C2M2–CMMC Supplemental Guidance
Guidance aligning DOE's Cybersecurity Capability Maturity Model with CMMC practices.
Insights
Assessment Notes, publications, and lessons from the field.
Practical perspectives on CMMC, federal cybersecurity, assessment leadership, and operational readiness.
National Cybersecurity Contributions
Publications shaped by assessment experience.
Guidance connecting maturity, threat-informed planning, and practical CMMC readiness.
Cybersecurity Threat Profile Development Guide
Guidance supporting structured threat-profile development and risk-informed cybersecurity planning.
Shawn's Assessment Notes
Field-tested observations for organizations and assessors.
Evidence
Evidence Before Assertion
Why confident explanations do not replace records, configurations, tickets, and demonstrations.
Read the insight →Operational Reality
Documentation Is Not the Control
What assessors learn when daily operations diverge from policies and procedures.
Read the insight →Scoping
The Scope Is the Assessment
How unclear CUI flows, external services, and inherited responsibilities create downstream risk.
Read the insight →Assessment Leadership
Consistency Creates Credibility
Why repeatable assessment methods improve fairness, defensibility, and trust.
Read the insight →Readiness
Prepare the Evidence Path
Organize evidence so assessors can understand, trace, and verify implementation.
Read the insight →Lessons from the Field
Operational Reality Wins
The strongest assessment programs connect documents, people, systems, and repeatable evidence.
Read the insight →Industry Features & Speaking
Assessment and critical-infrastructure perspectives in the field.
Why Every Enterprise Needs a Cybersecurity System of Record
Perspectives on multi-assessment environments, inherited controls, reducing redundancy, and creating a defensible enterprise view of cybersecurity risk.
Read the feature →Collective Defense Across Telecom and Energy
Cross-sector collaboration, threat intelligence sharing, incident preparedness, and cybersecurity resilience.
View the session →Speaking
Assessment leadership for conferences, webinars, and executive briefings.
Topics include CMMC readiness, objective evidence, assessment consistency, lessons from the field, and the intersection of maturity models and formal assessments.
View Speaking Topics →