How defense contractors decide which software is safe to allow in a CUI environment, and how to document that decision for a C3PAO assessment.
How to build an approved software list CMMC assessors can follow: required fields, version policy, evidence per entry and how the list ties to your system security plan.
3 min readRead Controls & RequirementsWhat CM.L2-3.4.8 requires, how NIST SP 800-171A turns it into assessment objectives, and what evidence to keep for every application on your allowlist.
5 min readRead Controls & RequirementsWhat CM.L2-3.4.9 asks defense contractors to do about software that users install themselves, and how to control and monitor it without blocking legitimate work.
3 min readRead Approval ProcessA practical seven-step CMMC software approval process for defense contractors, from request intake and vendor screening to a documented decision and re-review.
3 min readRead Audit EvidenceApproval is not permanent. Learn which events should trigger a CMMC software re-review, from critical CVEs to ownership changes, and how to record the outcome.
3 min readRead Technical AnalysisWhat dynamic sandbox analysis reveals about an installer, how to turn the results into firewall and allowlist decisions, and where its limits are.
3 min readRead Vendor & Supply Chain RiskWhich lists and clauses to check when approving software for a DoD contractor environment, how to look at vendor ownership, and how to document the result.
4 min readRead Audit EvidenceYour SPRS score and annual affirmation describe your CUI environment, including its software. See what they assume about installed applications and how to back them up.
3 min readRead Vendor & Supply Chain RiskHow to run a third-party software risk assessment for CMMC Level 2: what Rev 2 does and does not say about supply chain, which factors to score and how to decide.
3 min readRead Technical AnalysisCompare hash, publisher and path rules in WDAC (App Control for Business) and AppLocker, and learn which rule type to use for each approved application.
4 min readRead