Defense Tech BaseHow the course works
Every lesson below is free to read. Email delivers the same core material with examples selected for your goal, stage and product type. Choose daily, every two days or weekly. Lessons begin after you confirm your email and follow your chosen pace.
Pause or change preferences from any lesson. You are signing up for this course only, not the weekly briefing. Finishing an exercise is optional and does not block the next email.
Learn by email
Choose your email schedule
Lesson 1 of 5
Locate the actual requirement
Start with the applicable contract or solicitation and record the required CMMC level and assessment type.
Find the requirement in the actual opportunity, contract or customer flow-down. Save its reference and date, then record the required level, assessment route, relevant timing and the person who can clarify uncertainties. A supplier’s general marketing page is not the basis for your contractual scope.
FCI and CUI are different information categories. Identify what the work will involve before selecting systems or providers. If the information category or required handling is unclear, ask the authorized customer contact for clarification instead of classifying information from a guess.
Create a requirements log with one row per source requirement and a separate column for your interpretation. This makes a conversation with a provider more concrete and preserves the distinction between what the source says and what your team still needs to establish.
A worked example
Illustrative example: a subcontract mentions cybersecurity flow-downs, but the founder has not received the applicable information-handling details. The first action is clarification, not an assumed level.
Put it to work
Create a requirement log with source, clause or reference, level, assessment type, owner and unresolved questions.
- Original requirement saved
- Information category clarified
- Assessment route and owner recorded
Lesson 2 of 5
Map where relevant information goes
Describe information flows and system boundaries before treating a particular cloud purchase as the solution.
List where relevant information enters the organization, where it is stored, who accesses it, which devices process it and where it leaves. Include practical routes such as email, shared folders, backups, support access and supplier exchanges. Keep actual sensitive files in your approved internal systems; this exercise needs names of flows, not copies of controlled data.
Draw the proposed boundary and identify external service dependencies. A provider may operate part of a system while your team remains responsible for user behavior, access decisions and other functions. A product label alone does not establish an appropriate boundary or demonstrate that each obligation is met.
Ask your internal security owner or qualified provider to challenge the map. Missing support workflows and devices often make the first drawing incomplete. Record assumptions as open questions, then update the map when those questions are resolved.
A worked example
Illustrative example: a hardware team lists engineering workstations but initially misses the external supplier portal used to exchange drawings. It adds that exchange and asks how the boundary should handle it.
Put it to work
Draw a one-page flow map covering information, people, devices, storage, backups and external providers.
- Entry and exit points mapped
- External dependencies included
- Boundary assumptions reviewed
Lesson 3 of 5
Build an evidence register with owners
An evidence register connects a requirement to an actual practice, a responsible owner and reviewable supporting material.
Create a table with requirement reference, implementation owner, current practice, evidence location, review date and known gap. A policy document describes intended behavior; it does not automatically demonstrate that the behavior occurs. Keep evidence pointers in approved storage and avoid copying sensitive records into a public tool.
Separate “not reviewed,” “partially implemented” and “reviewed internally.” These are project statuses, not official assessment scores. A useful register makes uncertainty visible rather than presenting every row as complete because a template exists.
Test one row from end to end. Ask whether the owner can explain the practice and retrieve the supporting material consistently. If the answer depends on one individual or an outdated screenshot, add a specific maintenance task. Use the exercise to improve operations as well as prepare for review.
A worked example
Illustrative example: an access policy exists, but the owner cannot locate the most recent access review. The register records a gap with a concrete review task rather than marking the control complete.
Put it to work
Create ten initial evidence rows and walk through one requirement with its owner.
- Requirement and owner connected
- Evidence location and date recorded
- Missing practice distinguished from missing document
Lesson 4 of 5
Compare provider responsibilities and exclusions
Compare readiness, implementation, managed support and assessment as separate scopes with named responsibilities.
Give finalists the same sanitized scope brief. Describe the systems, user count, information-flow questions, existing work and desired deliverables. Ask for what is included, what is excluded, who supplies evidence and which work remains with your team. Share sensitive technical details only through a suitable process agreed with the provider.
Compare deliverables and dependencies instead of headline prices. One proposal may provide a gap report while another implements changes or operates services. An assessment role is also different from implementation help. Verify the current role and authorization required for the actual work using official program resources.
Request a responsibility matrix covering each major work package and handoff. Record recurring costs, change assumptions, subcontracted work and evidence access. This gives you a basis for discussing scope without asserting that the lowest price or a named cloud product guarantees an outcome.
A worked example
Illustrative example: proposal A delivers findings; proposal B adds implementation. The comparison separates those work packages so the team can evaluate the actual difference.
Put it to work
Write one provider brief and compare two proposals using the same deliverable and responsibility headings.
- Common scope sent to finalists
- Deliverables and exclusions compared
- Internal and provider responsibilities named
Lesson 5 of 5
Turn gaps into a maintained work plan
A readiness plan orders work by real dependencies and assigns an owner, evidence and review point to every task.
Group the open work into requirement clarification, system changes, operating practices, evidence and assessment preparation. Put dependencies beside the tasks: a boundary decision can affect system configuration, and a process change can affect the evidence you expect to collect.
Budget from quoted work and actual internal effort. Separate initial setup, recurring service charges and review or assessment costs; retain dates and assumptions for each input. Do not treat an illustrative calculator as a vendor quote or an assessment timetable.
Schedule internal reviews that test whether practices continue after the initial project. Track changed systems, roles and providers so evidence stays current. Before making a claim to a customer, have the authorized owner verify the applicable requirement and actual status.
A worked example
Illustrative example: a team postpones buying a new service until its boundary question is answered, while proceeding with an independent access-review task that is already well defined.
Put it to work
Build an owner-based work plan with dependencies, cost inputs, evidence outputs and next review dates.
- Dependencies drive task order
- Costs trace to verified inputs
- Ongoing ownership and reviews established
Questions about this course
Does this course make my company CMMC certified?
No. It helps organize preparation. Assessment and affirmation requirements depend on the applicable solicitation and CMMC program rules; completing lessons supplies no certification or assessment result.
What should I do before choosing a CMMC provider?
Identify the contract requirement, relevant information flows, current systems and internal owners. Use those facts to compare implementation, managed-service and assessment scope.
Is this CMMC assessor training?
No. This course is for founders and suppliers planning company readiness. Professional CCP or CCA credential training is a different offering.