Articles
-
CMMC & NIST
What Is a GSA Nonfederal CUI Assessment? What Contractors Need to Know Before It's Too Late
A GSA nonfederal Controlled Unclassified Information (CUI) assessment is an independent review of a contractor's system against the security and privacy requirements the GSA published.
By Mark LarsonSeptember 2, 2026 -
CMMC & NIST
A Practical CMMC Compliance Guide for the Defense Industrial Base
Navigating CMMC compliance? Learn what's required at each level, what assessors actually check, and how to avoid the gaps that derail certifications.
By Mark LarsonMarch 11, 2026 -
CMMC & NIST
NIST SP 800-61 Revision 3: Complete Guide to the New Incident Response Framework
NIST SP 800-61 Revision 3 replaces the 4-phase lifecycle with CSF 2.0 functions. Learn how to update your incident response plan for CMMC compliance.
By Mark LarsonAugust 13, 2025 -
CMMC & NIST
Stop Procrastinating: Your Guide to the CMMC Final Rule
Learn about the CMMC Final Rule effective December 2024, including key changes to CMMC 2.0, compliance requirements, and timeline for defense contractors.
By Mark LarsonJanuary 15, 2025 -
CMMC & NIST
What Is the CMMC Assessment Process?
What is the CMMC assessment process? This is an auditor's breakdown of what it will look like and what to expect when preparing for a CMMC certification.
By Mark LarsonMay 8, 2024 -
Compliance
A Guide to Microsoft’s Supplier Security Privacy Assurance (SSPA) Program
This guide breaks down Microsoft's Supplier Security Privacy Assurance (SSPA) program - what it is, and the requirements for compliance and audit assurance.
By Mark LarsonNovember 29, 2023 -
Compliance
New Cybersecurity Trends to Watch for in 2023 & Beyond
There's been a major influx of cyber attacks during the past year. Here are some of the top cybersecurity trends to look for in 2023 to keep your company safe.
By Mark LarsonJune 21, 2023 -
Compliance
What are the SEC’s Proposed Rules on Cybersecurity Risk Management?
In March 2022, the SEC proposed new rules to enhance & standardize cybersecurity risk management. Here's a closer look at how it will affect your organization.
By Mark LarsonSeptember 21, 2022 -
SOC 2
Cyber Threat Intelligence - What It Is & How It Relates to SOC 2 Audits
What is cyber threat intelligence? We break down the goals of CTI, how the process works, benefits, cost, and how it relates to your upcoming SOC 2 audit.
By Mark LarsonMay 4, 2022 -
Penetration Testing
Vulnerability Assessment vs Penetration Testing for SOC 2 Audits
What is the difference between a vulnerability assessment vs penetration testing? Should you consider performing both & how does it relate to a SOC 2 audit?
By Mark LarsonJune 23, 2021 -
Compliance
The MITRE ATT&CK Framework: How Does MITRE ATT&CK Work?
What is the MITRE ATT&CK Framework? How does it work? Here we discuss the extensive framework used to help identify hacker tactics, behavior, & more.
By Mark LarsonMarch 24, 2021 -
Compliance
What is Endpoint Security? Why is it Important?
What is endpoint security? How does it work? Here are some endpoint protection best practices and industry recommendations for securing your data.
By Mark LarsonSeptember 30, 2020
Get in touch
Have a question an article didn't answer? Talk to a partner.
Get straightforward answers from experienced auditors.