Practitioner guides to CMMC, DFARS 252.204-7012, the ITAR, OFAC sanctions screening, adverse media, and sanctions screening in education. Each paper cites its primary sources and shows the date it was last reviewed against them and against SecurePoint's product as it stood that day.
6 papersLatest review Web and PDFNo registration
Defense industrial base and export controls
Physical-access evidence for CMMC and DFARS 252.204-7012, and foreign-person access under the ITAR.
Physical Protection Requirements and the Evidence Behind Them
A practitioner guide to the CMMC Level 2 Physical Protection (PE) requirements that govern visitor management, quoted as NIST states them. Includes a requirement-by-requirement mapping, which requirements a POA&M cannot hold, and where the program stands after the July 2026 suspension of CMMC Phase 2.
Meeting 22 CFR 120-130 Foreign National Requirements
How defense contractors can implement systematic visitor screening workflows that align with ITAR foreign national access requirements. Covers Technology Control Plans, the deemed-export concept, common failure points, DDTC enforcement through 2026, and a 60-day implementation roadmap.
Building Defensible Visitor Evidence for DoD Assessments
How to build visitor management records that support DFARS 252.204-7012 and the NIST SP 800-171 assessments behind it. Covers who assesses what (DIBCAC, CMMC, and DCSA for cleared facilities), evidence pack composition, append-only audit trails, and retention by regime.
SDN, Entity List & Multi-List Screening for Visitor Management
A practitioner guide to multi-list sanctions screening. Covers government source coverage, fuzzy-match algorithms, the OFAC 50% ownership rule, adjudication workflows, and how to build defensible screening evidence for OFAC reviews.
AI-Assisted Discovery, PEP Context & Enforcement Intelligence
How to build an adverse media screening program that surfaces compliance-relevant findings before formal sanctions designation. Covers government enforcement sources (DOJ, SEC, FinCEN, FCA), AI-assisted triage, PEP context, source-credibility scoring, and roster-based monitoring.
Why sanctions screening, payment-chain review, and audit-ready documentation are no longer optional campus controls. Covers the OFAC IMG Academy settlement, Section 117 foreign funding disclosures, why a payment processor's own screening is not the institution's, the compliance failures that recur in education, and a 90-day action plan for school leaders.
Updated for the July 13, 2026 suspension of CMMC Phase 2 and Class Deviation 2026-O0025. Corrected POA&M eligibility: five of the six Physical Protection requirements cannot be placed on a POA&M, not three. Quoted each requirement as NIST states it, replaced an outdated ITAR civil penalty figure, distinguished award ineligibility from debarment, added False Claims Act settlements, and narrowed product statements to what SecurePoint records.
Re-checked the IMG Academy settlement and the Section 117 figures against OFAC and the Department of Education, and quoted OFAC's starting-point advice on whom to screen. Limited Section 117 to the colleges and universities it covers, corrected the vendor descriptions against Blackbaud's and Flywire's own materials, stated OFAC's ten-year record period, and described re-screening as the 30- or 90-day schedule the product runs.
Updated the ITAR § 126.1 country examples (Syria came off the list on October 1, 2026; China, Venezuela, and Burma are now named) and added the 2024 and 2026 DDTC consent agreements with Boeing, GE Aerospace, and BAE Systems. Corrected the citations for escorts, zone separation, and records, where SecurePoint captures U.S.-person status, and when check-in screens a visitor again.
Renamed the UK source to the UK Sanctions List, the only UK source since OFSI closed its Consolidated List on January 28, 2026, and corrected the EU list's name to the Financial Sanctions Files. Added OFAC's October 2026 Bank of America settlement, which turned on watchlist updates and alert priority, and replaced an unsourced transliteration figure with examples.
Corrected who assesses what: DCMA's DIBCAC conducts NIST SP 800-171 assessments (under DFARS 252.204-7019 and 252.204-7020, or clause 252.240-7997 in new actions since February 2026), and DCSA reviews cleared facilities under the NISPOM and does not assess CUI. Added NIST SP 800-171 3.3.8 for audit-log protection, replaced a single ten-year retention figure with each regime's own period, corrected what an unauthorized ITAR release requires, and updated for the CMMC Phase 2 suspension. Narrowed product statements: audit alerts reach SecurePoint's operations team rather than your organization, physical-access records come in the CMMC_PE_VISITOR pack, and SecurePoint staff run the account-isolation check.
Re-checked the FATF, FinCEN, DOJ, SEC, and FCA references (FATF Recommendation 12 is unchanged in the June 2026 update) and replaced stale source links. Removed unsourced timing and volume statements, and an FBI dataset the paper could not confirm is still published.
How these papers are maintained
Primary sources, cited
Each paper lists the regulations, agency guidance and enforcement releases it relies on, with links, at the foot of the page and in the PDF appendix.
A stated review date
Each paper shows the date it was last checked against those sources. Where a rule's status has changed or is changing, the paper says so and points to the issuing agency.
Product statements held to the product
Where a paper describes SecurePoint, it describes what the product did on the paper's review date, names the controls that stay with your organization, and claims no certification.
Not legal advice
The papers are written to support your counsel, Facility Security Officer, empowered official or assessor. They do not replace any of them.
Working session
Map a paper to your own facilities
Bring the paper that matches your program. We will walk through the records SecurePoint keeps for each control it supports, and where your own controls take over.
