TechnologyGovernmentEducationSelf-Improvement

CMMC Compliance Guide

Our experiences inspired the creation of The CMMC Compliance Guide Podcast and its accompanying resources. The podcast began as a way to share what we learned through real-world challenges—like helping that aerospace machine shop—and to provide accessible education for businesses navigating DoD cybersecurity requirements.

The CMMC Compliance Guide Podcast breaks down complex topics like NIST 800-171 and CMMC into actionable, easy-to-understand steps. Whether you’re a subcontractor struggling to meet compliance deadlines or a business owner looking to secure your supply chain, the guide offers practical advice to help you take control of your cybersecurity journey.

Play

Open in

20 episodes
Avg 37 min
English

Episodes 20

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

#73
October 2 · 51 min
The 10 CMMC Questions Defense Suppliers Ask Us Most: A Self-Check for Your Compliance Program
Submit any questions you would like answered on the podcast! These are the 10 questions Stacey and Brooke hear more than any other from defense suppliers, and most companies get at least half of them wrong without realizing it. If you've ever wondered whether your setup would actually hold up to a close look, this episode is your self-check. In this episode: Do you actually need to worry about CMMC right now, with the certification requirement on contracts still paused? How to actually figure out whether you're Level 1 or Level 2 (and why you should push back on vague answers about what counts as CUI) What "compliant" actually looks like day to day, not just the technical controls, but the ongoing documentation and change management behind them Why "our IT provider handles all of it" is rarely true, and the specific questions to ask them (CRM/SRM, CCP, RP, CCA credentials) Why companies with mature cybersecurity programs often still fail on documentation, even when their technical controls are solid The biggest real-world mistakes: shared shop-floor logins that fail CUI access requirements, misunderstanding what the controls actually mean, and manually "reviewing logs" instead of using a SIEM What an assessor actually checks first (hint: it's your scope definition, not your tools) Why buying a compliance tool or downloading a template package doesn't mean you're done, and what you actually have to prove objective by objective How to implement all of this without grinding operations to a halt Where most companies actually land when they get an honest gap assessment
- Transcript
- Chapters
#72
September 25 · 54 min
SPRS Scoring Explained in Plain English: How the 110-to-Negative-203 Scale Works and How to Fix a Bad Score
Submit any questions you would like answered on the podcast! Your SPRS score can quietly decide whether your company is even eligible to bid on a DoD contract, and defense contractors have already paid millions in False Claims Act settlements for getting that number wrong. Austin and Brooke break down exactly how SPRS scoring works, what score you actually need, and how to make sure your number is accurate before a government audit finds you. In this episode: What SPRS (Supplier Performance Risk System) actually is, and why it's the DoD's authoritative source for your compliance status How the scoring math really works: starting at 110, deducting 5, 3, or 1 points per missed control, and how you can end up as low as negative 203 Why missing just a couple of five-point controls can put your score under 100 fast, and why negative 50 to negative 70 scores are common in real gap assessments The one control (3.12.4, your SSP) that can single-handedly tank your entire assessment if it's incomplete Why an 88 is the minimum score to bid on a contract, and what that means for your POA&M The six-month clock: what happens if you report a POA&M and don't close it out in time Why misrepresentation, not the underlying gap itself, is what actually triggers False Claims Act exposure The 2026 timeline of changes: the February class deviation, the July 16th revision that formalized the Phase 2 pause, and the September 3rd update Who can actually see your SPRS score (hint: it's not primes, and it's not your competitors) How to actually register and submit a score: getting a CAGE code through SAM.gov and navigating PIEE
- Transcript
- Chapters
#71
September 11 · 58 min
CMMC Level 2 Explained in Plain English: Phases, POA&M Rules, Assessments, and What Level You Actually Need
Submit any questions you would like answered on the podcast! What does CMMC Level 2 actually require, and how does it connect to the four-phase rollout, the POA&M process, and the assessment you'll eventually go through? Austin and Brooke break down Level 2 in plain English, a few days ahead of the DoD's September update on the Phase 2 pause. In this episode: Where things stand with the Phase 2 pause right now, and what's not paused (your obligation to be compliant with NIST 800-171 R2) Why "just give me the CMMC checklist" doesn't work, and what CMMC actually is (a collection of DFARS rules built on NIST 800-171) The four-phase rollout explained: what phase you're actually in, what's paused, and what flows down regardless of the pause What CMMC Level 2 requires: 110 controls, 320 assessment objectives, and the "CMMC overlay" on top of NIST 800-171 POA&M rules explained: the 180-day clock, the minimum 88 score, and which controls can never go on a POA&M What "ready for assessment" actually means (hint: it's a lot more than an SSP and a POA&M, often 400+ documents and artifacts) Self-assessment vs. C3PAO certification: what a real assessment guide-based self-assessment looks like, and why assessors can't consult or advise you Why the "100 assessors" claim used to justify the pause doesn't hold up (there are over 1,000 CCAs) Level 1 vs. Level 2 vs. Level 3: what determines which level actually applies to you, and why most companies who think they need Level 3 don't Why asking your IT person to self-score your own compliance program is a liability risk, even with good intentions
- Transcript
- Chapters
#70
August 28 · 32 min
CMMC Vendor Marketing Claims Decoded: What "Covers 90 of 110 Controls" Actually Means
Submit any questions you would like answered on the podcast! Every CMMC vendor says the same thing: "we cover 80 out of 110 controls" or "90 out of 110." Austin and Brooke break down what that claim actually means, why "maps to," "satisfies," and "supports" are not interchangeable words, and why you almost always still have work to do even after buying the solution. In this episode: What vendors actually mean when they claim to cover a specific number of the 110 controls Why "maps to," "satisfies," and "supports" are different claims with different implications for your compliance program Why you can't stack vendors (40 controls from Vendor A plus 50 from Vendor B does not equal 90 covered) The moment your computer enters scope even when you're using a fully FedRAMP-compliant vendor: downloading, caching, or transmitting CUI through it Why "I never saved it to my computer, I just passed it through" doesn't get you out of scope (process, store, or transmit is the bar) How to use a CRM (customer responsibility matrix) or SRM (shared responsibility matrix) to know exactly where a vendor's responsibility ends and yours begins Why your MSP or IT provider needs a CRM too, not just your cloud vendors The exact questions to ask any vendor before you buy: which control numbers, full satisfaction vs. contribution, which systems and assets it applies to, and what's still on you Why vendors can only speak to their own product, not your specific environment, and why you need someone (in-house or outsourced) who understands your full compliance picture
- Transcript
- Chapters
#69
August 21 · 46 min
The Real Cost of CMMC Scoping Mistakes: Is "Six Figures" Real or Just Marketing?
Submit any questions you would like answered on the podcast! Is the "six-figure CMMC scoping mistake" a real number, or just something people throw around to sound scary? Stacey and Brooke break down where these numbers actually come from, what over-scoping really costs versus under-scoping, and what a defensible scope actually looks like. In this episode: Where the "six figures" scoping numbers actually come from (and why the DoW CIO and SBA's recent numbers conflated compliance cost with certification cost) What over-scoping actually costs: pulling in unnecessary cloud systems, remote users, and locations What under-scoping actually costs: a $30k-$40k assessment redo at best, a False Claims Act investigation at worst The most commonly missed scoping items: downloaded CUI, cached files, backups, CNC-connected computers, and cloud file-sync tools like Prevail Drive Why vendors and IT providers (MSPs, MSSPs) are an underscoping trap if their CRM/SRM documentation isn't in place Why most over-scoping actually traces back to primes and the government not clearly marking what is and isn't CUI 2026 scoping clarifications: encryption doesn't create a CUI boundary, paper-only CUI can limit flowdown, and why FedRAMP 20X won't satisfy DoW requirements Real False Claims Act cases where scoping was the legal basis (including a Georgia Tech case) What a defensible scope actually looks like in your SSP NIST 800-171 Revision 3 on the horizon, and why you need to start planning for it now regardless of what happens with the CMMC pause
- Transcript
- Chapters
#68
August 14 · 1 hr 22 min
The Complete CMMC Compliance Checklist for 2026: Phase 2 Pause, Level 1 vs Level 2, Scoping, and Vendor Documentation
Submit any questions you would like answered on the podcast! This is the all-in-one CMMC checklist episode. Austin and Brooke pull together everything into one place: what the 60-day Phase 2 pause actually changed (and didn't), what CMMC Level 1 really requires, what Level 2 really requires, why scoping is the foundation everything else depends on, and where most assessments actually fall apart. In this episode: What CIO Kirsten Davies' memo suspended, and what it left completely alone (spoiler: almost everything) Why the government's stated reasoning for the pause (cost, assessor shortage) doesn't hold up against real assessment pricing The RFI and task force timeline: what happens on August 14th, and what to expect around September 14th What happens to contracts that already have Phase 2 certification language written in Where to actually focus your compliance budget and effort during the pause CMMC Level 1: the checklist most people gloss over, and why it's not "nothing" CMMC Level 2: the 110 controls and 320 assessment objectives, POA&M rules, and the controls that most commonly get missed Why scoping has to come first, and what happens when you skip it (including a mole infestation analogy that actually makes sense) Whether your G-code, derivative drawings, and CAD pull-outs are CUI ESPs, CSPs, MSPs, and MSSPs: what each one means for your documentation and your assessment The two most common reasons assessments fail: documentation gaps and vendor/CRM gaps Justice IT Consulting's own path to CMMC Level 2 certification, completed right after the pause was announced
- Transcript
- Chapters
#67
July 31 · 30 min
Cyber AB June 2026 Town Hall Recap: Enforcement Data, Paper CUI Rules, Choosing a C3PAO, and the FAR CUI Update
Submit any questions you would like answered on the podcast! We're recapping the Cyber AB's June 2026 Town Hall, five topics every DoD contractor needs to hear, plus what's changed since (including the CMMC Phase 2 pause that landed after this town hall happened). Stacey and Brooke break down the real enforcement numbers, the paper CUI rules everyone gets wrong, how to actually vet a C3PAO, and the FAR CUI rule updates working their way through public comment. In this episode: False Claims Act enforcement: why almost every case comes from whistleblowers, not breaches, and why the discrepancies are massive (think negative scores, not "110 vs. 107") Paper-only CUI: when you're exempt from CMMC Level 2 controls, and the exact moment that exemption disappears (scanning, photographing, emailing it) How the town hall's November 10th "full steam ahead" messaging got overtaken by the Phase 2 pause memo weeks later What to actually ask when interviewing C3PAOs (assessor headcount, 1099 vs. employee, on-site requirements, SOCI screening status) FAR CUI rule updates: the incident reporting window moving to 72 hours, and the mislabeled/unlabeled CUI reporting requirement getting struck Why NIST 800-171 and CMMC were built for ongoing management, not a one-time snapshot, and what that means for your evidence and documentation Justice IT Consulting's own path through certification, and why that certification still matters even during the pause
- Transcript
- Chapters
#66
July 17 · 33 min
CMMC Phase 2 Paused: Why the DoD's Reasoning Doesn't Add Up, and What to Expect After the 60-Day Review
Submit any questions you would like answered on the podcast! The Department of War's pause on CMMC Phase 2 sparked a wave of panic, and a wave of misinformation right behind it. In this episode, Stacey and Brooke go deeper than the headline: what the pause actually changes, why the stated justification (cost, assessor capacity) doesn't hold up against the numbers, and what's realistically likely to come out of the 60-day review. In this episode: What "Phase 2 is paused" actually means (it's the third-party certification requirement on new contracts, not your obligation to be compliant) The biggest misconception floating around: "CMMC is suspended" vs. what's actually true Why the capacity argument (claims of "only 100 assessors") doesn't match reality (there are over 1,000 CCAs) Why the cost argument conflates "cost of certification" with "cost of actually being compliant," which have always been expensive Why self-assessments may face MORE scrutiny, not less, while third-party validation is paused Historical precedent: every incoming DoD/DoW CIO has paused and retooled this program since 2021, and it's never been canceled What to actually do this week if you're mid-remediation, mid-contract, or have a mock or certification assessment already scheduled The open RFI (Request for Information) the DoD posted, and why submitting a response matters Justice IT Consulting's own CMMC Level 2 certification news The mark-your-calendar date: September 14th is when the 60-day window closes and we should learn more about what comes next. Read the actual DoD memo here: https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902 Submit your own response to the DoD's RFI here: https://sam.gov/workspace/contract/opp/89ef9bfb0834473791e991c712698d94/view
- Transcript
- Chapters
#65
July 15 · 14 min
CMMC Phase 2 Certification Paused for 60 Days: What the DoD Memo Really Changes (and What It Doesn't)
Submit any questions you would like answered on the podcast! Here are the actual memos (Definitely worth a read): https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902 https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf The Department of War just paused the rollout of CMMC Phase 2's third-party certification requirement for 60 days. Austin breaks down what the memo actually says, what it doesn't say, and why "certification is paused" is not the same thing as "compliance is paused." In this episode: What the 60-day pause on CMMC Phase 2 actually covers (hint: it's the certification verification process, not the underlying NIST 800-171 requirements) Why this could ultimately make your path to CMMC less expensive, and why that's not a reason to slow down Why contractors who are already deep into implementation are in the strongest position no matter which direction this goes Why assuming "compliance has disappeared" is the riskiest read of this news What happens if third-party certification gets replaced with a stronger self-attestation or spot-check model, and why unsupported SPRS scores are already a liability A trade show story about a Department of War investigator actively pursuing ITAR fraud leads, and what that says about enforcement appetite right now What to actually do in the next 60 days while DoD figures out the future of the verification model
- Transcript
- Chapters
#64
July 10 · 31 min
CMMC for Small Aerospace Suppliers: Real Costs, DIY Limits, Level 1 vs 2, and the November 2026 Deadline
Submit any questions you would like answered on the podcast! Small aerospace suppliers are getting hit with the same CMMC questions over and over: what do I actually need to do if my contract requirements aren't clear yet, does redacting a drawing get it out of CUI territory, will a tool like ThreatLocker or Prevail make me compliant, and what is this actually going to cost. In this episode, Stacey and Brooke from Justice IT Consulting go through the real answers small manufacturers, machine shops, and engineering firms need before the November 10, 2026 DFARS CMMC requirement hits new DOD contracts. Topics covered: Why you can't fully plan compliance without knowing FCI vs. CUI exposure, and what that means for your Microsoft 365 environment (GCC vs. GCC High) Why redacting a customer name or contract number from a drawing does NOT remove CUI status Why compliance tools alone (ThreatLocker, Prevail, etc.) can't get you certified Realistic cost ranges for CMMC Level 2 certification, and why "$5,000" and "$20,000" quotes are misleading How far a small company can actually get doing CMMC in-house, including where AI-generated policies fall short Whether to start at Level 1 and move up later, or go straight to Level 2 What changes for new DOD contracts after November 10, 2026 How to get an honest readiness check with a gaps assessment before spending money We're also co-hosting a free live webinar with FutureFeed and Preveil on shared responsibility in CMMC assessments, covering how to read a customer responsibility matrix and close gaps before they become assessment findings. Tuesday, July 21st at 12 PM Central. Register (free, recording sent to all registrants): cmmccomplianceguide.com/podcast
- Transcript
- Chapters
#63
July 3 · 19 min
Cyber AB May 2026 Town Hall Recap: External Service Providers, Marketplace 2.0, New Leadership & OSC Accountability Explained
Submit any questions you would like answered on the podcast! The Cyber AB's May 2026 Town Hall packed in major updates and if you work with an MSP, use cloud services, or are trying to figure out where your compliance responsibility actually ends, this episode is required listening. Brooke and Stacey break down everything contractors need to know: ESP vs. CSP distinctions, FedRAMP changes, new leadership, Marketplace 2.0, and the single biggest takeaway every OSC needs to hear. 📌 What You'll Learn: What the new joint venture FAQ clarifies — and what actually changes (hint: less than you think) The status of the official CMMC certification badge and what you can display right now How FedRAMP 20X is changing authorization language — and why DoD's "moderate equivalency" standard isn't moving The three questions every OSC must answer about their ESP How to tell the difference between an MSP and a CSP — in plain English The 5 NIST 800-145 criteria that determine whether a service counts as cloud computing Cyber AB ecosystem updates: monthly RPO meetings launching in July and Marketplace 2.0 preview The biggest takeaway from the town hall — and why the burden always lands on the OSC Webinar Announcement: Whose Control Is It Anyway? — free live event July 21st at 12 p.m. CT - Sign up by clicking HERE
- Transcript
- Chapters
#62
June 19 · 19 min
New CMMC FAQ Clarifications: Joint Ventures, Paper-Only CUI, Reassessment Triggers & Where MSPs Actually Fit in Scope
Submit any questions you would like answered on the podcast! The Department of Defense just updated its CMMC FAQ document — and the clarifications inside answer some of the most common (and costly) assumptions contractors make. In this episode, Brooke and Stacey break down what changed for joint ventures, paper-only CUI, significant change triggers, and how MSPs and MSSPs actually fit into assessment scope. If you're navigating a merger, working with subcontractors, or relying on an MSP to manage your environment, this episode clears up exactly where you stand — and where you don't. 📌 What You'll Learn: Why joint ventures do NOT automatically inherit a company's CMMC certification status The new guidance on paper-only CUI — and when it does NOT require Level 2 assessment What actually counts as a "significant change" that triggers reassessment (mergers, system consolidation, and more) Why MSPs don't need their own CMMC certification — but still carry major assessment responsibilities The difference between CUI scope and Security Protection Data (SPD) scope for MSPs/MSSPs The five-part test for whether an MSP counts as a Cloud Service Provider (CSP) Listener Q&A: Do subcontractors need cybersecurity training and screening too?
- Transcript
- Chapters
#61
June 12 · 26 min
The CMMC Reality Check: Gap Assessments, Documentation Overload & Why 30-Day Compliance Claims Are a Red Flag
Submit any questions you would like answered on the podcast! Most defense contractors don't realize how complex CMMC compliance really is until they're already in trouble. In this episode, Brooke and Stacey break down the exact moments where contractors hit their wake-up call, what to expect from a gap assessment, and why waiting until the last minute could cost you your DoD contracts. Whether you're just starting your CMMC journey or think you're close to ready, this episode will show you what you're probably missing and how to get ahead of it.
- Transcript
- Chapters
#60
May 29 · 28 min
CS5 West 2026 CMMC Recap for Defense Contractor
Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, Brooke breaks down the biggest takeaways from CS5 West 2026, one of the largest conferences in the CMMC ecosystem. The biggest message from the conference was clear: CMMC is no longer theoretical. Assessments are happening now, companies are already getting certified, and many contractors are running out of time to prepare before Phase 2 requirements begin appearing on contracts. We discuss what assessors are seeing during mock and certification assessments, why documentation continues to be one of the biggest failure points, and why scoping mistakes are still creating major problems for manufacturers and defense contractors. We also cover: Why small contractors are struggling with implementation How primes are pressuring subcontractors to get certified early Why enclave strategies are often misunderstood The ongoing debate around G-code and CUI Why continuous compliance matters after certification The importance of mock assessments How False Claims Act risk ties into annual affirmations If you are a defense contractor trying to understand where CMMC enforcement is heading and what the industry is seeing right now, this episode gives you a practical, real-world update from inside the ecosystem.
- Transcript
- Chapters
#59
May 22 · 38 min
How Small Defense Contractors Can Handle CMMC Compliance
Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, we tackle one of the biggest challenges in the Defense Industrial Base: how small contractors without internal IT teams are realistically handling CMMC compliance. Many small manufacturers, machine shops, and defense suppliers feel overwhelmed by CMMC because they do not have dedicated cybersecurity, compliance, or IT security staff. Instead, employees wear multiple hats while trying to keep daily operations moving. We break down what compliance actually looks like for smaller contractors, what can realistically be outsourced, what responsibilities still stay with the company, and why buying tools like Microsoft 365 GCC High does not automatically make you compliant. We also explain why data flow mapping and scope are critical, how shared responsibility matrices work with MSPs and MSSPs, and the biggest mistakes smaller companies make when trying to shortcut compliance. If you are a small or mid-sized defense contractor trying to understand how to approach CMMC without a massive budget or internal compliance department, this episode will help you build a realistic roadmap.
- Transcript
- Chapters
#58
May 15 · 38 min
Why Contractors Fail CMMC Assessments and How to Prepare
Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, we break down one of the most frustrating realities for defense contractors thinking you are ready for a CMMC assessment, only to find out you are not. Many companies believe they are compliant because they have security tools in place, policies written, and even a high SPRS score. But when assessors actually evaluate the environment, major gaps often appear. We explain why this happens, how C3PAOs actually assess your environment, and what separates companies that pass their CMMC Level 2 assessment from those that fall short. You will learn how assessors use examine, interview, and test methods, why the 320 assessment objectives matter more than the 110 controls, and how small documentation inconsistencies can lead to failed controls. We also cover the importance of mock assessments, why your evidence package is critical, and how scope decisions can dramatically impact your assessment outcome. If you are preparing for a CMMC assessment, or think you are ready, this episode will help you avoid costly surprises and approach your assessment with confidence.
- Transcript
- Chapters
#57
May 8 · 1 hr 6 min
Top CMMC Compliance Mistakes and How to Avoid Them
Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, we break down the most common mistakes defense contractors make when preparing for CMMC compliance and how those mistakes can cost you time, money, and even future contracts. Even though CMMC 2.0 is now enforceable, many companies are still struggling with readiness. The issue is not effort, it is approach. Many contractors start in the wrong place, leading to overspending, failed assessments, or compliance gaps that could have been avoided. We cover critical topics like scoping mistakes, why treating CMMC as an IT-only project creates problems, and how focusing on tools too early can lead to unnecessary costs. We also explain why documentation and ongoing evidence are essential for passing an assessment and building trust with assessors. You will also learn why submitting an inaccurate SPRS score can create serious legal risk, how long CMMC actually takes to implement, and why waiting too long to start can put your contracts in jeopardy. If you are a small or mid-sized contractor in the defense industrial base, this episode will help you avoid the most common pitfalls and take a smarter approach to compliance.
- Transcript
- Chapters
#56
April 17 · 17 min
Can You Create CUI? CMMC Scope, ERP Systems, and Contractor Risk Explained
Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, we tackle one of the most misunderstood topics in CMMC compliance. Many contractors assume that if information is not marked as controlled unclassified information, then it is not CUI. But that assumption can lead to serious compliance risks. We break down how manufacturers and machine shops can actually create CUI while performing contract work, even if the original data was not clearly marked. We also cover how ERP systems factor into CMMC scope, when systems are considered in or out of scope, and how improper scoping decisions can create major compliance gaps. You will learn what derived CUI is, how it applies to things like CNC G code, and why simply removing identifying details from documents does not make them safe. We also explain who determines what qualifies as CUI, how scope can expand across your network, and what realistic cost and infrastructure decisions look like for small and mid sized contractors. If you are part of the defense supply chain, this episode will help you avoid one of the most common and costly misunderstandings in CMMC.
- Transcript
- Chapters
#55
April 10 · 17 min
The Hidden Operational Workload Behind CMMC Compliance
Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, we break down one of the biggest misconceptions in CMMC compliance. Most contractors think CMMC is just a cybersecurity upgrade. Install a few tools, write some policies, and you are ready for an assessment. But that is not how CMMC actually works. The real challenge is the operational workload behind compliance. We walk through what that workload actually looks like, including documentation, system security plans, asset management, workforce training, evidence collection, and continuous monitoring. These are the areas that consume the most time and are often underestimated by small and mid sized defense contractors. We also cover how CMMC impacts your supply chain, including subcontractor flowdown requirements and what you are responsible for as a prime or subcontractor. If you are preparing for CMMC Level 1 or Level 2, this episode will help you understand the true scope of work so you can avoid delays, failed assessments, and costly surprises.
- Transcript
- Chapters
#54
April 3 · 48 min
CMMC Reassessments Explained: What Changes Trigger a New Assessment
Submit any questions you would like answered on the podcast! In this episode of the CMMC Compliance Guide Podcast, we break down one of the most overlooked risks in CMMC compliance. What actually happens when your environment changes after an assessment? Many contractors assume that once they pass a CMMC assessment or complete a self assessment, they are set for the next year or even three years. But recent guidance from the Cyber AB town hall reveals that certain changes can trigger a brand new assessment. We walk through what qualifies as a significant change, what does not, and how decisions are made when things fall into the gray area. We also cover real examples like mergers, switching MSPs, expanding networks, and upgrading tools. If you are planning changes to your environment or trying to future proof your compliance strategy, this episode will help you avoid costly mistakes and unnecessary reassessments. We also answer a listener question about how to identify FCI and how it should be handled under CMMC Level 1 requirements. If you are a small or mid sized defense contractor, aerospace supplier, or manufacturer, this is critical guidance you do not want to miss.
- Transcript
- Chapters

Showing 1–20 of 20 episodes