Sign in Subscribe

CMMC Resources

The full library of Mac-first CMMC guides, organized by decision: scoping and CUI, macOS controls, MDM, documentation and assessment, and field notes.
Share

Home/Resources

Mac-first CMMC guidance, organized by the decision in front of you. Prefer a sequence instead of a library? Take the Start Here path. Need a lookup, not a guide? References has the controls list, dates, and acronyms.

Browse by decision
Start with the big picture CMMC for macOS: What Defense Contractors Need to Know Where the program stands, what Level 2 requires, and how Macs fit.

Scoping & CUI

All in Scoping & CUI →
CUI vs. FCI: How to Tell Them Apart and Handle Each CorrectlyOne decides 15 requirements, the other 110 - the definitions, markings, and handling differences. GCC vs. GCC High vs. Commercial Microsoft 365: What CMMC Level 2 Actually RequiresWhy the middle tier exists, and why CUI-handling tenants end up at GCC High for full defensibility. Can BYOD Macs Be Used in a CMMC Environment?The honest options when personal Macs touch the boundary, and why most shops should decline. Vetting an MSP or ESP for CMMC: Questions to Ask Before You SignThe questions that separate a provider that helps your assessment from one that complicates it. Mac Asset Classification for CMMC: CUI Asset, SPA, CRMA, or Out of Scope?The five scoping categories as a working decision tree, with the Mac traps at each step. Can You Use AI in a CUI Environment?Yes, under conditions that are already written down - the clause, the CSP fork, and what Apple Intelligence changes.

macOS Controls & Baselines

All in Controls & Baselines →
FIPS-Validated Encryption for CUI: Why Enabled Is Not Enough"FileVault is on" is not a FIPS claim - module validation, current Apple certificates, and the SSP language. MFA for CMMC: How to Actually Satisfy IA.L2-3.5.3 on macOSWhat counts, what does not, and how to evidence it without hand-waving. mSCP vs CIS vs STIG vs CMMC: Which Mac Baseline Should You Use?Three credible hardening baselines, one decision - compared for CMMC purposes. Boundary Protection on a Mac FleetControl-vs-protect thinking applied to a Mac fleet's network boundary. CUI on the Mac: FIPS, VDI, and PDF Protection for Apple ShopsWhere CUI actually lands on a Mac, and which protections hold up when an assessor asks.

MDM & the Management Plane

All in MDM & Management →
Jamf vs. Intune vs. Kandji (Now Iru) for CMMC Mac FleetsCapability, hosting model, and boundary posture - the MDM decision with compliance in mind. Apple Business Manager and MDM for CMMCABM registration, supervised enrollment, and MDM - the trio nearly every Mac control inherits from.

Documentation & Assessment

All in Documentation & Assessment →
Writing a CMMC System Security Plan (SSP) That Survives AssessmentThe entry ticket: structure, level of detail, and the failure modes that halt assessments. What Goes in a CMMC SSP for a Mac Fleet, Section by SectionThe eight SSP sections, and what changes in six of them when the endpoints are Apple. CMMC SSP Outline Template: 8 Sections, 52 SubsectionsThe section-by-section skeleton: system boundary, data flows, and where each control narrative goes. What a Mac SSP Narrative Needs for CMMCScope, baseline source, enforcement mechanism, verification - the narrative anatomy. Mosyle and CMMC Level 2: What It Covers and What It Does NotA named mSCP contributor with no CMMC claim of its own. What that means for scope, FedRAMP and FIPS. CMMC Documentation Options and Real Costs: DIY vs. Bundles vs. ConsultantsDIY, templates, consultants, and platforms priced against each other, with verified numbers. CMMC Phase 2 Is Suspended. Your 800-171 Obligations Are Not.The operative details of the July 2026 suspension, and what a small Mac shop actually changes. How the CMMC Reform RFI Worked: The Seven Questions and How to RespondThe seven questions, the mechanics, and how to write a response that gets used. CMMC Self-Assessment Checklist40 checks across documentation, technical, organizational, and assessment-day readiness.

Field Notes

All in Field Notes →
Why Blocking AI Is the Wrong CMMC Strategy (And What to Do Instead)A blanket ban is not a control - the governance that satisfies the intent. What I Took Away From the 2026 NCMS SeminarField notes from the 2026 NCMS seminar. Official Source IndexThe official sources worth bookmarking, collected in one place.
Ready to lookup instead of read? CMMC References has all 110 requirements, the key dates, and the acronyms. Ready to write? The CMMC Operator Suite is the documentation system these guides feed into.