Writing on offensive security, CMMC and NIST 800-171 obligations, and building a security program, from the practitioner doing the work.https://www.aptsecuritymanagement.com/en-ushttps://www.aptsecuritymanagement.com/blog/fci-vs-cui/https://www.aptsecuritymanagement.com/blog/fci-vs-cui/FCI or CUI decides your CMMC level. The difference in plain English, how to read your contract clauses, and what each one still requires in 2026.Wed, 12 Nov 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/ptaas-soc-2-pci-dss-auditor-requirements/https://www.aptsecuritymanagement.com/blog/ptaas-soc-2-pci-dss-auditor-requirements/Auditors care about scope, methodology, dates, independence and remediation evidence. What that means, and where subscription testing trips people up.Tue, 04 Nov 2025 00:00:00 GMTOffensiveCody D. Martinhttps://www.aptsecuritymanagement.com/blog/what-should-be-in-pen-test-report/https://www.aptsecuritymanagement.com/blog/what-should-be-in-pen-test-report/The report is the deliverable and everything else is process. Seven things a good one contains, and the tells that separate testing from scanner output.Tue, 21 Oct 2025 00:00:00 GMTOffensiveCody D. Martinhttps://www.aptsecuritymanagement.com/blog/what-is-penetration-testing-as-a-service/https://www.aptsecuritymanagement.com/blog/what-is-penetration-testing-as-a-service/PTaaS replaces the annual PDF with continuous findings, retesting and a platform. Useful for some buyers, oversold to others. How to tell which you are.Thu, 02 Oct 2025 00:00:00 GMTOffensiveCody D. Martinhttps://www.aptsecuritymanagement.com/blog/how-often-should-you-run-a-penetration-test/https://www.aptsecuritymanagement.com/blog/how-often-should-you-run-a-penetration-test/Annual testing is the common answer, usually driven by an audit cycle. Change is the better trigger. How to decide on evidence rather than habit.Thu, 18 Sep 2025 00:00:00 GMTOffensiveCody D. Martinhttps://www.aptsecuritymanagement.com/blog/cmmc-stop-at-level-1/https://www.aptsecuritymanagement.com/blog/cmmc-stop-at-level-1/Handling FCI without touching CUI keeps you at Level 1. How to know that is genuinely true, and how to keep it true as contracts change.Tue, 02 Sep 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/ssp-poam-cmmc/https://www.aptsecuritymanagement.com/blog/ssp-poam-cmmc/The SSP is the document everything else hangs off, and most are a template with a company name in it. What assessors actually read, and what fails.Thu, 14 Aug 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/cmmc-level-1-self-attestation/https://www.aptsecuritymanagement.com/blog/cmmc-level-1-self-attestation/Self attestation means a senior company official signs that 15 requirements are met. What that signature carries, what to keep, and the False Claims Act risk.Tue, 05 Aug 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/cmmc-level-1-practices/https://www.aptsecuritymanagement.com/blog/cmmc-level-1-practices/Level 1 covers 15 basic safeguarding requirements from FAR 52.204-21. What each one actually asks for, and the ones companies get wrong.Tue, 22 Jul 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/cmmc-level-1-or-level-2/https://www.aptsecuritymanagement.com/blog/cmmc-level-1-or-level-2/Your CMMC level is set by the data you handle and the clauses in your contract. How to read them, plus what changed for Level 2 after the 2026 suspension.Tue, 15 Jul 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/do-i-need-cmmc-checklist/https://www.aptsecuritymanagement.com/blog/do-i-need-cmmc-checklist/Five questions that tell you whether CMMC applies to your company, which level, and what to do if your prime has not told you what data you handle.Tue, 08 Jul 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/nist-800-171-cmmc-level-2-mapping/https://www.aptsecuritymanagement.com/blog/nist-800-171-cmmc-level-2-mapping/CMMC Level 2 is NIST SP 800-171 with an assessment process attached. How the 110 practices map, how SPRS scoring works, and where the two differ.Tue, 24 Jun 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/what-is-cmmc-2-0/https://www.aptsecuritymanagement.com/blog/what-is-cmmc-2-0/CMMC in plain language, updated for the July 2026 Phase 2 suspension. What the levels mean, what is paused, and what defense contractors still owe today.Tue, 10 Jun 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/rp-rpo-c3pao-explained/https://www.aptsecuritymanagement.com/blog/rp-rpo-c3pao-explained/Who does what in the CMMC ecosystem, why the roles are separated, and what the July 2026 suspension did to the assessment side of it.Tue, 27 May 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/what-to-expect-cmmc-gap-assessment/https://www.aptsecuritymanagement.com/blog/what-to-expect-cmmc-gap-assessment/What actually happens during a gap assessment, how long it takes, what you need to have ready, and what you should receive at the end of it.Tue, 13 May 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/after-cmmc-gap-assessment/https://www.aptsecuritymanagement.com/blog/after-cmmc-gap-assessment/A gap assessment tells you where you stand. Turning that into compliance is the harder part. A realistic roadmap for the twelve months that follow.Tue, 29 Apr 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/cmmc-prep-timeline/https://www.aptsecuritymanagement.com/blog/cmmc-prep-timeline/A realistic timeline for Level 1 and Level 2 preparation, what drives the variance, and how the July 2026 suspension changes the planning picture.Tue, 15 Apr 2025 00:00:00 GMTComplianceCody D. Martinhttps://www.aptsecuritymanagement.com/blog/choosing-cmmc-advisory-partner/https://www.aptsecuritymanagement.com/blog/choosing-cmmc-advisory-partner/Questions worth asking before you hire CMMC help, including the ones that separate a real advisor from a template vendor, and what the suspension revealed.Tue, 01 Apr 2025 00:00:00 GMTComplianceCody D. Martin