by Shawn Duffy | Jul 21, 2026 | Assessments, Blog, CMMC, Compliance
When it comes to CMMC compliance readiness, it’s tempting to shop for the lowest bid. Compliance can feel like a checkbox exercise; find someone who can get you certified, pay the smallest invoice, and move on. But organizations that choose the cheapest provider...
by Steve Medellin | Mar 13, 2024 | Assessments, Blog, Compliance
Over the years I have had many people ask me what they should do to prepare for an external compliance assessment. Or even worse, I’ve had people come to me in a panic because they have an external compliance assessment in a few weeks. My response is: If you are doing...
by Shawn Duffy | May 19, 2023 | Assessments, Blog, Featured, Risk, Risk assessment
Risk is not just a vulnerability. Risk is a combination of the likelihood of a vulnerability being exploited and the impact to the system if that vulnerability is exploited. So, what does that mean? When we think about a threat to the system, we look at the events...
by Shawn Duffy | Sep 9, 2022 | CMMC 2.0, Assessments, Blog, CMMC, Compliance, Featured, Incidence Response, Risk assessment, Security Awareness Training
If you’re a defense industrial base (DIB) contractor, you’re already aware you need to meet compliance requirements in the new CMMC system, which goes live May 2023. Most government contractors are required to meet CMMC Level 2 requirements. When in...
by Shawn Duffy | Nov 9, 2021 | CMMC, Assessments, Blog, CMMC 2.0, Department of Defense, DFARS, DOD, News, POA&M, SPRS, Vulnerability
As you may have seen last week, the new CMMC 2.0 has been released, which reverts us back to the NIST 800-171 set of security controls and families. It also allows for both a Plan of Actions & Milestones (POA&M) and self-assessments. This is great news for...
by Shawn Duffy | Mar 25, 2021 | Assessments, Blog, Vulnerability
Besides regulatory compliance, two cybersecurity services Duffy Compliance has been known for are penetration testing and vulnerability assessments. At first glance, pen testing and vulnerability assessments may appear to mean the same thing. Often this question comes...
