CMMC compliance, NIST 800-171, SPRS scoring, and cybersecurity for Arizona defense contractors.
Insider threats aren’t just espionage When Arizona defense contractors hear “insider threat,” they picture a spy stealing classified documents. The reality is far more mundane and far more common: an employee emails CUI to their personal account to work from home. A departing employee downloads client files to a USB drive. A contractor with excessive…
The SSP is the document your C3PAO will scrutinize most The System Security Plan is the cornerstone of your CMMC compliance program. It documents how your organization implements each of the 110 NIST SP 800-171 security controls, describes your CUI environment boundary, and maps the responsibilities between your team, your MSP, and your cloud providers….
What your SPRS score actually means Every Arizona defense contractor bidding on DoD contracts must have a current SPRS (Supplier Performance Risk System) score posted. The score ranges from -203 to 110, where 110 means full compliance with all NIST SP 800-171 controls and -203 means you haven’t implemented anything. Your SPRS score is calculated…
You might be handling CUI without knowing it Small defense suppliers in Arizona’s East Valley often handle Controlled Unclassified Information (CUI) without realizing it. If your machine shop in Gilbert receives engineering drawings from Boeing Mesa, those drawings are likely CUI. If your electronics firm in Chandler gets test specifications from Northrop Grumman, those specs…
What Is a C3PAO and Why Does It Matter If you’re an Arizona defense contractor preparing for CMMC Level 2 certification, you’ll need a Certified Third-Party Assessor Organization (C3PAO) to conduct your official assessment. No self-assessment option exists for Level 2. A C3PAO is the only path to certification. A C3PAO is an organization authorized…
The Flow-Down Clause You Cannot Ignore You run a 25-person machine shop in Tucson. Or a small engineering consultancy in Mesa. Or a staffing firm in Chandler that places cleared workers. You have been doing work for a defense prime contractor for years—maybe decades—and business has been good. Then a new contract comes through, and…
On July 13, 2026, the Department of Defense suspended CMMC Phase 2. The November 10 deadline for mandatory third-party C3PAO assessments is gone. Phases 3 and 4 are frozen. And DoD officials explicitly did not rule out cancelling the program entirely after a 60-day review. If you’re an Arizona defense contractor, you probably heard about…
Your SPRS score is your cybersecurity report card with the DoD. Learn how scoring works, why accuracy matters, and what the DOJ is doing about false scores. SPRS remains required even with CMMC Phase 2 suspended.
CMMC Level 1 covers 17 practices for FCI. Level 2 covers 110 NIST 800-171 controls for CUI. While Phase 2 certification has been suspended, the underlying security requirements remain in effect under DFARS.
