Federal Compliance
Field Manuals

The C3PAO practitioner's reference for conducting CMMC Level 2 assessments. Covers all 110 practices across 14 domains with assessment objectives, evidence requirements, and interview guidance aligned to the CMMC Assessment Guide v2.13 and 32 CFR Part 170.

Built for ISSOs and security engineers implementing CMMC Level 2 at an OSC. Covers all 110 NIST SP 800-171 practices with implementation guidance, documentation requirements, SSP construction, and POA&M management under 32 CFR Part 170.

The documentation and scoping companion to CMMC Level 2. Covers CUI identification, scoping decisions, system boundary definition, SSP structure, and POA&M construction — the documentation layer that assessors evaluate before they look at a single control.

The practitioner guide to CMMC Level 1 self-assessment and FAR 52.204-21 compliance. Covers all 15 FCI safeguarding practices across 6 domains with implementation guidance and annual self-assessment requirements.

The definitive guide for MSPs, MSSPs, and cloud providers operating in the Defense Industrial Base. Covers ESP and MSP determination, Security Protection Data triggers, CSP routing, inheritance, CRM construction, and assessment treatment under 32 CFR Part 170.

The mid-tier contractor's guide to DFARS and CMMC flow-down requirements. Covers prime-to-sub obligations, DFARS 252.204-7012 and 7021 clause requirements, subcontractor oversight, CUI flow-down, and supply chain compliance management.

A step-by-step guide to planning, conducting, scoring, and documenting a NIST SP 800-171 self-assessment. Covers the OSA methodology, SPRS score calculation, assessment evidence requirements, and POA&M development for DoD contractors.

The complete practitioner guide to the CUI Program under 32 CFR Part 2002. Covers CUI identification and determination, marking discipline, the CUI Registry, safeguarding requirements, contractor obligations under DFARS 252.204-7012, and the CUI-to-CMMC compliance chain.

The practitioner's guide to FedRAMP 20x certification under the Consolidated Rules for 2026. Covers the CR26 authorization pathway, all 46 Key Security Indicators, KSI assessment methodology, and the technical and documentation requirements for CSPs pursuing 20x authorization.

Built for ISSOs operating a FedRAMP 20x authorized cloud service. Covers continuous monitoring under CR26, KSI maintenance, evidence collection, ConMon reporting, significant change management, and the operational discipline required to sustain a 20x authorization.

Complete coverage of all 410 FedRAMP High baseline controls across 18 control families. Includes implementation guidance, parameter values, assessment considerations, and field techniques for CSPs pursuing or maintaining FedRAMP High authorization.

Complete coverage of all 323 FedRAMP Moderate baseline controls. The most widely used baseline in the FedRAMP marketplace, covering all 18 control families with implementation guidance, parameter values, and field techniques.

Complete coverage of all 156 FedRAMP Low baseline controls for CSPs targeting the entry-level federal authorization. Covers all 18 control families with implementation guidance and assessment considerations.

A step-by-step reference for all seven DoD RMF steps from Prepare through Monitor. Covers every task and output defined in DoDI 8510.01, NIST SP 800-37 Rev. 2, and CNSSI 1253 — the foundational process guide for DoD information system authorization.

The ISSO and ISSM implementation reference for DoD RMF. Covers all 20 NIST SP 800-53 control families with DoD-specific implementation guidance, eMASS documentation requirements, evidence collection, and continuous monitoring.

The Security Control Assessor's field reference for DoD RMF assessments. Covers assessment planning, examine-interview-test methodology for all 20 control families, tailored DoD assessment procedures aligned to NIST SP 800-53A Rev. 5, and assessment reporting.

Operationalizing the NIST AI Risk Management Framework. Covers all four core functions — Govern, Map, Measure, Manage — with 72 subcategories, the NIST AI 600-1 Generative AI Profile, 12 GenAI risk categories, and actionable implementation guidance.

The practitioner guide to auditing AI governance, risk management, and controls. Covers audit universe development, AI-specific risk assessment, governance program auditing, vendor AI assessment audits, and reporting to boards and senior leadership.

A practitioner's implementation guide to ISO/IEC 42001, the international standard for AI management systems. Covers AIMS design and implementation, risk management, vendor oversight, internal controls, and audit readiness for ISO 42001 certification.

Building and running an enterprise AI governance program. Covers governance structure, policy frameworks, AI risk inventory, oversight bodies, assessment methodologies, monitoring, and audit readiness across commercial and regulatory AI governance requirements.

A practitioner's guide to AI risk registers, third-party AI assessments, vendor due diligence, and continuous monitoring. Covers the full AI vendor governance lifecycle from initial assessment through contract requirements and ongoing monitoring programs.

The practitioner reference for SOC 2 Type I and Type II examinations. Covers all 64 Trust Services Criteria across all 5 categories, 2022 Points of Focus, evidence requirements, and audit procedures for CPA firms, internal auditors, and security practitioners.

Complete coverage of all 12 PCI DSS v4.0.1 requirements from both the entity implementation and QSA assessment perspectives. Aligned to the PCI SSC ROC Template v4.0.1, covering every requirement with implementation guidance and assessment testing procedures.

Compliance-mapped penetration testing using MITRE ATT&CK Enterprise v16. Covers all 14 tactics, 220+ TTPs, and 440+ commands for FedRAMP, PCI DSS, CMMC, DoD RMF, GovRAMP, and SOC 2 penetration testing engagements.

The practical compliance guide for automotive dealerships subject to the FTC Safeguards Rule. Covers risk management, vendor oversight, incident response, employee training, and audit readiness for dealerships handling customer financial information.