CMMC

What CMMC means

Cybersecurity Maturity Model Certification (CMMC) is a US defense-supplier cybersecurity program. It is designed to assess how contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on their unclassified information systems.

The relevant contract, the information involved, and the systems handling it determine the applicable requirements and assessment scope. Different assessment paths apply; not every supplier needs the same level or a third-party certification.

My CMMC credentials

I hold all five of the following practitioner and assessment credentials:

Practitioner designations support implementation consulting. CCP is the foundational professional credential; CCA and Lead CCA relate to formal assessment work and assessment leadership within the authorized assessment ecosystem. Readiness consulting and independent assessment are distinct responsibilities, with conflict-of-interest boundaries.

From a security program to an assessment

My CMMC work builds on years of creating governance, risk, and compliance programs and helping clients prepare for audits and assessments. I connect requirements with the architecture, policies, procedures, runbooks, and operational evidence that make a program usable.

Scoping is part of that work: understanding which information needs protection, where it moves, which services and systems handle it, and who is responsible. A good document package supports that understanding; it needs to reflect the organization’s actual implementation and operating practices.

My current CMMC LCCA work with Meerkat Cyber →

Why I created CMMC Brain

I created CMMC Brain to simplify the technical material clients need to navigate when learning compliance programs. It is a practitioner’s knowledge tool: a connected way to explore requirements, scoping, assessment objectives, implementation guidance, and relationships between frameworks.

The value is in following those connections. A reader can investigate how a requirement relates to an assessment objective, consider implementation guidance, and compare how different compliance regimes address related concerns. Those mappings support understanding; they are not a claim that different frameworks are interchangeable or that every requirement has an authoritative one-to-one match.

Sample templates and a practical starting point

CMMC Brain includes sample CMMC templates to help readers move from learning requirements to organizing their own working documents. They offer a starting point to adapt to an organization’s scope, responsibilities, and implementation.

Templates and guidance support preparation. They do not replace the official standards, evidence that controls are operating, or the applicable assessment and certification process.

Open the interactive CMMC Brain↗ (opens in a new tab)

CMMC Brain website↗ (opens in a new tab) · The landing website is currently under maintenance; the link above opens the interactive resource directly.