Appalachia Technologies Blog

If you had told me a few years ago that my calendar would be split between virtual CISO responsibilities, mentoring team members, and crafting cybersecurity campaign content with a marketing team, I might have raised an eyebrow. But today, that’s just a regular Tuesday. As the Practice Lead for NIST, SOC2, and CIS GRC Services at a cybersecurity consulting firm, no two days look exactly alike, and that’s exactly what makes the role both challenging and rewarding. However, my day has looked like this before and this includes most of my responsibilities.

The Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) Level 2 is based on the 110 security practices from NIST SP 800-171 rev 2. These practices are designed to protect controlled unclassified information (CUI) within the defense supply chain. For most DoD contractors, achieving CMMC Level 2 compliance is now mandatory, but the process is challenging. Organizations must navigate evolving requirements, implement technical controls, manage costs, train their workforce, and prepare for stringent audits. Here’s an overview of the top challenges contractors face along with the best practices for overcoming them.

In today’s increasingly interconnected world, safeguarding sensitive government data is a top priority for federal agencies—and for the contractors they partner with. While classified information has long been protected through well-established regulations, a new category of “Controlled Unclassified Information” (CUI) has emerged in recent years, prompting additional guidance and compliance requirements. Enter the Federal Acquisition Regulation (FAR) rule for CUI.

In this blog post, we’ll explore what CUI is, why it matters to government contractors, and how the FAR rule on CUI will shape compliance requirements going forward.