Craft a Board Risk Update

Description

Mid-sized defense contractor with cleared personnel, handling Controlled Unclassified Information (CUI) and some ITAR data.

Analyst task

You are 90 days from a CMMC L2 assessment. Write the readiness plan and the briefing for the COO on what is at risk if any of the top three POA&M items slip.

Systems

• On-prem enclave for CUI
• Air-gapped dev environment
• External collaboration tool (GovCloud)
• Classified network (read-only data)

Regulatory exposure

• CMMC 2.0 L2
• DFARS 7012
• ITAR
• Export Administration Regulations

Top risks

• CUI exfiltration via removable media
• Insider with cleared access
• Foreign national contact
• Subcontractor flow-down gaps

Audit concerns

• SSP currency
• POA&M closure evidence
• Annual security training records