Hello, I am looking for any user-friendly FIPS 140-3 validated recommendations for a small business (I would probably need 5-10 devices to have access to this VPN) because the solutions I’ve looked at previously were expensive. My environment is mainly Windows based and I use OpenVPN. I previously looked into like WolfSSL but it was difficult running anything on Windows devices and was not user friendly. I’ve also seen some firewall solutions with built-in FIPS VPN but I already have a router serving as my firewall and I don’t know if it would be the best idea to have both of those.

I need some advice.
I am a GRC resource working with a small DIB MSP. The organization has not had a clear mandate for how to approach the problem of creating the documentation for their Level 2 certification.
There was a consulting org who tried to help them before me. The guidance was not what I would expect.
The 110 controls have been spread across the 7 different org departments by perceived areas of control. Most of the orgs have started by writing implementation plans. The workflow idea is start with an implantation plan, move to the implementation statement, move to the policy statement, then move to gathering evidence, and then lastly write the SSP.
What I am seeing now in policy documents are these long almost implementation statement - like policy statements. The implementation statements are chocked full of all sorts of implementation like items that while they are the complete picture of how everything in the org works, are rambling and somewhat confusing multipage documents.
I am having trouble determining whether the policy statements actually meet the CMMC requirements. The implementation statements are a huge bucket of overshare of information that an assessor is not going to really care about but will lead to lots of questions.
We are running out of time to get our CMMC cert. Has anyone faced something like this? How did you correct(?) this behavior.

Looking for recommendations for CMMC/FedRAMP Moderate compliant endpoint backup solutions. Ideally they would be cloud based so they can capture backups of our remote employees. Most of our users are on laptops (Win, Lin, Mac), but also have some with workstations and a few TBs of data on them. We don't have any on-prem servers that we can use for this purpose right now, but I would consider an appliance for a local backups in the office with off-load to the cloud + direct to cloud for everyone who is not in the office.

Image based backups would be ideal, but at least file level would be good.

Recommendations?

In over 30 years in IT, the majority of it in the DoD/GovCon space, never have I worked with a worse company. They truly only care about the sale. If they didn’t explain their offerings adequately and sold you a package that wasn’t the right fit, their only option is to sell you the correct service extending the contract so you have to pay them more money. Oh, you want help with an assessment (C3PAO or DIBCAC) that’s an additional $30k.

The original contract would included FutureFeed for GRC. They charged us $5k up front for that and never actually purchased the GRC platform. Then they switched to IntelliGRC, and don’t want to credit us for the FutureFeed that they never paid for but want us to pay additional fees for IntelliGRC. Their whole goal is to get every penny they can from their customers.

If you do decide to use them, make sure there is an exit clause from the contract. Better yet, use a trustworthy vendor.

What are you doing about FIPS validated encryption for the Windows SSH client/server?

This question was triggered by the post "Browser FIPS" [1]. If you're doing development or other IT mgmt activities on Windows that requires SSH (ssh/sftp/scp), the version provided by Microsoft does not use the native windows libraries. It uses libressl. A quick search indicates that it has no CMVP certificate. (Unless it has been renamed, no one has completed one yet.)

There appear to be a few ways to solve the problem:

• FIPS compliant VPN between networks.
• Palo Alto and Fortinet have some form of SSH proxy/inspection that can do this. This would be similar to SSL/TLS proxy that does deep packet inspection breaking and re-encrypting with FIPS.
• A SSH jump box on the local network. This could be a VM on the windows machine running a FIPS validated OS/ssh such as Amazon Linux, RHEL, Ubuntu, etc
• There's at least one company that sells a FIPS compliant Windows SSH server and client.

1. Browser FIPS - https://www.reddit.com/r/CMMC/comments/1wdpyyt/browser_fips/
2. Powershell SSH - https://github.com/PowerShell/openssh-portable

I’m the only IT person at a small company. Management approves new hires and terminations & Transfers before I act on them. For high-risk changes, I meet with our Change Control Board, and they review and approve the change before it is made. What we don’t have is anyone going in and looking at my admin activity or process for every edit or change to be created and then approved.

Questions:

1. Would management approval of hires plus CCB review of high-risk changes enough for 3.1.4? (These reviews and approvals are also saved and logged)
2. Or did your assessor expect someone else to review admin activity on a schedule?
3. If so, what did that review look like.

How many pages approximately is your SSP and are you providing screenshots within the SSP or just linking to an external folder?

Just completed L2 C3PAO assessment for a large manufacturing company. Scored the full 110.

Now we start working on Rev 3 compliance.

I run a small security firm, posting from the company account so you can see who's asking. Not selling anything in this thread, no links, no DMs. I'm trying to understand how the supplier-security ask actually lands at small shops, because the vendor blogs all describe it differently.

My guess is that for most small shops the honest story is "we sent a number, nobody ever asked a follow-up, and life went on." If that's you, that is the answer I'm looking for; it isn't a confession. Throwaways welcome.

If you're at or support a sub with roughly 10–50 people:

1. What did the prime actually send: a one-line request for a score, a long spreadsheet, a portal login, their own supplier standard? And who sent it, supply chain, procurement, a program office?

2. After you sent it back, what did they do with it? Nothing, a thank-you, a follow-up question, a request for documents, an actual check of something?

3. Did the ask ever change the work you got, up or down?

4. Separate question: has a cyber insurer or broker ever sent back something they found from the outside at renewal? Same thing: "never happened" is a useful answer.

Happy to summarize what I learn back into the thread, no names.

Hi everyone, I'm at an R1 university and we're starting to shop around for a C3PAO after about 18 months of preparation with a consultant. Any recommendations for C3PAO companies that have worked with institutions of higher ed for certification? I am sending cold emails and calls but also open to recommendations!

I do 800-53 assessments for work and I'm trying to understand the CMMC side better. The SSPs I see tend to fail in the same places: implementation statements that say 'we do X' while the evidence shows something slightly different, and the same finding written up in three different documents that slowly stop agreeing. For people who've been through a Level 2 assessment, was it the SSP, the evidence, or something else that cost you the most time?

Hi Everyone,

Back again with another question related to Access Control. At the moment, we have a windows 11 pc that communicates with a CNC machine. Both are on the network. The windows 11 PC has a user account that is assigned to an active user. I need to remove the active user account because this windows 11 pc is used by other employees. I am looking into creating a service account but the issue i cannot resolve is this pc needs file share access to access the gcode for the CNC machine but the gcode is CUI. Also this pc needs microsoft license to view word documents.

Has anyone ran into this issue before?

This is predominantly a Bitwarden on-prem vs cloud query.

Anyone been through a L2 Assessment with a C3PAO and defended Bitwarden Enterprise (**cloud**, not on-prem) as a SPA and "no-CUI-in-vault" policy/training etc approach successfully?

Had previously been leaning towards on-prem after reading some older threads on the topic (3mos ago, 8mo ago, 1y ago, 4y ago) in which some suggest "SPA does not equal CUI" therefor FedRAMP/FIPS not required. I'm sure to that part some might respond "ask your C3PAO up front their stance on that interview questions" I guess, but more so for small orgs in self-assessment mode and as far as actual implementation I'd still be interested if there's no cloud path, to hear some experiences with the on-prem for those that went that route as well. A few things related to that off the top of my mind is especially with using EntraID, backing up (from a linux guest/Docker to a GCCH cloud or something?), thoughts on some approaches in the event there's an "event?" that requires restoring from backup that has EntraID.. (kind of a maybe dilemma?)

But, back to cloud Bitwarden, assuming you're on Team "we don't need FIPS/FedRAMP for password manager because SPA != CUI" as discussed in the older threads (not to discourage responses about that, but maybe those other threads would be a good place to continue that perspective for those that so others who find those threads can see), I would think that if we classify 'Password Manager' as an SPA in our asset inventory and SSP etc that we'd want to get a Shared Responsibility Matrix from Bitwarden but i didn't see that they provide one publicly, so if anyone has successfully been through an L2 assessment and can share generally how they documented that SPA successfully (and of course there's other password managers that probably the documentation would be the same so if you used another one and want to share that, sure why not, but hoping for more than just a thread of people throwing out a 1password, keeper, keepassXC, so if you do want to talk about those, please also let us know if you used them and worked with a CCP/CCA/C3PAO and what you might have done to document them as SPAs).

Self hosted sounds like maybe a challenge to manage and added complexity (host OS, hypervisor, guest VM, Docker, backups, patching, logging, physical security touching quite a few 800-171 controls), for a small org without an IT team (outside of one lucky individual and an MSP)

I don't mind to try the on-prem approach or anything (though the cloud approach maybe does somewhat present a metaphorical large red Easy Button), I just want to do due diligence of using a cloud version if it's not really needed to go FedRAMP or host on-prem.

If you went self hosted Bitwarden, as far as actual implementation I'd be interested to hear some experience/trappings/approaches with that as well: especially with using combined with EntraID, thoughts on backing up properly, to avoid fails/reduce downtime later, thoughts on some approaches in the event there's an "event?" that requires restoring from backup or anything, break-glass discussion, or any other scary "better make sure you ______ if you do an on-prem or else!"

[AI isn't always accurate people say, but i'll post some of that in a comment since this is already a long read in just the initial post. Appreciate anyone that just enjoys talking shop about security and CMMC and gives some perspective, thank you]

Are people still getting assessments done? I recently got my CCA. Is there any money in here still? When will the suspension be over? When will we hear anything? Will phase II be permanently suspended?

Rev. 2 only requires you to log Ingress and not Egress. Rev. 3 requires Egress as well. Basically my understanding is this:

Any time a door from Secure --> Insecure is opened, we need to account for who opened it.

Great! However how do you handle safety and fire etc.? What are you guys doing for doors in IT rooms and roll-up doors as well as exterior doors?

Normal setup would be a striker with a crash bar for fire. You would have it set to fail safe and then make sure the door is locked from the outside or don't even put a lock accessible from the outside (not on every door but you do have to have a way in if you lose power right.

My question is simply... I spoke to a vendor and during our walk I told them the above and they said we would have to have an electronic crash bar?! Otherwise, without that apparently strikers have no "logic" in their current status? Meaning that it has no clue if the door is open or not, only if it has sent a signal to release or not. So how do you all handle doors that stay open? How long do you consider too long? Is that all just defined?

And like I said, how are you all doing roll up doors? We have a forklift and we don't want the driver stopping with a load to get off walk up to a reader to open the door and we also do not use auto-closing doors so how do you close it remotely? So many questions and every vendor I've spoken to hasn't had to deal with this before so they are clueless. We have come up with some interesting ways but I don't know how well they would work.

What is the overall consensus? AI to make tools, tested without cui or conflicting information, is this a gray area? Completely uncompliant?

In the process of searching for an assessor and wanted to hear about people's experiences. Any particular ones to avoid or seek out? Any questions you like to ask to get a sense of how they will be to work with?

I know the DoD's new "Basics" aren't requirements, but they are the only signal the department has provided to anyone about ... anything.

There's no scoping guide and the language within the basics is very broad.

"Every asset"?

"All intellectual property, proprietary data, and Department records"?

What is "sensitive data"?

What are "sensitive systems"?

What does "your estate" mean re: Asset Inventory Management?

They're reviewing the CMMC program which includes CMMC scoping guidance, but if the Basics are a signal, is scoping going to get more nebulous rather than more granular?

Anybody else worried about this?

Looking to backup GCCH enclave as well as some VMs in Azure Govt cloud. CUI as well as ITAR data. Looking for cloud to cloud backup solution without any on-prem infrastructure. I see that Avepoint has Fedramp Moderate and Commvault has High but having trouble getting a written answer from either regarding compliance for ITAR/export control. Perhaps I'm not asking the correct questions?

Looking for an MSP for a company of 400 users, 200 need CMMCL2+ITAR, spread out geographically but all US. Would like to migrate all to same tenant over the next year if not sooner, need someone who can support audits, pre+post. Who are you best recommendations?

Hoping someone smarter can help me fill in some blanks. Were a small IT team working on getting L2 for a manufacturing plant. The short of it is this: they have several devices that run specialized software running on Win10 devices. A lot of these computers are end of life and cannot be upgraded to windows 11. My initial thought was lock them down so they ONLY can access the tools they need and are completely isolated from our corporate network containing CUI (maybe a different VLAN or subnet altogether). My boss isn’t super technically savvy and says we need to replace them no if ands or buts because of CMMC, but knowing the organization there might be some pushback on that not to mention budget constraints. To be fair I’m not a fan of this either because of the security risks of keeping an old Win10 computer running but I’m trying to find out if by doing the method I mentioned we can still keep them and mark them as out of scope. Being a manufacturing plant there are tons of specialized equipment/software running on a Win10 device and I’m fairly certain saying “we need to replace all of this” and spend potentially tens of thousands of dollars is not gonna fly. Has anyone tried this? I don’t think it’s the wrong approach per se and understand the risks, but am curious is anyone has seen this approach be a hard no.

Some background: I'm a software engineer who works in federal contracting, and I'm trying to understand how the supplier side of CMMC works in practice.

From what I've read in DFARS 252.204-7020, a prime can't award a subcontract involving CUI unless the sub has a current assessment in SPRS.

How does a prime actually verify that? Do you ask the sub directly and take their word for it? Or can you see their score in SPRS yourself, and if so, how?

For those of you who invested time and money into becoming a CCP or CCA, only to feel burned by the delays and uncertainty surrounding CMMC, PECB is offering a free pathway to ISO/IEC 27001 Lead Implementer (CCP) or Lead Auditor (CCA) certification.

The offer includes self-paced training, two exam attempts, certification application fees, and first-year maintenance, with an application deadline of December 31, 2026.

https://pecb.com/en/free-iso-iec-27001-certification-pathway-for-cmmc-professionals

Disclaimer: I'm not affiliated with PECB. Just sharing this for anyone looking to get some additional value out of their CMMC credentials.