Free Cybersecurity Resources and CMMC Guidance for Small Contractors

Eric Marquette

Roughly 120,000 small business contractors work in the Department of War, and WarU's Cyber Solutions page says 70% of them have fewer than 30 employees. That's a lot of tiny companies facing DFARS clauses, NIST SP 800-171, and CMMC. Paul, what do those companies actually have access to for free?

Paul Netopski

More than most of them realize. Start with WarU, the Warfighting Acquisition University, formerly DAU. Cyber Solutions is built for contracting teams and project managers, but the content helps contractors too. The page describes bite-sized lessons each month on how federal requirements, legislation, and oversight programs interconnect. There are webinars, podcasts, and short videos. My interpretation of this is that it's a free education layer sitting under whatever you decide to buy later.

Roz the Rulemaker

And that translation role matters. Regulation is written in clause numbers. The video titled Following the FAR and DFARS in your Small Business Contract summarizes the cybersecurity clauses for small contractors. The slide deck lists FAR 52.204-21 style basic safeguarding, DFARS 252.204-7012 on safeguarding covered defense information and incident reporting, 7019 and 7020 on assessments, 7021 on the CMMC requirement, and 7024 on SPRS. Someone has to turn that alphabet into plain English, and here an official source does it.

Eric Marquette

Which videos stand out to you?

Paul Netopski

Multifactor Authentication for Today. The page states that 91% of all cyber incidents begin with a phishing email. That's WarU's figure, and it supports what I call the brilliant basics: MFA, logging, patching, phishing defense. Add Reporting DoW Cybersecurity Incidents, which covers what, how, and where to report. Then Where to Begin with NIST SP 800-171, and Protecting Common Types of DoW Controlled Unclassified Information. If your contract provides or generates CUI, you need the categories, types, and markings.

Roz the Rulemaker

There's also a video called Questions to Ask a Cybersecurity Provider, for companies deciding who should support their contract. That's a modest title, but a small shop weighing a managed service provider needs exactly that.

Paul Netopski

Agreed. I'd rather see a vendor walk into that sales call prepared than sign a compliance-in-a-box package. Know the requirement first, then judge the price.

Eric Marquette

And the podcasts?

Roz the Rulemaker

A three part series, Cybersecurity for Contracting, with WarU Professor Kelley Kiernan. Part one covers how cybersecurity depends on the data a contract provides or generates, and five lines of defense for the supply chain. Part two gets into FAR and DFARS, the cyber kill chain, and CMMC. Part three, from Contracting Conversations, covers contracting officers verifying controls and the upcoming CMMC program.

Paul Netopski

For formal training, the WarU slides list three CMMC courses: CYB 1010, Introduction to the CMMC Program, CYB 1020 for practitioners, and CYB 1030 for senior leaders. The slides also list web events, including sessions on CMMC level selection, and one titled It Might Be CUI If. Check events pages for current dates, since those are scheduled sessions.

Eric Marquette

The second piece is ACQuipedia. How does that differ from the videos?

Roz the Rulemaker

It's an online encyclopedia of defense acquisition topics. WarU describes each article as a definition, a brief narrative for context, and links to the most pertinent policy, guidance, tools, and training. So you get the summary and the citation trail together.

Paul Netopski

The CMMC articles are the ones I'd bookmark. CMMC Understanding an SSP. CMMC Operational Plans of Action versus POA&Ms. Understanding CMMC Flow Down Requirements. CMMC Level Determination. CMMC Phased Implementation. Those are the questions I get in assessments. Most small businesses are about 75% documentation and 25% technical controls, so a clear explanation of an SSP is real value, and it's free.

Eric Marquette

Now the Defense Small Business side.

Paul Netopski

The business.defense.gov resources page lists a Best of Small Business Resources collection from OSBP, a marketing to DoD guide, and archived webinars on SAM.gov tools, SBIR and STTR, and facility clearances. Those webinars date from 2020 and 2021, so treat them as background. On the CMMC page, the Office of Industrial Base Growth describes Project Spectrum: a free account at projectspectrum.io, an on demand webinar, and engagement with a Cyber Advisor.

Roz the Rulemaker

That same page carries a July 13, 2026 announcement. The Department of War suspended CMMC Phase II requirements, originally scheduled for November 10, 2026, and begins a comprehensive review. It says Phase I self assessment requirements remain firmly in place. Contractors should read the release and the DoW CIO pages directly, because the review's outcome isn't settled.

Paul Netopski

And the baseline doesn't go away. Self assessments, SPRS entries, MFA, logging. Use the free tools to get those right. That's firsthand testimony, not commentary: the contractor who understands the basics beats the one who bought a binder.