by Kevin Mann | Aug 19, 2025 | CMMC, Cybersecurity
If IA.L2-3.5.1 is about knowing who is trying to access your systems, then IA.L2-3.5.2 is about verifying they really are who they claim to be. As a Certified CMMC Assessor and Certified CMMC MSP, we often find that organizations rely on weak or inconsistent...
by Kevin Mann | Aug 12, 2025 | CMMC
The most fundamental question in cybersecurity is: “Who are you?” Before any system can enforce policy, log activity, or prevent unauthorized access, it must first identify the user. That’s what IA.L2-3.5.1 requires: reliable identification of users, processes, and...
by Kevin Mann | Aug 4, 2025 | CMMC, Cybersecurity
When we assess organizations for CMMC Level 2, CM.L2-3.4.2 is one of the clearest indicators of whether their security is proactive or accidental. Having configuration settings is one thing. Enforcing them is another. This post explores how to implement and validate...
by Kevin Mann | Jul 29, 2025 | CMMC, Cybersecurity
In the CMMC world, Configuration Management begins with knowing what you have and how it should look. CM.L2-3.4.1 is foundational—and if you can’t meet this, the rest of the domain is going to fall apart quickly. As both an Authorized C3PAO and a Level 2 Certified...
by Kevin Mann | Jul 21, 2025 | CMMC, Cybersecurity
1. Why This Practice Matters AC.L1‑3.1.2 may look deceptively simple (“limit information‑system access to the types of transactions and functions that authorized users are permitted to execute”), but it is the cornerstone of least‑privilege at Level 2 (Its a Level 1...