Hats. We all have many, but for a small business owner you wear them all at the same time. This includes running your Security Program (unless, and you should, farm work out to an External Service Provider).
\nCMMC isn’t a framework or a standard. You need a program. A one person company does not need an enterprise security department. Instead as a founder you need a routine. All programs need routines to run.
\nMicrosoft Defender can find vulnerabilities. Huntress can monitor security events. Intune can enforce device settings. A FedRAMP provider can protect its cloud infrastructure. An MSP can review alerts.
\nNone of those tools decides how your company operates.
\nSomeone has to decide who gets access, which software the company allows, when vulnerabilities require action, what happens after an alert, and when a business change affects the CUI boundary. Wearing your security officer hat you need to turn technology into procedures.
\nYou do not need to create 20 Standard Operating Procedures. We want to identify the small number of things our founder must actually do and later write those actions directly into the SSP. Creating wave after wave of documentation will lead to problems for a small company. Document drift will cause you to fail assessments.
\nInstead treat your system security plan as a top level document that describes your plan for system security. Almost like it is in the name, or something. You will need some procedures and artifacts documented, especially inventory. Basically write down things you need to do your business. Put all your security related stuff in your SSP.
\nA one-person security program works better when you divide the work into four buckets:
\nThat gives us a security department without creating a security department.
\nStart with the work you already paid someone else to do.
\nDefender continuously evaluates the managed Windows endpoint for vulnerabilities and malware. Intune checks whether the laptop still meets the required configuration. Huntress monitors for suspicious activity. The cloud providers generate authentication, access, and file activity logs.
\nDo not recreate these technical processes manually. In your SSP explain that these requirements get inherited. You just need to make sure the services remain active.
\n\n\nAutomation performs the check. The company remains responsible for the decision.
\n
If Defender finds a vulnerability, Defender has done its job. The control still requires someone, you (or your MSP that you really should hire), to decide what to do about the finding.
\nFor a one-laptop company, start with one scheduled security review each week.
\nPick a day. Put it on the calendar. Treat it like bookkeeping.
\nYou or your MSP reviews (in our example architecture):
\nThe review does not need to become a three-hour meeting with yourself. Most weeks, nothing interesting should happen. Feature, not bug.
\nYou check the dashboards, handle anything that requires action, and record that the review occurred. If an MSP performs the review, you review the MSP report and follows up on anything that requires a business decision.
\nNow we have turned a large collection of NIST requirements into a simple habit:
\nOnce a week, check the health of the one system that can touch CUI.
\nDefender, using the E3+P2 license in our model, can continuously identify vulnerabilities on the laptop and supported applications. That solves the technical scanning problem.
\nYou still need to spell out a process in your SSP on how to handle a vulnerability when spotted.
\nWhen Defender identifies a vulnerability, the founder or MSP reviews the finding, determines whether it affects the system, applies the update or mitigation, and verifies that the vulnerability no longer appears.
\nThe company also needs to react when a new vulnerability appears between scheduled reviews. A Microsoft advisory, CISA notice, Huntress alert, or software vendor warning may trigger another review.
\nThe procedure remains simple:
\nFind it. Decide what it means. Fix it. Verify the fix. Keep the record.
\nThat sentence will eventually become much more valuable in our SSP than a paragraph that says, “See Vulnerability Management Policy.”
\nYou can write directly in the SSP how you Find it. Decide what it means. Fix it. Verify the fix. Keep the record. Keep your documentation lean.
\nWhen a small business owner opens up NIST-SP-800-171 for the first time they get overwhelmed reading 3.1.1.
\nMany access-control requirements sound complicated because large companies need to manage hundreds or thousands of accounts. You only have one authorized CUI user.
\nThe 1099 contractors do not receive CUI access. Their BYOD devices cannot access the CUI repository. Their Government-Furnished Equipment does not connect to company systems.
\nWhat you need are multiple identities with your multiple hats.
\nAccess Control specifically calls for separation of duties and least privilege. Feels like an oxymoron for a one person company.
\nUnder NIST-SP-800-171 different identities can be defined by roles. Give yourself a normal account for daily work and a separate privileged account when administrative access becomes necessary.
\nMicrosoft already made you buy enough roles to do this. Just enforce this on your laptop. Have one user to change and update stuff, and your everyday user to do stuff.
\nThen once a month review your accounts and access to confirm a bunch of new users weren’t added or changes weren’t made without approval.
\nThe review should take less than a half hour.
\nYou need to examine the user list, privileged accounts, and file-sharing permissions. You have a small scope, make sure to create small repeatable procedures.
\nWhen you read the configuration management requirements for approving changes a single person company can get frustrated. It seems like overkill.
\nYou do not need to form a Configuration Control Board every time you want to install something new.
\nWhat you need in your procedures is something that ensures you:
\nDo not install or change software without considering the security impact first.
\nBefore adding software, you need to document what the company needs, why the company needs it, whether the vendor supports it, whether it creates a new cloud connection, and whether it changes how CUI flows.
\nYou can make a form, send yourself an email, use a spreadsheet. Even paying for a ticketing system has value for a single person company. Having everything organized in one place with little effort can be worth the money.
\nAfter installation, you verify stuff works, close the ticket.
\nYou must document:
\nYou need traceability.
\nA ticketing system is something I encourage every company to have. If you want to use Microsoft Forms here are instructions.
\nScheduled reviews handle ordinary operations. Certain events should trigger immediate action.
\nExamples include:
\nHaving an MSP can help the single person shop handle these events.
\nLater in the SSP, we can spell out the exact steps.
\nFor now, the founder only needs to understand the principle:
\n\n\nRoutine problems follow the routine. Security events interrupt the routine.
\n
Some of the most important security events do not look like cybersecurity events at all.
\nYou might hire another employee. A contractor suddenly needs access to CUI, or you buy another laptop. Maybe your Prime wants to change the file-transfer process.
\nThose requests may sound operational, but they can change the CMMC boundary.
\nOur founder therefore needs one more procedure:
\nBefore changing who can access CUI, where CUI can go, or what technology can touch it, stop and review the scope.
\nWe introduced this as a scope-change trigger in Post One.
\nNow it becomes part of normal security operations.
\nWhen we strip away the product names and compliance language, the one-laptop security department has a pretty short job description.
\n| When | \nFounder or MSP Action | \n
|---|---|
| Continuous | \nSecurity tools monitor the endpoint, identity, and authorized services. | \n
| Weekly | \nReview vulnerabilities, alerts, compliance, updates, and outstanding remediation. | \n
| Monthly | \nReview accounts, access, authorized software, and major configuration changes. | \n
| When software changes | \nReview the security impact, approve the change, verify the system, and record the change. | \n
| When a vulnerability appears | \nReview it, remediate it, verify the correction, and keep evidence. | \n
| When a security event occurs | \nContain the problem, investigate it, escalate when necessary, and document the response. | \n
| When the business changes | \nCheck whether the change affects the CUI boundary before implementing it. | \n
That starts to look much more manageable than “implement 110 security requirements.”
\nA founder who wants to spend very little time on IT can pay an MSP to perform most of the weekly review. A managed VDI provider can take even more technical work off the company’s plate.
\nThat does not remove the founder from the security program.
\nA good small-business security program separates technical work from business authority. You can buy as much technical work as makes financial sense, but you always own the business decisions.
\nDo not wait until the CMMC assessment and try to recreate the last year of activity from memory.
\nMake evidence a side effect of doing the work.
\nThis will save a small company an enormous amount of time and money.
\nA weekly vulnerability review creates a review record. An Intune check creates device-compliance evidence. A Defender finding and later clean scan create remediation evidence.
\nIf you are going at it alone how can you ensure you follow the evidence collection needs?
\nWe now have enough information to start writing actual operating procedures into our SSP.
\nWe know:
\nNotice what we did not create.
\nWe did not write a separate Vulnerability Management Plan, Access Control Plan, Configuration Management Plan, Security Operations Procedure, and five other documents just to explain how one person manages one laptop.
\nWe described what actually happens.
\nAs a small business focus on doing the do and let the residuals of work prove the procedures in your System Security Plan.
\n![](\"https://cdn.uploads.micro.blog/29546/2026/1415449418-dd82c4af17-k.jpg\")
\n",
"date_published": "2026-08-29T17:46:31-04:00",
"url": "https://www.drmacscybersecuritybrief.com/2026/08/29/the-onelaptop-security-department.html",
"tags": ["soloprenuer"]
},
{
"id": "http://doctormac.micro.blog/2026/08/27/scoping-out-costs-of-solution.html",
"title": "Scoping out Costs of Solution Architecture",
"content_html": "For many small entrepreneurs the cost of CMMC drives your scope. You may engineer a solution that allows you to buy inherited solutions so you do not have to build every security control yourself. Microsoft GCCH will always have lower lifetime costs, but not every contractor can live by five year plans.
\n\n\nThis is the third post in the series on the soloprenuer and CMMC. You can find the first post here and the second post here.
\n
You may live TO by TO even after winning a spot on an IDIQ. Maybe you make it from RFP response to response and need to survive lean times between awards. Paying for the costly migration of a Microsoft tenant may not be in the cards until after award. So you utilize a FedRAMP Fileshare until then.
\nNo matter what the interwebz say, no one way exists to engineer a NIST-SP-800-171 environment for a single employee company. You have to right fit your solution to your business needs.
\nWhat do I actually need to buy?
\nA tiny contractor does not need one product for every NIST SP 800-171 requirement. Really the first question you need to ask, the most important thing to interview is Time and not money. How much time do you want to spend on IT, and does this have an impact on time available for Direct work?
\nReally try to see if your Prime will bring you in scope and provide you a device, but when they say no, four practical strategies emerge:
\nKeep Microsoft 365 Commercial and add a dedicated CUI repository.
\nBuild a Microsoft 365 GCC High environment.
\nRent a fully managed VDI enclave.
\nUse an MSP to take recurring security work off your plate.
\nThe products may change, but the business question will not.
\nCheap does not simply mean the smallest monthly bill.
\nA founder needs to look at the first-year check, five-year cost, implementation labor, inherited controls, and the amount of time the company must spend running the environment.
\nWe need an apples-to-apples starting point before comparing CUI solutions.
\nFor this article, every architecture except GCC High starts with the same commercial Microsoft baseline:
\n$32 per user per month for Microsoft 365 Business Premium/E3 plus the P2 add-on.
\nThat gives us:
\nThis baseline gives the company the Microsoft identity, endpoint-management, and Defender capabilities that support the managed endpoint. Defender handles vulnerability management, and Huntress remains the monitoring/SIEM platform.
\nYou might be a Google Workspace customer, and of so just skip ahead to the Managed VDI section. Explaining the difference in what a Google versus Microsoft stack brings goes way beyond the scope of this post. Google shops will need a managed VDI.
\nThe important budgeting rule looks like this:
\n\n\nFile sharing and VDI add to the commercial Microsoft baseline. GCC High replaces the commercial Microsoft baseline.
\n
We do not buy Business Premium/E3 + P2 and then stack equivalent GCC High licensing on top of it for the same CUI users.\nA one person company would rarely need a CUI enclave. You would not maintain two tenants unless you made significant commercial money overseas.
\nYou have all seen the commercials. Heard the channel sales pitch. Building a CUI enclave, meaning logical boundaries, around a FedRAMP High File share is quite common. Many business owners will pay more to keep Microsoft 365 Commercial for ordinary business and FCI while placing CUI in a separate FedRAMP High file-sharing service. This introduces less change to how business already gets done
\nFor this example, we budget $12,000 per year for a product-agnostic FedRAMP High file-sharing service. We also assume that price includes five CUI users.
\nYou always need more than one user, even as a single user company.
\nThe business still controls the laptop, approves access, reviews vulnerabilities, handles remediation, manages CUI, and keeps evidence. The cloud provider handles the infrastructure inside the CUI repository.
\nFor one user let us assume:
\n$12,000 file share + $384 Microsoft baseline = $12,384 per year
\n| One-User File-Share Model | \nCost | \n
|---|---|
| Commercial M365 + P2 baseline | \n$384.00/year | \n
| FedRAMP High file share | \n$12,000.00/year | \n
| Annual recurring cost | \n$12,384.00 | \n
| Five-year cost | \n$61,920.00 | \n
This architecture has one easy rule:
\n\n\nCUI goes in the CUI repository. Commercial business information stays in commercial Microsoft 365.
\n
For a tiny contractor, that clarity has real value. Many contractors also want to pay less up front and might start with a file-share and then move to GCCH once they win award. You gamble with less, and hope you win the award.
\nThe second strategy moves the CUI users into Microsoft 365 GCC High. GCC High can provide CUI email, SharePoint, OneDrive, Teams, identity, device management, and related security capabilities inside one Microsoft government environment. Defender still handles endpoint vulnerability management, and Huntress still supports monitoring.
\nThe key budget difference matters:
\nGCC High replaces the $32-per-user commercial Microsoft baseline for those CUI users.
\nWe do not add $384 per user to the GCC High number.
\nWe also need to remember that one employee does not mean one GCC High identity. Our one-person company needs a licensed daily-use account, a separate licensed privileged-administrator account, and two cloud-only emergency-access identities. The architecture comparison uses this same separation because the founder should not use the account that reads email and browses the web to administer the entire tenant.
\n| Identity | \nPurpose | \nDaily Use? | \n
|---|---|---|
| Daily user | \nEmail, Teams, SharePoint, OneDrive, and CUI work | \nYes | \n
| Privileged administrator | \nTenant and security administration | \nNo | \n
| Emergency access 1 | \nTenant recovery | \nNo | \n
| Emergency access 2 | \nTenant recovery | \nNo | \n
Our current planning model puts that GCC High stack at approximately $7,871.88 per year for the one-person environment.
\nThen we have to build it.
\nLet us assume a qualified Microsoft provider charges an average of $150 per hour.
\nA greenfield GCC High deployment requires about 100 hours of engineering. The provider needs to configure the tenant, identities, administrative accounts, device management, Defender, Conditional Access, logging, SharePoint, OneDrive, security settings, testing, and documentation.
\nThat creates a $15,000 setup project.
\n| One-User Greenfield GCC High | \nCost | \n
|---|---|
| Annual GCC High stack | \n$7,871.88 | \n
| 100-hour implementation at $150/hour | \n$15,000.00 | \n
| Year-one cost | \n$22,871.88 | \n
| Five-year cost | \n$54,359.40 | \n
GCC High costs less over five years than the dedicated file-share model, but the founder has to absorb a much larger first-year bill.
\nThat creates the cash-flow problem.
\nA founder who already runs a commercial Microsoft tenant faces a larger project. The provider now needs to build GCC High and move identities, mail, files, permissions, devices, DNS, and configurations.
\nWe will budget 150 hours for that work.
\nAt $150 per hour, the migration costs $22,500.
\nIf you know how to all the Microsoft stuff you can knock down these costs, but it will still take time. If you are in between awards time may not be scarce, if you have Direct hours to bill your time gets expensive.
\n| One-User GCC High Migration | \nCost | \n
|---|---|
| Annual GCC High stack | \n$7,871.88 | \n
| 150-hour migration at $150/hour | \n$22,500.00 | \n
| Year-one cost | \n$30,371.88 | \n
| Five-year cost | \n$61,859.40 | \n
Notice what happened.
\nThe five-year cost of migrating into GCC High gets close to commercial Microsoft and adding the $12,000 file share. Two to Five users, if you can get an affordable file-share package is the sweet spot.
\nThe business decision now depends much more on cash flow, workflow, and how much infrastructure the founder wants to manage.
\nA fully managed VDI enclave takes another path.
\nA service such as CuickTrac, ATX, or Midwatch moves much of the technical operation into the managed enclave. You get access to a VDI solution that keeps your endpoint out of scope. Suddenly more of your security requirements get inherited. This is as close as turn key getd
\nFor this comparison we will assume three users. Just like the Fileshare and M365 a single person company needs multiple identities to fill roles of least privilege.
\nFor this compliance story we will use $325 per user per month, with a three-user minimum, plus a $5,000 one-time setup fee.
\nThe commercial Microsoft baseline still applies because this model does not replace the company’s Business Premium/E3 + P2 environment.You still need to pay for your commercial side of the business.
\n3 × $325 = $975 per month for Managed Enclave
\nThen we add our one-user Microsoft baseline:
\n$975 + $32 = $1,007 per month
\n| One-User Model | \nCost | \n
|---|---|
| Commercial M365 + P2 baseline | \n$384.00/year | \n
| Three-seat minimum | \n$11,700.00/year | \n
| Annual recurring cost | \n$12,084.00 | \n
| One-time setup | \n$5,000.00 | \n
| Year-one cost | \n$17,084.00 | \n
| Five-year cost | \n$65,420.00 | \n
Now the fully managed VDI model sits in an interesting position.
\nIt costs less in year one than either GCC High approach, and its five-year cost stays reasonably close to both the dedicated file share and a GCC High migration.
\nThe founder pays a premium over greenfield GCC High but buys much more operational help.
\n| One-Person Architecture | \nYear One | \nFive Years | \n
|---|---|---|
| Commercial M365 + P2 + FedRAMP High file share | \n$12,384.00 | \n$61,920.00 | \n
| Cuick Trac + Commercial M365 + P2 | \n$17,084.00 | \n$65,420.00 | \n
| GCC High — greenfield | \n$22,871.88 | \n$54,359.40 | \n
| GCC High — migrate existing tenant | \n$30,371.88 | \n$61,859.40 | \n
The dedicated file share creates the lowest first-year cost.
\nGreenfield GCC High creates the lowest five-year cost.
\nManaged Enclaves have the highest lifetime cost but the lowest level of effort.
\nMigrating into GCC High costs almost exactly the same over five years as the dedicated file-share model, but the founder has to fund much more of that cost during year one.
\nNone of those choices are right or wrong. They solve different problems.
\nNow let the company grow from one CUI user to five.
\nOur commercial Microsoft baseline follows the number of users:
\n5 × $32 × 12 = $1,920 per year
\nThe file-share service still costs $12,000 because our planning assumption includes five licenses.
\nThat gives the five-user file-share model a major scaling advantage.
\n| Five-User File-Share Model | \nCost | \n
|---|---|
| Five Commercial M365 + P2 users | \n$1,920.00/year | \n
| FedRAMP High file share with five included users | \n$12,000.00/year | \n
| Annual recurring cost | \n$13,920.00 | \n
| Five-year cost | \n$69,600.00 | \n
At one user, the company pays for file-sharing capacity it does not use. At five users, the company finally uses all five included licenses while the $12,000 repository cost stays flat.
\nA five-person GCC High company also needs more than five identities.
\nOur design uses five licensed daily-use accounts, one separate licensed privileged-administrator account, and two cloud-only emergency-access identities.
\nThat gives the company eight identities, with six licensed identities in our planning model.
\nThe current planning figure puts the five-user GCC High stack at approximately $12,335.88 per year.
\nGCC High still replaces the commercial Microsoft baseline. We do not add another $1,920 for Business Premium/E3 + P2.
\n| Five-User GCC High | \nYear One | \nFive Years | \n
|---|---|---|
| Greenfield — 100-hour setup | \n$27,335.88 | \n$76,679.40 | \n
| Migration — 150 hours | \n$34,835.88 | \n$84,179.40 | \n
GCC High now loses the five-year price advantage it had at one user because our file-share service includes five seats for the same $12,000 annual price. File-share pricing model scales unusually well from one to five users.
\nManaged Enclaves scale differently because they charge per user.
\nUsing our earlier estimage Five users cost:
\n5 × $325 × 12 = $19,500 per year
\nWe then add the five-user commercial Microsoft baseline:
\n$19,500 + $1,920 = $21,420 per year
\n| Five-User Cuick Trac Model | \nCost | \n
|---|---|
| Five Commercial M365 + P2 users | \n$1,920.00/year | \n
| Five users | \n$19,500.00/year | \n
| Annual recurring cost | \n$21,420.00 | \n
| One-time setup | \n$5,000.00 | \n
| Year-one cost | \n$26,420.00 | \n
| Five-year cost | \n$112,100.00 | \n
The managed VDI looks much more attractive at one user than at five because the three-seat minimum already forces the tiny company to buy unused capacity.
\nOnce the company reaches five people, every new VDI user increases recurring cost.
\n| Five-User Architecture | \nYear One | \nFive Years | \n
|---|---|---|
| Commercial M365 + P2 + FedRAMP High file share | \n$13,920.00 | \n$69,600.00 | \n
| Cuick Trac + Commercial M365 + P2 | \n$26,420.00 | \n$112,100.00 | \n
| GCC High — greenfield | \n$27,335.88 | \n$76,679.40 | \n
| GCC High — migrate existing tenant | \n$34,835.88 | \n$84,179.40 | \n
The file-share model wins the five-user price comparison because the $12,000 subscription already includes five CUI users.GCC High costs more over five years at this size, but it provides a much broader collaboration environment. The company gains CUI email, Teams, SharePoint, OneDrive, identity, device management, and other services under one ecosystem.
\nManaged Enclaves cost substantially more at five users, but price does not tell the whole story. The company pays the provider to operate much more of the environment. A founder who does not want to build or maintain the technical stack may still value that trade.
\nThe three architectures sell different kinds of inheritance.
\nWith the FedRAMP High file-share model, you buy a controlled place for CUI while keeping the commercial Microsoft security stack.
\nWith GCC High, the founder replaces the commercial Microsoft stack with a government cloud environment and pays a substantial engineering cost to build it correctly.
\nWith *Managed Enclave, the founder keeps the commercial Microsoft baseline and pays a managed-enclave provider to take much more responsibility for the CUI workspace.
\nThe cheapest choice depends on the size of the company and the kind of inheritance the founder values.
\nAn MSP can support the commercial Microsoft and GCC High models by reviewing Defender findings, monitoring Huntress, coordinating remediation, managing endpoint configuration, reviewing accounts, gathering evidence, and preparing reports.
\nThe founder still owns the CMMC program, but the founder does not need to spend every Friday staring at security dashboards.
\nThat time has value.
\nIf a founder spends five hours each month managing cybersecurity, the company loses 60 hours per year. At a $200 billable rate, that represents $12,000 of potential revenue.
\nA spreadsheet that ignores the founder’s time does not show the true cost of the architecture.
\nMicrosoft can operate the cloud. A FedRAMP provider can secure the repository. Defender can identify vulnerabilities. Huntress can monitor security events. CuickTrac can operate a managed enclave. An MSP can review alerts.
\nThe founder still approves users, decides who may access CUI, maintains the system boundary, manages company procedures, reviews provider responsibilities, makes risk decisions, and keeps the SSP accurate.
\nThat gives us the real lesson behind inheritance:
\n\n\nYou do not need to build every security control yourself. You need to understand which controls you own and which controls you bought from somebody else.
\n
For a one-person company, the dedicated file-share architecture provides the lowest first-year cost, while greenfield GCC High produces the lowest five-year cost under these assumptions.
\nA managed VDI enclave such as CuickTrac lands between them. It costs a little more over five years than the file-share model but can dramatically reduce the amount of technical work the founder needs to perform.
\nMigration changes the GCC High story. Once a company already has a commercial Microsoft tenant, the 150-hour migration makes GCC High and the file-share model almost identical over five years. The founder then needs to decide whether consolidation justifies the larger first-year bill.
\nAt five users, the dedicated file share becomes the least expensive architecture because the $12,000 subscription already includes all five users. GCC High costs more but offers broader capabilities, while managed VDI costs the most because every additional seat increases the subscription.
\nThe goal is not to buy the most cybersecurity products or chase the cheapest advertised license.
\n\n\nBuy the architecture that leaves you with the fewest security problems you personally have to solve at a price your business can a afford.
\n
We now know where CUI lives, how users reach it, which services manage identity and endpoints, how the company handles vulnerability management and monitoring, which providers operate technical controls, and which responsibilities remain with the founder.
\nIn the next post, we stop shopping and start doing. We will look at what you need to do every day, every week, every month, and every time something changes. You need to think about security controls stop as product features and start building procedures to get better at business.
\n![](\"https://cdn.uploads.micro.blog/29546/2026/6107919083-ab1177c1ce-h.jpg\")
\n",
"date_published": "2026-08-27T17:30:36-04:00",
"url": "https://www.drmacscybersecuritybrief.com/2026/08/27/scoping-out-costs-of-solution.html",
"tags": ["soloprenuer"]
},
{
"id": "http://doctormac.micro.blog/2026/08/26/one-laptop-does-not-need.html",
"title": "One Laptop Does Not Need an Enterprise Security Program",
"content_html": "A one-person company struggles to prepare for CMMC. Often, folks begin in the wrong place.
\n\n\nAll month long I am focusing on how a single-user company can create controls that meet NIST SP 800-171 security requirements and pass a CMMC assessment using the NIST SP 800-171A assessment objectives. You can find the first post here.
\n
You download NIST SP 800-171. You see 110 requirements. You throw up in your mouth when you realize you must meet 320 assessment objectives. You have no employees. How can you meet requirements meant for a large enterprise?
\nYou start hearing about policies, SIEMs, VLANs, vulnerability scanners, privileged access workstations, firewalls, incident response plans, configuration management boards, and a dozen other things that sound like they belong in a Fortune 500 company.
\nBefore long, a founder with one laptop tries to design an enterprise security program.
\nStop this backward approach.
\nBefore we decide how to protect the system, we need to answer a much simpler question:
\nWhat exactly do we need to protect?
\nFor a small contractor who runs staffing agencies and hires 1099 employees to work on GFE, the simplicity of the environment matters.
\nWe work with many companies that operate on similar principles.
\nOne founder serves as the principal contractor. She has one company-controlled Windows laptop. Only this company device can process, store, or transmit Controlled Unclassified Information.
\nThe company also uses 1099 contractors, but those contractors perform their government work onsite using Government-Furnished Equipment.\nTheir GFE does not connect to the company’s systems.\nThe company does not grant those contractors access to CUI.
\nFor ordinary company communications and Federal Contract Information, the contractors may use their own devices to access Microsoft 365 Commercial.\nBut that Microsoft 365 environment only touches FCI. Contractors cannot access the CUI repository.
\nThe company realizes it has:
\nA small business may own or interact with all kinds of technology.\nThat does not mean all of it has to become part of the system that handles CUI.\nOur founder may use a personal phone.\nThe 1099 contractors may own laptops and tablets.\nThe Government may provide computers.\nThe company may have a commercial Microsoft 365 tenant.\nT he founder may have a home router.\nNone of those facts automatically place all of those devices inside the CUI environment.
\nAs you start to scope a single-person company, begin with critical questions:
\nOur boundary may look like this:
\n![\"Auto-generated](\"https://cdn.uploads.micro.blog/29546/2026/single-contractor.png\")
\nOr like this:
\n![\"\"](\"https://cdn.uploads.micro.blog/29546/2026/singlelaptopscope.png\")
\nWe keep the center of the diagram intentionally boring.
\nWhen you realize the scope involves a single company-managed Windows laptop, you can get a handle on CMMC.\nThat laptop connects to the authorized services used to protect and handle CUI. Everything else gets separated by function.\nThe Government-Furnished Equipment stays in the Government environment.\nThe contractors' personally owned devices stay in the FCI workflow.
\nMicrosoft 365 Commercial stays an FCI environment and provides SPA support as an External Connection.
\nThe contractors never receive access to the CUI repository.\nCUI does not move onto their personal devices.\nCUI does not move onto the Government equipment through the company’s systems.\nCUI does not get printed.
\nThe result:
\nCUI scope, Government systems, and ordinary FCI collaboration do not have to become one giant blob.
\nThat makes both cybersecurity and CMMC easier.
\nA hidden cost appears every time you allow CUI onto another device.\nSuppose the founder decides to let a contractor download one CUI drawing onto a personal laptop.\nThat sounds like one small workflow change.
\nNo.\nWe just added another device to our boring middle, and we increased scope.
\nNow we have another device that we may need to inventory, configure, harden, monitor, patch, protect, assess, and describe in the SSP. We need to know who administers it. We need to control access. We need to know where the file gets stored.We need to know whether it gets backed up.
\nWe need to think about browser caches, temporary files, local accounts, malware protection, encryption, vulnerabilities, and incident response.All because we wanted to make one file easier to access. The same thing happens with printers.
\nIf we do not print CUI, then we do not need to design procedures for protecting CUI sitting in an output tray, storing paper records, transporting hardcopy, sanitizing printer storage, or destroying printed CUI.
\nThe simplest printer control for a tiny company:
\nDo not print CUI.
\nThat gives us one of the most important lessons in this entire series:
\n\n\nEvery asset you keep out of the CUI workflow is an asset you do not have to protect as part of the CUI system.
\n
That does not mean ignoring security on the rest of the business.
\nFCI still has safeguarding requirements.\nCommercial systems still need security.\nEmployees and contractors still need safe computing practices.\nIt simply means that we should not unnecessarily turn every business system into a CUI system.
\nThis is why I would not start a small company’s CMMC project by shopping for cybersecurity tools.
\nI would start with a diagram.
\nIf a founder cannot explain the boundary in plain English, you will struggle to write an accurate SSP around it.
\nIf the assessor cannot understand the boundary, the assessment will get much more complicated.
\nTechnology alone will not keep this design small.\nThe company also needs rules.
\nThose operating decisions preserve the boundary.
\nWe still have not written any of the 110 NIST SP 800-171 requirements.
\nBut we have already created some of the most important content that will eventually go into the System Security Plan.
\nWe now know:
\nThat is why I wanted to start the series here.
\nIf we get the boundary wrong, everything we build afterward gets harder.
\nIf we get the boundary right, a one-person company can remain a one-person security problem instead of accidentally becoming an enterprise security problem.
\nWhen it comes time to write the System Security Plan, your boundary diagram will support many controls:
\n![](\"https://cdn.uploads.micro.blog/29546/2026/cfcf929ad0.png\")
\n",
"date_published": "2026-08-26T08:05:37-04:00",
"url": "https://www.drmacscybersecuritybrief.com/2026/08/26/one-laptop-does-not-need.html",
"tags": ["soloprenuer"]
},
{
"id": "http://doctormac.micro.blog/2026/08/25/cmmc-for-a-company-of.html",
"title": "CMMC for a Company of One: Building a Business Not a Burden",
"content_html": " If you are a founder, independent consultant, or owner of a very small defense contractor, NIST SP 800-171 feels overwhelming. You stare at the CMMC scoping guide and know someone wrote it for a company much larger than yours.
\nYou may have one employee, one laptop, no server room, no IT department, and no corporate network. Yet if your company handles Controlled Unclassified Information (CUI), you still need to protect that information and explain how you meet the requirements of NIST SP 800-171. You have to meet the same 110 requirements as Boeing, RTX, or General Dynamcs
\nIn this series, we will build a complete System Security Plan (SSP) for a fictional one-person company. But we will not start with the SSP.
\nWe will begin with how the business actually operates, define the CUI boundary, select the technology, write the procedures, identify the evidence, and only then assemble the SSP.
\nThe goal: Create an SSP that tells the founder exactly what to do instead of constantly pointing to separate policies, plans, and procedures. You do not need to swim in pages of procedures. We will also include a cost analysis of different solutions, and consider the implications to how you do business better. We will focus on implementing controls not on how they fall in in NIST-SP-800-171 but on the ROI for security for a micro-business
\nOur company has one principal contractor who may receive and work with CUI. The principal uses one company-managed Windows laptop as the only company-controlled endpoint authorized for CUI.
\nThe company also uses 1099 contractors. When performing government work, they use Government-Furnished Equipment (GFE) onsite. The company does not grant those contractors access to its CUI environment.
\nFor normal business communications and Federal Contract Information (FCI), the contractors may use personally owned devices to access Microsoft 365 Commercial. That environment is not authorized for CUI.
\nThere are no company servers, no CUI printers, and no removable media used for CUI.
\nThe same system boundary will be used throughout the series. The important part is the separation: the managed laptop and authorized CUI services are inside the CUI environment, while contractor GFE, BYOD devices, and the Microsoft 365 Commercial FCI environment remain outside it.
\n![\"\"](\"https://cdn.uploads.micro.blog/4002/2026/examplenetworkdiagram.png\")
\nThis deliberately narrow architecture gives us a manageable example for showing how a micro-business can implement NIST-SP 800-171 without designing an enterprise network it does not need. Our solution also relies on using strategic partners when it makes more economic sense than trying to do it on your own.
\nA common mistake small is to start with 110 requirements and immediately begin writing policies.
\nThat reverses the process.
\nFirst understand the business. Then follow the CUI. Draw the boundary. Select the technology. Assign responsibilities. Write the procedures. Identify the evidence. You want to use CMMC to do business better.
\nThen write the SSP.
\nBy the end of this series, the SSP should be more than an assessment document. It should function as the operating manual for protecting CUI in this small environment.
\nWe will build this outcome together.
\n", "date_published": "2026-08-25T13:04:40-04:00", "url": "https://www.drmacscybersecuritybrief.com/2026/08/25/cmmc-for-a-company-of.html", "tags": ["soloprenuer"] } ] }