Tracing where CUI is created, stored and sent
• →Enclave vs. whole-company scope
• →When GCC High is worth it
• →Asset categories assessors look for

Do this week

80–90% of CMMC is documentation. The trap is having policies nobody actually follows.

Lessons

• →Anatomy of a System Security Plan (SSP)
• →Writing policies with the people who run the systems
• →Tying each control to a configuration and evidence
• →Reviewing consultant-written documents critically

Do this week

Not every gap has to be closed before you start, but every gap needs an owner, a plan and a date.

Lessons

• →Which controls can and can't be on a POA&M
• →The 180-day closeout window
• →Prioritizing by point weight and effort
• →Using built-in tools (MFA, logging, encryption) you already own

Do this week

Assessors examine, interview and test. Your staff need to describe what they do in their own words.

Lessons

• →Examine / Interview / Test, explained
• →Preparing staff for interviews
• →Building an evidence binder
• →What happens if you're not as ready as you thought

Do this week

Certification isn't the finish line. Staying compliant takes weekly and daily work, and a team that stops and thinks.

Lessons

• →Weekly, monthly and annual review cycles
• →Annual affirmation
• →Security awareness that sticks
• →Making compliance help the business, not hold it back

Do this week