Resources
Straight explanations of the three frameworks we work in every day — written for the program manager or engineer who needs to understand what's actually required, not a vendor brochure.
The RMF Lifecycle
All seven steps of NIST SP 800-37, and where authorization efforts actually stall.
02CMMC 2.0 Level 2
The 110 practices, SPRS scoring, and where the phase-in actually stands right now.
03Zero Trust Architecture
NIST SP 800-207 in plain terms, plus the DoD and CISA maturity models and deadlines.
The RMF Lifecycle, Step by Step
The Risk Management Framework is the process federal systems go through to earn and keep an Authorization to Operate. It's defined in NIST SP 800-37 Revision 2, and it's seven steps — the first of which people routinely forget exists.
1.Prepare
Establish roles, risk tolerance, and the organization-wide groundwork before touching a single control. Define the system boundary and identify which controls are inherited as common controls rather than implemented per-system. Added in Revision 2, and the step most often skipped — which is precisely why so many packages fall apart later over boundary disputes.
2.Categorize
Rate the system Low, Moderate, or High against confidentiality, integrity, and availability, per FIPS 199. This single decision drives the size of everything downstream — categorize High and you inherit a substantially larger control set.
3.Select
Pull the corresponding NIST SP 800-53 control baseline, then tailor it — applying overlays, justifying any control you're not implementing, and defining the continuous monitoring strategy up front rather than as an afterthought.
4.Implement
Actually deploy the controls, and — the part that consumes the real schedule — document how each one is implemented in the System Security Plan. "We have MFA" is not an implementation statement. An assessor needs to know which mechanism, covering which users, enforced by what policy.
5.Assess
An assessor evaluates whether controls are implemented correctly and producing the intended outcome, and issues a Security Assessment Report. Anything that fails becomes a POA&M — a tracked finding with an owner, a remediation plan, and a date.
6.Authorize
The Authorizing Official reviews the package and makes an explicit risk-acceptance decision — granting authorization, granting it with conditions, or denying it. This is a risk decision by an accountable human being, not a checklist that scores itself.
7.Monitor
Continuously assess control effectiveness, feed changes through change control, and keep the documentation current. An ATO is a point-in-time decision about a system that keeps changing — monitoring is what keeps the authorization honest between assessments.
Where It Actually Stalls
In our experience it is rarely the engineering. It's Step 4 documentation and Step 5 POA&M burn-down — controls that are genuinely implemented but described too thinly to survive assessment, and findings that sit open because nobody owns them. Both are solvable with disciplined package work.
CMMC 2.0 Level 2, and Where It Stands
The Cybersecurity Maturity Model Certification program is how the Department of Defense verifies that contractors are actually protecting federal contract information and controlled unclassified information — rather than simply asserting they are. It has three levels.
15 requirements
Basic safeguarding of Federal Contract Information, drawn from FAR 52.204-21. Annual self-assessment.
110 practices
Aligned one-to-one with NIST SP 800-171. This is the level most defense suppliers handling CUI land on.
110 + NIST SP 800-172
Adds enhanced requirements for the highest-priority programs, assessed by the government directly.
The SPRS Score
Level 2 readiness is expressed as a score out of 110, posted in the Supplier Performance Risk System. You start at 110 and subtract for each unimplemented requirement, weighted by severity — which means a score can go negative. Contracting officers can see it. Treat it as a number that gets read, not a private diagnostic.
- The acquisition rule is live. The 48 CFR DFARS rule took effect November 10, 2025, and CMMC clauses began appearing in contracts from that point.
- Phase 2 is suspended. On July 13, 2026, DoD suspended Phase 2 — the step that would have made third-party C3PAO certification mandatory for Level 2 — and stood up a CMMC Reform Task Force to review the program.
- Phase 1 obligations did not go away. Level 1 and Level 2 self-assessment requirements remain in force, as do the safeguarding obligations under DFARS 252.204-7012. Contractors are still expected to hold a current CMMC status and post their identifier in SPRS.
What this means practically: the suspension is a change to the assessment mechanism, not a pause on the underlying security requirements. Standing down your 800-171 work because "CMMC got delayed" is the wrong read — the System Security Plan, the POA&M, and the SPRS score are all still live obligations, and the remediation work has a long lead time regardless of when certification resumes.
Zero Trust Without The Marketing
Zero Trust is not a product, and no vendor can sell you one. NIST SP 800-207 defines it as an architectural approach built on a single premise: being inside the network grants you nothing. Every request to every resource is authenticated, authorized, and evaluated against current context — who the user is, what device they're on, and whether that device is still in a state you'd trust.
Architecturally it comes down to three components. A Policy Engine decides whether to grant access; a Policy Administrator executes that decision by establishing or tearing down the session; and a Policy Enforcement Point sits in front of the resource and actually gates the traffic. The first two together form the policy decision point. Everything else is implementation detail.
CISA Maturity Model (ZTMM 2.0)
Five pillars, each assessed across four maturity stages from Traditional through Optimal:
- • Identity
- • Devices
- • Networks
- • Applications & Workloads
- • Data
Plus three capabilities that cut across all five: visibility and analytics, automation and orchestration, and governance.
DoD Zero Trust Strategy
Seven pillars and a defined set of capability activities, with two milestones:
- Target Level — 91 of the 152 activities, due by the end of FY2027 (September 30, 2027).
- Advanced Level — the remaining 61 activities, due by FY2032.
Where To Start
Identity, every time. Strong authentication, least-privilege access, and the ability to make an authorization decision per request are the foundation the other four pillars depend on. Organizations that start with network segmentation before fixing identity generally end up rebuilding the segmentation later.
Primary Sources
- • NIST SP 800-37 Rev. 2 — Risk Management Framework for Information Systems and Organizations
- • NIST SP 800-53 — Security and Privacy Controls for Information Systems and Organizations
- • NIST SP 800-171 / 800-172 — Protecting Controlled Unclassified Information
- • NIST SP 800-207 — Zero Trust Architecture
- • FIPS 199 — Standards for Security Categorization
- • CISA Zero Trust Maturity Model v2.0
- • DoD Zero Trust Strategy and Execution Roadmap
These explainers are general information for planning purposes, not legal, contractual, or compliance advice. Regulatory programs — CMMC especially — change; verify current requirements against the authoritative source and your contracting officer before making decisions.
We Execute This Work
RMF package execution, 800-171 gap assessment and remediation, and Zero Trust architecture design — as a subcontractor, teaming partner, or staff augmentation on your existing task order.