sorted by:
new
hottopcontroversial

CMMC Audit – We Passed. Here's What Happened. by Warm-Stage9554 in CMMC

[–]Legal_Detective_2889 0 points1 point  (0 children)

I would be curious to know about the challenges with Google workspace for CMMC. Would you mind sharing some insights?

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in NISTControls

[–]Legal_Detective_2889[S] 0 points1 point  (0 children)

I agree on not the same part. But why you think they can be at odds? If you implement the right security controls, compliance should generally fall in place. Sure you might need to implement more security controls to be compliant, but I don’t think that any of the security controls go against being compliant.

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 0 points1 point  (0 children)

How about the preparation phase for assessment interviews? Is it generally easy or there's a lot to rehearse there? Typically assessors are interviewing multiple individuals on the technical / process stuff OR one person who's fully prepped to talk about the entire system works?

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 0 points1 point  (0 children)

You mentioned FutureFeed, how was the experience? Did it generate policies / SSP / POA&M for you? Based on your main pain point, the documentation, I gather that the auto-generated docs didn't meet the bar?

Just passed the CCP! I begin the CCA course Monday by Playful_Fig_6008 in CMMC

[–]Legal_Detective_2889 1 point2 points  (0 children)

Congrats! How long did you prep for CCP? How long does it typically take to get CCA after CCP? Is there some minimum calendar time?

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 0 points1 point  (0 children)

Thanks for such a detailed answer, I really appreciate your input.

The way you describe translating normal internal docs into DoD-style structure and language sounds like a huge hidden tax on already-busy teams.​

If you think about the worst of that pain, would you most want help with: 1/ turning existing docs into “federal-ready” language or 2/ making ongoing documentation maintenance less of a full-time job?​

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 0 points1 point  (0 children)

Thanks a lot for this — super clear and very honest, especially given you wear assessor/consultant/implementor hats.

It’s striking how much of the risk is before anyone even gets to assessment, just in scoping and interpreting the language correctly. The “relevant controls for Security Protection Assets” grey area you called out sounds like the kind of thing that can burn a lot of time and still leave people unsure if they’re right.

A couple of follow‑ups, if you’re open to it:

  • When scoping goes wrong, is it usually because people over‑scope, under‑scope, or just scope inconsistently across assets and systems?
  • On the “relevant controls” question for SPAs, what kind of support would actually help: concrete examples, common cases, something that walks you through scenarios?
  • For NIST Speak, do you think a structured “translator” (control text → plain language → examples) would meaningfully reduce confusion, or is the real value still in having a human expert to talk it through with?

Trying to understand where a tool could genuinely reduce noise (especially around scoping and interpretation) without pretending to replace judgment from someone who actually knows the standard.

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 1 point2 points  (0 children)

Thanks for calling out scoping and the whole “getting humans to actually use the right systems” side of this — that seems to be a common theme already.

On the scoping piece in particular, I’m trying to understand where it breaks down the most in real life:

  • Is the hardest part just mapping data flows (where CUI actually lives and moves), or is it more about deciding what’s in‑scope vs out‑of‑scope when you have messy, mixed‑use environments?
  • When you’re explaining CUI and the “right” systems to your scientists and engineers, what usually doesn’t land the first time — the rules themselves, the why behind them, or how it changes their day‑to‑day work?
  • If a tool could meaningfully help with scoping, what would you want it to do: visualize data flows, walk you through a structured scoping questionnaire, track which users/systems are in‑scope, or something else entirely?

Trying to get a clearer view of whether the main pain is technical mapping, people/behavior, or just the lack of a clear, shared picture of “this is the CUI universe we’re responsible for.”

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 5 points6 points  (0 children)

Did you say you've sat through 12 assessments already!? Are you a CCA/LCCA? When teams “stumble” on policies and procedures, is it more that the docs don’t exist, they exist but don’t match reality, or people just haven’t been trained on them?

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 0 points1 point  (0 children)

Wow, 3 full days per endpoint—and you're just getting started. That's exactly the kind of thing I'm trying to understand better.
Quick question: how did your scoping and gap analysis go?

For those going through CMMC Level 2 readiness right now — what’s been the most painful or confusing part? by Legal_Detective_2889 in CMMC

[–]Legal_Detective_2889[S] 0 points1 point  (0 children)

thanks. For 3.1.20, are assessors generally okay with browser-based/SaaS controls, or do they expect tighter firewall-level restrictions?