Be sure to meet with your Contracts Officer/Prime/Agencies to understand all of your FAR and DFARS related requirements. You may have requirements that exceed CMMC (e.g., ITAR, RMF).

Hold off on documenting the controls until you get through remediation.

If you choose to use a cloud service to store CUI, be sure to validate that the service provider (not the cloud location) has a FedRAMP moderate ATO or equivalent. Without one, you will fail your CMMC assessment.

When you are documenting policies and processes, be sure to document the types of evidence they will produce, who will be responsible for it, and where it will be stored.

The SSP needs to include the full CUI lifecycle, and the data should include the Prime (or Agency) and CUI relevant vendors.

The SSP outlines how an organization implements its security requirements. That includes defining the roles and responsibilities of security personnel and detailing the different security standards and guidelines that the organization follows. An SSP should provide high-level diagrams that show how connected systems talk to each other. The SSP should also explain your organization’s “design philosophies” (e.g., defense-in-depth and/or Zero Trust strategies, as well as allowed interfaces and network protocols). All information in the SSP should be high-level. Include enough information in the plan to guide the design implementation of the organization’s systems, and be sure to reference existing policies and procedures.

You need two different forms of evidence (not instances of the same form) for each CMMC practice.

Aspire to a very formal approach to operating your cybersecurity program. You can do this in many ways, including a GRC platform, a help desk ticketing system, or a project management tool. The important thing is that you do it! Long-term success requires a “single source of truth” that spans from the CXO Suite to the IT team to external assessors.