Compliance/November 12, 2025
FCI vs CUI: Which Type of Data Are You Handling?
FCI or CUI decides your CMMC level. The difference in plain English, how to read your contract clauses, and what each one still requires in 2026.
Blog
Notes from the work.
Written by the person doing the testing and the advisory, not a content team. Dated, and corrected when the ground moves.
Offensive/November 4, 2025
PTaaS for SOC 2 and PCI DSS: What Auditors Want
Auditors care about scope, methodology, dates, independence and remediation evidence. What that means, and where subscription testing trips people up.
Offensive/October 21, 2025
Seven Things Every Pen Test Report Needs
The report is the deliverable and everything else is process. Seven things a good one contains, and the tells that separate testing from scanner output.
Offensive/October 2, 2025
What Is Penetration Testing as a Service?
PTaaS replaces the annual PDF with continuous findings, retesting and a platform. Useful for some buyers, oversold to others. How to tell which you are.
Offensive/September 18, 2025
How Often Should You Run a Penetration Test?
Annual testing is the common answer, usually driven by an audit cycle. Change is the better trigger. How to decide on evidence rather than habit.
Compliance/September 2, 2025
When You Can Stop at CMMC Level 1
Handling FCI without touching CUI keeps you at Level 1. How to know that is genuinely true, and how to keep it true as contracts change.
Compliance/August 14, 2025
Your SSP and POA&M: What Assessors Want
The SSP is the document everything else hangs off, and most are a template with a company name in it. What assessors actually read, and what fails.
Compliance/August 5, 2025
How CMMC Level 1 Self-Attestation Works
Self attestation means a senior company official signs that 15 requirements are met. What that signature carries, what to keep, and the False Claims Act risk.
Compliance/July 22, 2025
The 15 CMMC Level 1 Requirements in Plain English
Level 1 covers 15 basic safeguarding requirements from FAR 52.204-21. What each one actually asks for, and the ones companies get wrong.
Compliance/July 15, 2025
Level 1 or Level 2? How to Tell Which You Need
Your CMMC level is set by the data you handle and the clauses in your contract. How to read them, plus what changed for Level 2 after the 2026 suspension.
Something here apply to you?
Tell us which part. That is usually a faster conversation than starting from scratch.