CMMC Compliance Guide

CMMC Compliance Guide
  • 0.0 (0)
  • Technology
  • Updated Weekly

Our experiences inspired the creation of The CMMC Compliance Guide Podcast and its accompanying resources. The podcast began as a way to share what we learned through real-world challenges—like helping that aerospace machine shop—and to provide accessible education for businesses navigating DoD cybersecurity requirements. The CMMC Compliance Guide Podcast breaks down complex topics like NIST 800-171 and CMMC into actionable, easy-to-understand steps. Whether you’re a subcontractor struggling to meet compliance deadlines or a business owner looking to secure your supply chain, the guide offers practical advice to help you take control of your cybersecurity journey.

  1. 2d ago

    CMMC Phase 2 Paused: Why the DoD's Reasoning Doesn't Add Up, and What to Expect After the 60-Day Review

    Submit any questions you would like answered on the podcast! The Department of War's pause on CMMC Phase 2 sparked a wave of panic, and a wave of misinformation right behind it. In this episode, Stacey and Brooke go deeper than the headline: what the pause actually changes, why the stated justification (cost, assessor capacity) doesn't hold up against the numbers, and what's realistically likely to come out of the 60-day review. In this episode: What "Phase 2 is paused" actually means (it's the third-party certification requirement on new contracts, not your obligation to be compliant)The biggest misconception floating around: "CMMC is suspended" vs. what's actually trueWhy the capacity argument (claims of "only 100 assessors") doesn't match reality (there are over 1,000 CCAs)Why the cost argument conflates "cost of certification" with "cost of actually being compliant," which have always been expensiveWhy self-assessments may face MORE scrutiny, not less, while third-party validation is pausedHistorical precedent: every incoming DoD/DoW CIO has paused and retooled this program since 2021, and it's never been canceledWhat to actually do this week if you're mid-remediation, mid-contract, or have a mock or certification assessment already scheduledThe open RFI (Request for Information) the DoD posted, and why submitting a response mattersJustice IT Consulting's own CMMC Level 2 certification newsThe mark-your-calendar date: September 14th is when the 60-day window closes and we should learn more about what comes next.  Read the actual DoD memo here: https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902  Submit your own response to the DoD's RFI here: https://sam.gov/workspace/contract/opp/89ef9bfb0834473791e991c712698d94/view

  2. 4d ago

    CMMC Phase 2 Certification Paused for 60 Days: What the DoD Memo Really Changes (and What It Doesn't)

    Submit any questions you would like answered on the podcast! Here are the actual memos (Definitely worth a read):   https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdfThe Department of War just paused the rollout of CMMC Phase 2's third-party certification requirement for 60 days. Austin breaks down what the memo actually says, what it doesn't say, and why "certification is paused" is not the same thing as "compliance is paused." In this episode: What the 60-day pause on CMMC Phase 2 actually covers (hint: it's the certification verification process, not the underlying NIST 800-171 requirements)Why this could ultimately make your path to CMMC less expensive, and why that's not a reason to slow downWhy contractors who are already deep into implementation are in the strongest position no matter which direction this goesWhy assuming "compliance has disappeared" is the riskiest read of this newsWhat happens if third-party certification gets replaced with a stronger self-attestation or spot-check model, and why unsupported SPRS scores are already a liabilityA trade show story about a Department of War investigator actively pursuing ITAR fraud leads, and what that says about enforcement appetite right nowWhat to actually do in the next 60 days while DoD figures out the future of the verification model

  3. Jul 10

    CMMC for Small Aerospace Suppliers: Real Costs, DIY Limits, Level 1 vs 2, and the November 2026 Deadline

    Submit any questions you would like answered on the podcast! Small aerospace suppliers are getting hit with the same CMMC questions over and over: what do I actually need to do if my contract requirements aren't clear yet, does redacting a drawing get it out of CUI territory, will a tool like ThreatLocker or Prevail make me compliant, and what is this actually going to cost. In this episode, Stacey and Brooke from Justice IT Consulting go through the real answers small manufacturers, machine shops, and engineering firms need before the November 10, 2026 DFARS CMMC requirement hits new DOD contracts. Topics covered: Why you can't fully plan compliance without knowing FCI vs. CUI exposure, and what that means for your Microsoft 365 environment (GCC vs. GCC High)Why redacting a customer name or contract number from a drawing does NOT remove CUI statusWhy compliance tools alone (ThreatLocker, Prevail, etc.) can't get you certifiedRealistic cost ranges for CMMC Level 2 certification, and why "$5,000" and "$20,000" quotes are misleadingHow far a small company can actually get doing CMMC in-house, including where AI-generated policies fall shortWhether to start at Level 1 and move up later, or go straight to Level 2What changes for new DOD contracts after November 10, 2026How to get an honest readiness check with a gaps assessment before spending moneyWe're also co-hosting a free live webinar with FutureFeed and Preveil on shared responsibility in CMMC assessments, covering how to read a customer responsibility matrix and close gaps before they become assessment findings. Tuesday, July 21st at 12 PM Central.  Register (free, recording sent to all registrants): cmmccomplianceguide.com/podcast

  4. Jul 3

    Cyber AB May 2026 Town Hall Recap: External Service Providers, Marketplace 2.0, New Leadership & OSC Accountability Explained

    Submit any questions you would like answered on the podcast! The Cyber AB's May 2026 Town Hall packed in major updates and if you work with an MSP, use cloud services, or are trying to figure out where your compliance responsibility actually ends, this episode is required listening. Brooke and Stacey break down everything contractors need to know: ESP vs. CSP distinctions, FedRAMP changes, new leadership, Marketplace 2.0, and the single biggest takeaway every OSC needs to hear. 📌 What You'll Learn: What the new joint venture FAQ clarifies — and what actually changes (hint: less than you think)The status of the official CMMC certification badge and what you can display right nowHow FedRAMP 20X is changing authorization language — and why DoD's "moderate equivalency" standard isn't movingThe three questions every OSC must answer about their ESPHow to tell the difference between an MSP and a CSP — in plain EnglishThe 5 NIST 800-145 criteria that determine whether a service counts as cloud computingCyber AB ecosystem updates: monthly RPO meetings launching in July and Marketplace 2.0 previewThe biggest takeaway from the town hall — and why the burden always lands on the OSCWebinar Announcement: Whose Control Is It Anyway? — free live event July 21st at 12 p.m. CT - Sign up by clicking HERE

  5. Jun 19

    New CMMC FAQ Clarifications: Joint Ventures, Paper-Only CUI, Reassessment Triggers & Where MSPs Actually Fit in Scope

    Submit any questions you would like answered on the podcast! The Department of Defense just updated its CMMC FAQ document — and the clarifications inside answer some of the most common (and costly) assumptions contractors make. In this episode, Brooke and Stacey break down what changed for joint ventures, paper-only CUI, significant change triggers, and how MSPs and MSSPs actually fit into assessment scope. If you're navigating a merger, working with subcontractors, or relying on an MSP to manage your environment, this episode clears up exactly where you stand — and where you don't. 📌 What You'll Learn: Why joint ventures do NOT automatically inherit a company's CMMC certification statusThe new guidance on paper-only CUI — and when it does NOT require Level 2 assessmentWhat actually counts as a "significant change" that triggers reassessment (mergers, system consolidation, and more)Why MSPs don't need their own CMMC certification — but still carry major assessment responsibilitiesThe difference between CUI scope and Security Protection Data (SPD) scope for MSPs/MSSPsThe five-part test for whether an MSP counts as a Cloud Service Provider (CSP)Listener Q&A: Do subcontractors need cybersecurity training and screening too?

  6. Jun 12

    The CMMC Reality Check: Gap Assessments, Documentation Overload & Why 30-Day Compliance Claims Are a Red Flag

    Submit any questions you would like answered on the podcast! Most defense contractors don't realize how complex CMMC compliance really is until they're already in trouble. In this episode, Brooke and Stacey break down the exact moments where contractors hit their wake-up call, what to expect from a gap assessment, and why waiting until the last minute could cost you your DoD contracts. Whether you're just starting your CMMC journey or think you're close to ready, this episode will show you what you're probably missing and how to get ahead of it.

  7. May 29

    CS5 West 2026 CMMC Recap for Defense Contractor

    Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, Brooke breaks down the biggest takeaways from CS5 West 2026, one of the largest conferences in the CMMC ecosystem. The biggest message from the conference was clear: CMMC is no longer theoretical. Assessments are happening now, companies are already getting certified, and many contractors are running out of time to prepare before Phase 2 requirements begin appearing on contracts. We discuss what assessors are seeing during mock and certification assessments, why documentation continues to be one of the biggest failure points, and why scoping mistakes are still creating major problems for manufacturers and defense contractors. We also cover:  Why small contractors are struggling with implementation  How primes are pressuring subcontractors to get certified early  Why enclave strategies are often misunderstood  The ongoing debate around G-code and CUI  Why continuous compliance matters after certification  The importance of mock assessments  How False Claims Act risk ties into annual affirmations If you are a defense contractor trying to understand where CMMC enforcement is heading and what the industry is seeing right now, this episode gives you a practical, real-world update from inside the ecosystem.

  8. May 22

    How Small Defense Contractors Can Handle CMMC Compliance

    Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, we tackle one of the biggest challenges in the Defense Industrial Base: how small contractors without internal IT teams are realistically handling CMMC compliance. Many small manufacturers, machine shops, and defense suppliers feel overwhelmed by CMMC because they do not have dedicated cybersecurity, compliance, or IT security staff. Instead, employees wear multiple hats while trying to keep daily operations moving. We break down what compliance actually looks like for smaller contractors, what can realistically be outsourced, what responsibilities still stay with the company, and why buying tools like Microsoft 365 GCC High does not automatically make you compliant. We also explain why data flow mapping and scope are critical, how shared responsibility matrices work with MSPs and MSSPs, and the biggest mistakes smaller companies make when trying to shortcut compliance. If you are a small or mid-sized defense contractor trying to understand how to approach CMMC without a massive budget or internal compliance department, this episode will help you build a realistic roadmap.

See All (66)

About

Our experiences inspired the creation of The CMMC Compliance Guide Podcast and its accompanying resources. The podcast began as a way to share what we learned through real-world challenges—like helping that aerospace machine shop—and to provide accessible education for businesses navigating DoD cybersecurity requirements. The CMMC Compliance Guide Podcast breaks down complex topics like NIST 800-171 and CMMC into actionable, easy-to-understand steps. Whether you’re a subcontractor struggling to meet compliance deadlines or a business owner looking to secure your supply chain, the guide offers practical advice to help you take control of your cybersecurity journey.

Information

  • Creator
    CMMC Compliance Guide
  • Years Active
    2024 - 2026
  • Episodes
    66
  • Rating
    Clean
  • Copyright
    © 2026 CMMC Compliance Guide
  • Show Website
    CMMC Compliance Guide

You Might Also Like