https://news.capital-cyber.com/ CMMC, NIST 800-171 and current threats, explained plainly. Mon, 17 Aug 2026 19:12:47 GMT https://news.capital-cyber.com/what-cmmc-is-and-what-changed-july-2026/https://news.capital-cyber.com/what-cmmc-is-and-what-changed-july-2026/Mon, 17 Aug 2026 19:12:47 GMTUnderstand CMMC, the July 2026 suspension of third party certification, and what defense contractors must still do for compliance. https://news.capital-cyber.com/cmmc-level-1-vs-level-2/https://news.capital-cyber.com/cmmc-level-1-vs-level-2/Mon, 17 Aug 2026 19:12:47 GMTConfused about CMMC Level 2? Learn how to determine if Level 1 or Level 2 applies, based on whether you handle FCI or CUI, and what to do next. https://news.capital-cyber.com/fci-vs-cui-difference/https://news.capital-cyber.com/fci-vs-cui-difference/Mon, 17 Aug 2026 19:12:47 GMTUnderstand the difference between FCI and CUI, why CUI drives your compliance scope, and how correct marking under 32 CFR Part 2002 can save costs and risk. https://news.capital-cyber.com/the-110-controls-by-family/https://news.capital-cyber.com/the-110-controls-by-family/Mon, 17 Aug 2026 19:12:47 GMTUnderstand all 14 families of NIST 800-171 controls, including practice counts and what each family requires for Level 2 compliance. https://news.capital-cyber.com/cmmc-scoping-five-asset-categories/https://news.capital-cyber.com/cmmc-scoping-five-asset-categories/Mon, 17 Aug 2026 19:12:47 GMTUnderstand CMMC scoping with a focus on the five asset categories in 32 CFR 170.19(c)(1) Table 3 to avoid common mistakes and improve compliance. https://news.capital-cyber.com/four-scoping-artifacts-assessors-ask-for/https://news.capital-cyber.com/four-scoping-artifacts-assessors-ask-for/Mon, 17 Aug 2026 19:12:47 GMTUnderstand the four essential documents needed for a CMMC assessment: CUI Flow Diagram, Network Boundary Diagram, Physical Site Diagram, and Authorized User List. https://news.capital-cyber.com/sprs-score-explained/https://news.capital-cyber.com/sprs-score-explained/Mon, 17 Aug 2026 19:12:47 GMTUnderstand how your SPRS score is calculated, what a negative score means, and why the DIB average SPRS score lags behind the required 110. https://news.capital-cyber.com/system-security-plan-ssp/https://news.capital-cyber.com/system-security-plan-ssp/Mon, 17 Aug 2026 19:12:47 GMTLearn what a System Security Plan is, why CA.L2-3.12.4 mandates it for defense contractors, and the real consequences of failing to maintain one. https://news.capital-cyber.com/poam-explained/https://news.capital-cyber.com/poam-explained/Mon, 17 Aug 2026 19:12:47 GMTLearn what a POA&M is, how it works at Level 2 for CMMC and NIST SP 800-171, and why POA&Ms are not permitted at Level 3. Understand the 180 day rule. https://news.capital-cyber.com/self-assessment-after-the-suspension/https://news.capital-cyber.com/self-assessment-after-the-suspension/Mon, 17 Aug 2026 19:12:47 GMTThe CMMC self-assessment process remains mandatory for defense contractors. Learn what requirements still apply after the suspension of third-party certification. https://news.capital-cyber.com/kev-catalog-what-is-in-it-now/https://news.capital-cyber.com/kev-catalog-what-is-in-it-now/Mon, 17 Aug 2026 19:12:47 GMTThe CISA KEV catalog lists 1665 exploited vulnerabilities, including threats with confirmed ransomware use. Learn how to use it to prioritize patching. https://news.capital-cyber.com/ransomware-exploited-vulnerabilities-2026/https://news.capital-cyber.com/ransomware-exploited-vulnerabilities-2026/Mon, 17 Aug 2026 19:12:47 GMTLearn which ransomware vulnerabilities are actively used in attacks, with real CVEs, vendors, and dates based on the CISA Known Exploited Vulnerabilities Catalog. https://news.capital-cyber.com/n-able-n-central-msp-supply-chain/https://news.capital-cyber.com/n-able-n-central-msp-supply-chain/Mon, 17 Aug 2026 19:12:47 GMTLearn how the recent CVE-2026-18556 in N-able N-central highlights the risks of MSP supply chain attack and what you should ask your IT provider. https://news.capital-cyber.com/sonicwall-sma1000-ransomware/https://news.capital-cyber.com/sonicwall-sma1000-ransomware/Mon, 17 Aug 2026 19:12:47 GMTThe SonicWall vulnerability, flagged for ransomware use, highlights why remote access appliances demand urgent attention from small businesses. https://news.capital-cyber.com/sharepoint-server-exploitation/https://news.capital-cyber.com/sharepoint-server-exploitation/Mon, 17 Aug 2026 19:12:47 GMTLearn about the SharePoint vulnerability CVE-2026-45659, its ransomware use, and why on-premises collaboration servers pose scoping and security risks. https://news.capital-cyber.com/firewall-appliance-vulnerabilities/https://news.capital-cyber.com/firewall-appliance-vulnerabilities/Mon, 17 Aug 2026 19:12:47 GMTFirewall vulnerability is a real risk for any business. Learn what recent exploited firewall vulnerabilities mean for your patching and compliance. https://news.capital-cyber.com/small-business-ransomware-reality/https://news.capital-cyber.com/small-business-ransomware-reality/Mon, 17 Aug 2026 19:12:47 GMTSmall business ransomware threats target familiar products like cPanel and WordPress. Learn what matters most for your company’s risk and compliance. https://news.capital-cyber.com/legacy-software-still-exploited/https://news.capital-cyber.com/legacy-software-still-exploited/Mon, 17 Aug 2026 19:12:47 GMTAttackers keep using the same legacy vulnerability year after year. Learn why asset inventory is your best defense against old, still-exploited bugs. https://news.capital-cyber.com/patch-prioritization-for-small-teams/https://news.capital-cyber.com/patch-prioritization-for-small-teams/Mon, 17 Aug 2026 19:12:47 GMTPatch management is critical for compliance and risk reduction. Learn how small teams can prioritize using the KEV Catalog and meet SI.L2-3.14.1 requirements. https://news.capital-cyber.com/credential-theft-and-mfa-gaps/https://news.capital-cyber.com/credential-theft-and-mfa-gaps/Mon, 17 Aug 2026 19:12:47 GMTCredential theft remains the most cost-effective attack method. Learn what IA.L2-3.5.3 requires and how to protect your business from stolen credentials. https://news.capital-cyber.com/mfa-what-satisfies-ia-3-5-3/https://news.capital-cyber.com/mfa-what-satisfies-ia-3-5-3/Mon, 17 Aug 2026 19:12:47 GMTUnderstand what counts as multifactor authentication CMMC compliance, why SMS is weak, and how to meet requirements for privileged and non-privileged accounts. https://news.capital-cyber.com/backups-the-undocumented-control/https://news.capital-cyber.com/backups-the-undocumented-control/Mon, 17 Aug 2026 19:12:47 GMTBackup compliance is more than having backups. Level 2 companies must prove CUI backup protection and restore capability for NIST SP 800-171 and CMMC. https://news.capital-cyber.com/incident-response-72-hour-clock/https://news.capital-cyber.com/incident-response-72-hour-clock/Mon, 17 Aug 2026 19:12:47 GMTUnderstand DFARS 72 hour reporting, DIBNet incident submissions, and what the DFARS 252.204-7012 requirements mean for your company’s incident response. https://news.capital-cyber.com/vulnerability-scanning-start-early/https://news.capital-cyber.com/vulnerability-scanning-start-early/Mon, 17 Aug 2026 19:12:47 GMTLearn why starting vulnerability scanning early is essential for compliance and how scan history impacts NIST SP 800-171 and CMMC Level 2 self-assessments. https://news.capital-cyber.com/least-privilege-in-a-small-company/https://news.capital-cyber.com/least-privilege-in-a-small-company/Mon, 17 Aug 2026 19:12:47 GMTLeast privilege is required even when roles overlap. Learn how AC.L2-3.1.5 applies when one person handles IT, finance, and shipping in your business. https://news.capital-cyber.com/media-protection-and-disposal/https://news.capital-cyber.com/media-protection-and-disposal/Mon, 17 Aug 2026 19:12:47 GMTMedia sanitization is a critical requirement under NIST SP 800-171. Learn how improper media protection can undo your compliance efforts and what to do next. https://news.capital-cyber.com/what-cmmc-actually-costs/https://news.capital-cyber.com/what-cmmc-actually-costs/Mon, 17 Aug 2026 19:12:47 GMTUnderstand real CMMC cost benchmarks for Level 2, including assessment, remediation, and consulting. Learn how scoping and enclaves affect your budget. https://news.capital-cyber.com/cga-cmmc-gap-assessment-grant/https://news.capital-cyber.com/cga-cmmc-gap-assessment-grant/Mon, 17 Aug 2026 19:12:47 GMTLearn what the CMMC gap assessment grant from Cyber Grants Alliance covers, who qualifies, and how it supports defense contractors with NIST 800-171 compliance. https://news.capital-cyber.com/false-claims-act-and-cybersecurity/https://news.capital-cyber.com/false-claims-act-and-cybersecurity/Mon, 17 Aug 2026 19:12:47 GMTThe False Claims Act cybersecurity risk is real for defense contractors. Learn from recent cases, what actions led to liability, and how to reduce exposure. https://news.capital-cyber.com/first-30-days-if-you-have-not-started/https://news.capital-cyber.com/first-30-days-if-you-have-not-started/Mon, 17 Aug 2026 19:12:47 GMTYour first 30 days matter. Use this CMMC compliance checklist to scope assets, inventory systems, and build your SSP for NIST SP 800-171 readiness.