CMMC Compliance Guide

10/02/2026

Shared shop floor logins. Template policies for a company that doesn't exist. Manually "reviewing the logs." These are the mistakes that quietly fail an assessment, and most shops don't realize they're doing them.

New episode covers the 10 questions defense suppliers ask us more than any other:

🔑 Do you still need to worry about CMMC right now? (Yes. The certification requirement is paused. The compliance requirement never was)
🔑 How do you actually know if you're Level 1 or Level 2? (Check your contract for DFARS clauses, then ask your prime what's actually CUI)
🔑 Can your IT provider just handle all of it? (They can handle a lot. They can't authorize on your behalf, and "we do compliance too" doesn't mean they understand CMMC)
🔑 Why does a shared shop floor login fail an assessment on the spot? (CUI access requires an identified individual, not a shared account)
🔑 Can you buy a tool or download a template package and call it done? (No, and most templates are written for one tool, not your actual environment)
🔑 What are assessors really looking for first? (Not the control statement. The assessment objective, and whether your SSP actually tells your story instead of just restating the control)

The bigger theme: documentation is where most companies who've done real security work still fall short. Good technical controls without the paperwork to prove ongoing management still fails.

👉 Full episode out now: https://youtu.be/577c96GTlP4

Which of these trips up your shop the most: scoping, shared accounts, or documentation? Curious where people are getting stuck.

These are the 10 questions Stacey and Brooke hear more than any oth...

09/10/2026

We're a day or so out from the DoD's update on CMMC Phase 2. So, Austin and Brooke used this episode to answer the questions that keep coming up before that deadline hits.

💡 What's actually paused right now, and what isn't? (Phase 2 certification requirements are paused. Your obligation to protect FCI and CUI under Phase 1 is not, and never has been)
💡 Can you just skip certification and self-attest forever? (Only if you're willing to lose out on contracts that require it)
💡 What's actually required to close out a POA&M? (180 days, a score of at least 88, and zero of the hardest-weighted items on it)
💡 Is there really an assessor shortage? (No. Brooke breaks down why that claim doesn't hold up against the actual numbers)
💡 What determines whether you're Level 1, 2, or 3? (It comes down to whether you handle FCI or CUI, not company size)
💡 What does it actually take to be "assessment ready"? (Hint: it's a lot more than an SSP and a POA&M)

The bigger point: a lot of people are treating CMMC like one checklist. It's actually four phases, three levels, and hundreds of assessment objectives, and understanding where you actually stand starts with reading the assessment guide, not guessing.

👉 Full episode out now: https://youtu.be/EyCReOQHem8

Are you checking your contracts for DFARS 7012 language, or waiting to be told? Curious how people are approaching this before the update drops.

What does CMMC Level 2 actually require, and how does it connect to...

08/28/2026

"We cover 90 out of 110 controls." Every CMMC vendor says some version of this. Almost none of them are lying, and almost none of them mean what you think.

New episode breaks down what vendor coverage claims actually mean:

🔍 What's the real difference between "maps to," "satisfies," and "supports" a control? (They're not interchangeable, and the wording matters more than you'd think)
🔍 If Vendor A covers 40 controls and Vendor B covers 50, do you get to 90? (No. Coverage doesn't stack the way people assume)
🔍 Does downloading CUI to your computer for "just a few seconds" before moving it to a compliant enclave keep that computer out of scope? (No. There's no time threshold that saves you)
🔍 What if you never download it, just transmit it straight from a customer portal into a FedRAMP vendor? (Still in scope. It touched your network either way)
🔍 What questions should you actually ask a vendor before buying their compliance solution? (Brooke gives a specific list)

The core message: vendors solve their piece of the puzzle, not your whole environment. You still own the last mile, and no product replaces understanding your own data flow first.

👉 Full episode out now: https://youtu.be/XdHp-2su_Ks

Have you run into a vendor's coverage claim that didn't hold up once you looked at the fine print? Drop it below.

Every CMMC vendor says the same thing: "we cover 80 out of 110 cont...

08/21/2026

"Just treat everything as CUI" feels safe. It's actually one of the most expensive mistakes a contractor can make.

New episode breaks down what scoping mistakes actually cost, on both sides:

🔍 Is the "six figure scoping mistake" real or just marketing? (Depends on size and complexity, but yes, it's real)
🔍 What's the most common overscoping trap? (Primes who won't tell you what's actually CUI, so you're stuck treating everything as CUI)
🔍 What actually happens if you underscope and get caught? (A failed assessment is the cheap outcome. A whistleblower discovering it after certification is the expensive one)
🔍 Has scoping actually been the legal basis for a False Claims Act case? (Yes, and Brooke names a specific one)
🔍 What do most companies get wrong about downloaded CUI? (Once you download it, that device is in scope, period, even if you delete it after)
🔍 When does an enclave actually reduce your scope, and when does it just create a false sense of security?

The core message: scoping isn't a compliance formality. Get it wrong in either direction and it shows up later as either a wasted six-figure budget or a legal problem.

👉 Full episode out now: https://youtu.be/g3geyo2b030

Which mistake do you see more often in your world, over scoping or under scoping? Curious what people are running into.

Is the "six-figure CMMC scoping mistake" a real number, or just som...

08/19/2026

🎉 We’re excited to announce the winner of our Milwaukee Cordless Combo Kit giveaway!

Congratulations to Omar Gonzalez of West Coast Inc. for winning our Milwaukee M18 18-Volt Cordless 5-Tool Combo Kit.

Thank you to everyone who participated and connected with us during the show. We appreciate the opportunity to meet with so many great professionals and organizations.

Please join us in congratulating Omar on his win!

08/14/2026

We got our own CMMC Level 2 certification a couple days after the pause was announced. We know exactly how expensive and how real this process is, because we just went through it ourselves.

New episode is a full CMMC checklist: what the 60-day pause actually changed, and what it didn't.

❓ What did the July memo actually pause? (Just the certification requirement on contracts. Not FCI/CUI protection, not DFARS 7012, not your existing obligations)
❓ Does a pause on Phase 2 affect Phase 3 or 4? (No, and here's the rollout timeline)
❓ What does CMMC Level 1 actually require? (More than most people think, and there's no room for a POA&M)
❓ What's the #1 reason assessments fail? (It's not the technical controls)
❓ Why does scoping come before everything else? (Skip it and you'll spend money solving the wrong problem)
❓ What do you actually need from your MSP or cloud vendor's compliance documentation?

The short version: the certification deadline moved. The requirement to protect CUI and FCI didn't.

🎧 Full episode out now: https://youtu.be/4Ban5DkhOwI

If you've got a mock or certification assessment already scheduled, are you keeping it during the pause? Curious how people are handling this.

This is the all-in-one CMMC checklist episode. Austin and Brooke pu...

08/01/2026

Big shoutout to our Technician of the Month, Jeff! He keeps things running smoothly behind the scenes.

Your hard work doesn’t just fix problems, it prevents them.

We appreciate you Jeff! 👏

07/31/2026

The CyberAB held their June town hall a little before CMMC Phase 2 got paused. So, a lot of what they said needs a second look.

Brooke pulled the five things every contractor needs to know from it:

❓ Is False Claims Act enforcement actually happening? (Yes, and almost all of it starts with whistleblowers, not audits)
❓ If you only handle paper CUI, are you off the hook for CMMC Level 2 controls? (Mostly, until you scan or photograph it)
❓ Did the November 10th pause actually change your obligations? (No. DFARS 252.204-7012 is still in effect, and so is the requirement to protect CUI and FCI)
❓ What changed in the FAR CUI rule? (The mislabeled-CUI reporting window got a lot more workable)
❓ How do you actually pick the right C3PAO? (It's more than price and scheduling)

The bigger theme: pausing certification requirements on contracts didn't pause the underlying compliance obligation. That's been true since November 2023, and it's still true now.

🎧 Full episode live now: https://youtu.be/jwDEIQ3q-f8

If you've got an assessment already scheduled, are you keeping it or holding off during the 60-day window? Curious how people are approaching this.

We're recapping the Cyber AB's June 2026 Town Hall, five topics eve...

07/17/2026

CMMC Phase 2 was just paused. Here's what that does and doesn't mean for your business.

If you've seen the headlines, you've probably also seen the panic.

"CMMC is dead."
"You don't have to worry about it anymore."

Neither of those is true.

Brooke breaks down what actually happened in this episode:
❓ What did the DoD actually pause, and what stayed in effect?
❓ Does this mean self-assessments get less scrutiny? (Brooke thinks the opposite)
❓ Is the "capacity problem" the DoD cited even real? (Brooke pushes back hard on this one)
❓ Has anything like this happened before? (Yes, and it's a useful precedent)
❓ What should you actually do this week if you're mid-remediation?

The short version: this isn't a green light to stop. It's a 60-day window, and the DoD has paused this program before and never scrapped the underlying requirements.

🎧 Full episode live: https://youtu.be/WLxmruqfmxk

Are you pausing your compliance work, or pushing through the 60-day window? Curious where people land on this.

The Department of War's pause on CMMC Phase 2 sparked a wave of pan...

07/15/2026

🚨 We dropped an emergency podcast episode

CMMC Phase 2's third-party certification requirement is paused for 60 days. Austin recorded his take within hours: what changed, what didn't, and why he's telling clients to stay the course.

Spoiler: your CMMC may have just gotten cheaper. Your responsibility didn't.

🎥 Watch it here: https://youtu.be/euQwozpUqaU

What's your read on the pause? Good news, or too soon to celebrate?