Lion Cipher Lab
Scope a defense contractor for CMMC and run a Level 1 self-assessment and a Level 2 gap assessment with an SPRS score
- GRC / Compliance
- Intermediate
- ~75 min
- Free · no account required
Why it matters
There is a version of security work that has nothing to do with alerts or exploits, and it employs a very large number of people: proving to a customer that you are safe to do business with. In the United States the biggest single instance of that is the Department of Defense's supply chain. Somewhere north of a hundred thousand companies sit in what the government calls the defense industrial base — the machine shops, circuit-board houses, software vendors, logistics firms, welders, translators and engineering consultancies that build and support what the military buys. Most of them are…
What you'll learn
- telling Federal Contract Information (FCI) apart from Controlled Unclassified Information (CUI)
- reading the CUI Registry and CUI markings
- CMMC asset categorisation (CUI, Security Protection, Contractor Risk Managed, Specialized, Out-of-Scope)
- enclave design and scope reduction as a cost lever
- running a CMMC Level 1 self-assessment against the 15 FAR 52.204-21 requirements
- running a NIST SP 800-171 Level 2 gap assessment
- computing an SPRS score with the DoD Assessment Methodology weighting
- applying the POA&M eligibility and closeout rules
- understanding flow-down, C3PAO assessment and the senior-official affirmation
Steps in this lab
- The vocabulary, from absolute zero — because none of this is guessable
- Where the rules actually live — and why you must go and read them yourself
- FCI versus CUI — the one call that determines everything downstream
- Meet Meridian, set up your working folder, and build the data-type register
- The revision problem — read this before you buy anything or believe anyone
- Scope it — the five asset categories, and why the category decides the workload
- Shrink the scope — the enclave, and the single biggest cost lever in the programme
- Do the Level 1 self-assessment — 15 requirements, no partial credit, no POA&M
- Do the Level 2 gap assessment — NIST SP 800-171 against a shop that never planned for it
- Compute the SPRS score — the arithmetic, done by hand, until it is obvious
- POA&M rules — what you may defer, what you absolutely may not, and the 180-day clock
- Who assesses you, what your prime will do to you, and the memo a senior official signs
- The judgment — what this really costs, and the sentence that ends companies