.webp?width=2169&height=526&name=Compass%20regular%20transparent%20website%20(1).webp "Compass IT Compliance Logo")
-1.webp?width=2169&height=620&name=Compass%20regular%20transparent%20website%20smaller%20(1)-1.webp "Compass IT Compliance")
CISA's K-12 Cybersecurity Guidance: A Roadmap for School Districts
by Kyle Daun on August 24, 2026 at 1:21 PM
On August 12, CISA released the K-12 Cybersecurity Foundations Resource Package, which is a Getting Started Guide, an Implementation Guide, a six-part video series, and quick-reference materials built around eight core objectives: credential protection, device and asset security, back …
Plan of Action and Milestones (POA&M): A CMMC Level 2 Essential
by Jake Dwares on June 27, 2026 at 11:00 AM
Every CMMC Level 2 compliance program involves two documents that work in tandem: the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M). The SSP describes how practices are implemented. The POA&M documents what is not yet implemented and what the organiz …
Your CMMC SSP Is Not Just a Checkbox: How to Build One That Works
by Derek Boczenowski on June 26, 2026 at 1:24 PM
The System Security Plan (SSP) is the cornerstone document of any CMMC Level 2 compliance program. Yet it is also one of the most underdeveloped artifacts assessors encounter. Organizations preparing for a C3PAO assessment frequently arrive with an SSP that describes their environment …
CMMC Scoping Guide: How to Define Your Level 2 Assessment Boundary
by Derek Boczenowski on June 5, 2026 at 11:30 AM
One of the most consequential (and most misunderstood) steps in preparing for CMMC compliance is defining the scope of your assessment boundary. Scope too broadly and you’re burdening your organization with unnecessary controls and cost. Scope too narrowly and you risk leaving Control …
CMMC & the False Claims Act: High Stakes for DoD Contractors
by Derek Boczenowski on November 17, 2025 at 1:14 PM
Cybersecurity compliance for Defense Industrial Base (DIB) organizations has never been purely technical, but the stakes have now escalated into a very real legal and financial risk. With the Department of Defense’s final CMMC rule taking effect on November 10, 2025, and the Departmen …
CMMC Final Rule Compliance: A Guide for Defense Contractors
by Justin Leach on November 12, 2025 at 3:17 PM
Since its publication nearly two months ago, the Cybersecurity Maturity Model Certification (CMMC) Final Rule has moved from anticipation to implementation. For defense contractors, compliance is no longer theoretical. The rule is now shaping how the Department of Defense (DoD) manage …