CMMC Uncovered

Secure-Centric

CMMC Uncovered breaks down the real-world challenges behind CMMC, CUI, NIST SP 800-171, and cybersecurity compliance across the Defense Industrial Base. Hosted by Secure-Centric, each episode brings practical conversations with CMMC experts, assessors, contractors, and industry leaders.

  1. 13h ago

    Why CMMC Was Paused: RFI Results With Jason Miller

    Not sure if you have CUI? Schedule your Free CUI Identification Session: https://api.leadconnectorhq.com/widget/booking/eVwMlhdbXuKhKkkYMGa1Get the facts on CMMC certification costs and the reality behind recent DoD RFI results. Learn what the data really shows.Jason Miller from Federal News Network joins us to break down the actual RFI findings regarding CMMC certification. While early reports suggested costs as high as $600,000, the data points to a much lower average cost of $47,000. We examine why these capacity concerns were raised and what the disconnect between the PMO meeting and the actual task force documents means for the defense industrial base.This episode clarifies the current landscape for defense contractors facing NIST 800-171 requirements. We look at why DoD leadership may have had an incomplete picture during critical meetings and how this impacts the broader CMMC rollout. Understanding these documents is essential for anyone navigating the path to compliance.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistListen our podcasts on any of your favourite platform - Apple Podcasts - https://podcasts.apple.com/us/podcast/cmmc-uncovered/id6829819335Spotify Podcasts - https://open.spotify.com/episode/3K6ZgofUMZVubdZYOMWRyz?si=uEzW58CfTLSuLT739InDcQChapters:00:00 Introduction to guest Jason Miller and his CMMC RFI reporting00:43 Jason Miller’s background at Federal News Network01:43 How the RFI summary story came together04:48 Why the documents were not confidential05:34 Motive, sourcing, and DoD’s decision not to comment08:56 Why DoD’s silence matters to the defense industrial base11:35 Cost, burden, and capacity: what the RFI results showed15:02 The PMO meeting and the leadership understanding of CMMC17:55 Why self-attestation hasn’t worked, and the False Claims Act risk20:56 Why low SPRS scores show the need for assessment22:09 Where the task force report goes next23:55 Task force recommendations: a smaller restart and ecosystem risk26:39 Rev 3 and why clearer CUI identification matters27:48 No recommendation to drop third-party assessments29:36 How a reporter handles an RFI that contradicts the story31:52 When will the final report come out32:10 CMMC vs the FAR CUI rule and Rev 2 vs Rev 334:04 Why DoD updates and “brilliant at the basics” matter36:55 What the review is worth for future administrations38:49 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs to understand where the CMMC pause stands.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

  2. Nov 5

    We Reviewed 4 CMMC Contracts Line by Line: Do You Actually Have CUI?

    DFARS 7012 is in your contract, but nobody will tell you what is CUI. CMMC consultant Kelly Hood walks through four mock contracts and shows where to look, who to ask, and how to write your own designation guide.Jake Celler sits down with Kelly Hood, a cybersecurity consultant who helps defense contractors scope CMMC, for a hands-on review of replica contracts. Jake plays the stressed IT leader, Kelly plays the consultant, and they cover what to search for, what the clauses mean, and what to do when the contract doesn’t say what you have to protect. They also open with a few CS5 takeaways and a discussion of a recent article on the CMMC task force.📋 Get our free resourcesThe CMMC Level 1 Readiness Checklist: https://www.secure-centric.com/level1...The CMMC 2.0 Level 2 Compliance Checklist: https://www.secure-centric.com/level2...How to Detect Unmarked CUI: https://www.secure-centric.com/cuitem...This episode is for defense contractors, government contractors, manufacturers, IT leaders, procurement teams, and compliance professionals in the defense industrial base who need to figure out what is and isn’t CUI before they scope CMMC Level 2 or NIST 800-171. Kelly notes she is not a lawyer, so run contract decisions by your counsel. The CS5 and task force discussion is based on rumors and a published article, not confirmed policy.Chapters:00:00 Introduction to guest Kelly Hood and the contract review01:27 CS5 takeaways: Rev 3 and the FAR CUI rule03:39 The task force article and what it says about CMMC next steps07:51 The $600,000 cost claim vs what RFI responses showed10:08 Contract one: setting up the mock review11:13 Finding CUI in a contract: start with the 7012 clause12:54 7012 without 7021: why even janitorial companies see these clauses15:45 Checking attachments and the data requirements list16:33 Distribution statements A through F and what they signal18:23 Asking the contracting officer for a designation guide19:36 No CUI but 7012 in your contract: asking for a contract mod22:47 Contract two: janitorial services and the 7021 clause26:04 Writing your own CUI designation guide31:18 How a designation guide narrows what you protect34:29 Contract three: a bracket assembly and the technical data package36:41 Reading the 7021 fill-in: Level 2 C3PAO vs self-assessment39:13 C3PAO in your contract during the pause: get it in writing40:37 Distribution D and the egg McMuffin example43:09 Manufacturers: COTS vs items created for the government44:05 Contract four: a purchase order with export control and ITAR flags48:00 The 10-day letter saying everything is CUI50:56 When you have CUI but no clause says so53:50 Final advice: ask questions and write it downWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who is trying to find the CUI in their contracts.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsl...LinkedIn: / secure-centric Website: https://www.secure-centric.com/

  3. Oct 29

    What Is Actually CUI? A CUI Expert Explains

    What is actually Controlled Unclassified Information (CUI), and how do you know if your company is handling it?For many defense contractors, identifying CUI is one of the hardest parts of preparing for CMMC Level 2. A document arrives marked CUI, but nobody can clearly explain which information needs protection.In this episode of CMMC Uncovered, Jake Celler sits down with Rachel Bassford, a CUI expert who has worked with NARA, the FBI, and Fortune 500 organizations, to discuss the confusion surrounding CUI identification, markings, and scoping.📋 Get our free resourcesThe CMMC Level 1 Readiness Checklist: https://www.secure-centric.com/level1checklistThe CMMC 2.0 Level 2 Compliance Checklist: https://www.secure-centric.com/level2checklistHow to Detect Unmarked CUI: https://www.secure-centric.com/cuitemplateThis episode is for defense contractors, government contractors, manufacturers, IT leaders, procurement teams, and compliance professionals in the defense industrial base who need to work out what is and isn’t CUI before making scoping and budget decisions. Rachel notes that her answers are not legal advice and should be run by your counsel.Chapters:00:00 Introduction to guest Rachel Bassford and why CUI is the top CMMC question01:17 What is CUI? A plain-English definition03:12 Why the government’s CUI determination never happened08:57 Finding CUI in your contracts beyond DFARS 701214:38 How to narrow CUI scope by ruling out what CUI cannot be21:54 Why unclear CUI marking lets some suppliers look the other way23:16 Poorly marked CUI: what primes and subs can do29:24 Game time: CUI or not CUI36:53 Why “it depends” is the honest answer on CUI40:59 The FAR CUI rule and why the standard form falls short43:22 Why SMBs struggle to resolve CUI without help46:11 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who is trying to figure out what is actually CUI.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

  4. Oct 28

    Inside Boeing’s Supply Chain: The CMMC Pause Isn’t a Pass

    CMMC is paused, but CMMC Level 2 clauses are still showing up in contracts, and primes still want proof of NIST 800-171 compliance from defense contractors. Brett Cox of Boeing explains what suppliers need to show right now.Jake Celler sits down with Brett Cox, who works at Boeing as a CMMC Cybersecurity Program Management Office Principal, to cover his Pentagon meeting with the Honorable Davies, the task force listening sessions, and what he is seeing in contracts during the pause.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, manufacturers, suppliers at every tier, and compliance professionals who need to know what primes expect during the pause. If you hold CUI and wonder whether the pause means you can wait, Brett’s answer is clear: CMMC is still in effect.Note: Brett’s remarks on policy and the pause are his personal perspective.Chapters:00:00 Introduction to guest Brett Cox00:34 Boeing CUI training and supplier summit03:12 Meeting the Honorable Davies at the Pentagon05:47 How the CMMC task force tiers worked07:33 DIB listening sessions and the 60-day question09:38 CUI history and why NIST 800-171 still struggles17:42 February FAR overhaul: 7019, 7020 and FAR 52.204-2122:30 Why 7021 sets a minimum score floor25:43 Are contracts still citing 7021 during the pause29:14 7012 vs 7021: NIST 800-171 is the homework, CMMC is the test33:56 Validating your supply chain before accepting 702135:10 CMMC is still in effect: only phase two was paused38:10 What primes ask for when no C3PAO is required40:51 Is a C3PAO assessment still worth it44:59 How primes help suppliers identify CUI49:20 COTS vs commercial53:12 Getting CUI answers from the government58:22 Is the “find new suppliers” message still in effect1:03:37 Are suppliers leaving the DIB1:08:27 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who supplies a prime.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

  5. Oct 28

    DOW Director of CMMC(Former) on Pause, Rulemaking & The FAR CUI Rule

    CMMC is paused, but NIST 800-171, DFARS 7012, and False Claims Act exposure are not. Buddy Dees, who just retired after 38 years with the DoD and worked on CMMC from the start, explains what the deviation does and doesn’t change for defense contractors.Jake Celler sits down with Buddy Dees, a recently retired member of the DoW CIO’s CMMC program office, nine days into retirement. They cover CMMC’s start-stop history, why rulemaking takes so long, and what the pause means for contractors handling CUI.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, C3PAOs, MSPs, and compliance professionals in the defense industrial base who need a clear view of what the pause means for CMMC and NIST 800-171 obligations. If your company handles CUI and is deciding what to do now, this is a firsthand explanation.Note: Buddy’s remarks on policy direction and the current administration are his personal perspective, not official DoD positions.Chapters:00:00 Introduction to guest Buddy Dees01:41 The mission behind the CMMC PMO flak vest06:27 Did CMMC create a culture shift in the DIB08:58 How CMMC raised awareness of DFARS 701211:56 What CMMC 3.0 and the Rev 3 amendment looked like15:40 Why OT was deferred to phase two17:48 Can the CIO change CMMC without rulemaking23:58 How much an interim final rule really saves26:27 The rulemaking clock and the end of an administration29:50 What the Rev 3 deviation actually does33:27 Can the DoW deviate 7012 and NIST 800-17138:08 False claims and DIBCAC assessments still apply41:15 Who decides which CMMC level goes in a contract48:33 FAR CUI rule: Rev 2 vs Rev 3 explained59:45 How the FAR CUI standard form could fix CUI marking1:05:15 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs to understand the pause.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

  6. Oct 28

    DoD's Former DIB Cyber Chief Breaks Down CMMC

    A welder had the entire structural design of the F-22 open on his laptop, Facebook Messenger flashing right next to it, and no idea why that mattered. Stacy Bostjanick says that moment is exactly why CMMC had to exist. She spent 37 years in federal government, led CMMC through two full rulemaking processes as DoD's Chief, Defense Industrial Base Cybersecurity, and walks through the real history behind the program most people only know through headlines.Jake Celler sits down with Stacy Bostjanick, who recently retired after nearly four decades in federal service, to trace CMMC's full history from the original 2013 DFARS clause through two rulemaking processes, a change in administration, and the current pause.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, C3PAOs, compliance professionals, and anyone in the defense industrial base trying to understand how CMMC actually came to exist and where the rulemaking process could take it next. If you want the real history behind the headlines, this conversation lays it out in detail.Chapters:00:00 Introduction to guest Stacy Bostjanick00:30 Stacy's 37-year career in federal government01:40 CMMC's origins in the 2013 DFARS clause04:24 Why 800-171 was seen as a win compared to 800-5305:37 The DoD IG findings that led to DCMA DIBCAC08:59 The welder story: full F-22 access on a laptop11:30 Rulemaking, OMB desk officers, and who really holds the power17:38 Inside the two-year formal rulemaking process19:06 Over 2,000 public comments, adjudicated line by line24:23 Why the industry calls this "Groundhog Day"25:38 Whether the current pause follows the Procedures Act29:50 Why companies think the pause means nobody is checking30:02 Phase One was not suspended: the 88/110 requirement explained33:41 Why CMMC never got to operational technology37:15 The rise in whistleblower activity around DFARS contracts38:18 Can the Department of War change contract clauses at will40:11 What happens when the FAR CUI rule reaches revision three42:01 How much Washington actually prioritizes data confidentiality44:11 Stacy's reflection on her legacy and the program's future48:21 The real risk: losing the assessor ecosystem before a decision is madeWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs the real history behind CMMC.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

  7. Oct 28

    How A Prime Achieved A Perfect CMMC Level 2 Assessment

    CMMC Level 2 compliance is not a one-time project, and one prime's internal assessment fail came down to people not doing what the con ops said they would. Anne-Marie Castrigno led NIST 800-171 at a billion-dollar defense contractor and explains how she got to a perfect external Level 2 assessment.Jake Celler sits down with Anne-Marie Castrigno, a defense industrial base leader with over 24 years of experience who started as a sysadmin and worked her way up to leading technology and NIST 800-171 at a large prime. This conversation covers how IT leaders can win funding, build a security culture, scope before buying, and keep CMMC compliance running after the assessment.This episode is for IT leaders, CIOs, defense contractors, government contractors, manufacturers, and compliance professionals in the defense industrial base working toward CMMC Level 2 and NIST 800-171 compliance. If you are deciding what to buy, what to build, and how to sustain compliance, this is a practical view from someone who has done it inside a prime.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistChapters:00:00 Introduction to guest Anne-Marie Castrigno00:48 Career advice: talking risk and revenue like a CFO04:04 Building a security culture and compliance operating model06:30 Shifting from engineering language to business language11:04 What slows NIST 800-171 progress: culture and awareness15:03 Tactical approach: walking the factory floor17:27 How compliance uncovers operational efficiencies19:16 Why IT leaders buy tools before defining scope23:10 GCC High vs lower-cost CUI solutions for manufacturers26:33 Why clean data makes future migrations easier28:52 Maintaining CMMC Level 2 compliance after assessment32:28 Patching in manufacturing: automation vs white-glove support35:25 Final advice: think about today and the futureWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who is working toward CMMC Level 2.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

  8. Oct 28

    Katie Arrington on CMMC, the Pause & the DIB's Future

    Katie Arrington (Former DOW CIO) helped create CMMC after a senator told her the DIB was leaking hundreds of billions in R&D to adversaries, and she says pausing it until 2028 puts national security at risk. In her most candid interview yet, she explains why she believes the current pause contradicts the Department of War's own stated priorities.Jake Celler sits down with Katie Arrington, former DoD CIO and the driving force behind CMMC, for an unusually personal and direct conversation covering her background, why CMMC exists, and her view on the current pause in third-party assessments.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, C3PAOs, compliance professionals, and anyone in the defense industrial base trying to understand the reasoning behind CMMC and the debate surrounding the current pause. Please note that portions of this conversation reflect Katie Arrington's personal opinions on the current pause and Department of War leadership, not confirmed facts, and some content in this episode touches on a serious personal experience involving loss of life.📬 Stay ahead of every CMMC update: subscribe to our newsletter: https://secure-centricorg.com/scnewsletterChapters:00:00 Introduction to guest Katie Arrington01:17 The personal experience that shaped Katie's view of cybersecurity07:35 Why Katie pushes back on the "CMMC is too expensive" argument09:32 Cyber risk in the age of AI and quantum computing14:10 How CMMC originated from a Senate hearing with Senator Rounds16:38 Assurance, accountability, and the DFARS 7012 self-attestation gap20:19 Katie's reaction to the pause being extended to 202825:07 Whether a corporate background limits understanding of DoD rulemaking29:17 The Paperwork Reduction Act, the Procedures Act, and how CMMC became law31:16 Momentum lost since the July pause began38:49 Crediting the people behind CMMC beyond Katie herself40:07 How Katie's public tone shifted over the course of the pause45:09 Why removing CMMC increases risk for manufacturers48:16 Comparing breach notification timelines between the US and China53:05 Katie's personal reflection on responsibility and the cost of inaction59:15 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs to understand where CMMC came from and what's at stake in the current pause.Follow Secure-Centric for future CMMC episodes:LinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

See All (15)

About

CMMC Uncovered breaks down the real-world challenges behind CMMC, CUI, NIST SP 800-171, and cybersecurity compliance across the Defense Industrial Base. Hosted by Secure-Centric, each episode brings practical conversations with CMMC experts, assessors, contractors, and industry leaders.

Information

  • Creator
    Secure-Centric
  • Years Active
    2026
  • Episodes
    15
  • Rating
    Clean
  • Copyright
    © Secure-Centric
  • Show Website
    CMMC Uncovered