CMMC Compliance Guide

Submit any questions you would like answered on the podcast!

You’ve done the work, the assessment is scheduled, and your stomach is in knots. What actually happens once the C3PAO shows up? Austin and Brooke walk through a Level 2 certification assessment from start to finish: what you upload beforehand, what each assessment phase covers, how a typical day runs, what assessors count as evidence, how the certificate reaches you, and what happens if you don’t meet everything.

In this episode:

• The high-level flow of a C3PAO assessment: preparation, upload, three assessment phases, and the certificate
• Phase one: the scoping in-brief, the document review, and the off-ramp that lets you reschedule instead of failing
• Phase two: how assessors use interview, examine, and test to work through all 320 assessment objectives
• How assessors structure the week, and why the two assessors take turns by control family
• What a real assessment day looks like: start and end times, breaks, lunch, and the end-of-day hot wash
• What “trending met” and “trending not met” mean, and why you should never mark anything “not applicable”
• The evidence assessors actually accept: reviewed visitor logs, vulnerability scans, screenshots matching your authorized user list, key logs, onboarding and offboarding checklists, and firewall rules
• How the result moves from quality review to a signed certificate to your SPRS record, and why PIEE access can slow you down
• If it doesn’t go well: the 180-day POA&M window, what can never be placed on a POA&M, and the 10-day window for evidence you already have but couldn’t find
• The most common failure point (documentation that doesn’t match across your SSP, policies, and procedures), and how to use AI safely inside a compliant tenant to catch inconsistencies without asking it to judge your controls
• Listener question: an additive manufacturing startup asks where to begin on the path to Level 2, and why the honest answer on cost is “it depends”

Submit any questions you would like answered on the podcast!

You have a $400,000 CNC machine running a Windows 7 controller that the manufacturer won’t update. Do you have to replace the machine to pass a CMMC assessment? Stacey and Brooke walk the shop floor and answer the questions machine shop owners ask us most: what to do with legacy controllers, why a shared shop login breaks the rules, how to handle MFA when your machinists won’t put an app on their personal phones, and what to do with the junk drawer of old thumb drives.

In this episode:

• Why the shop floor is in scope even if you only use paper travelers, and how to protect physical CUI at every station
• What to do with an unpatchable Windows 7 controller: isolate it, keep it off the internet and your corporate network, and document it, rather than replacing the machine
• How to move programs to older machines with FIPS-validated encrypted USB drives that old controllers can still read
• Why the computer that sends programs to the machine stays in scope, and how SneakerNet transfers keep it clean
• Why a shared shop login is fine for clocking in but can never be used to access CUI, and how fast user switching solves it
• Why multi-factor authentication can never be pushed onto a POA&M, and your options beyond personal phones (Duo-style push apps and FIDO hardware keys)
• Why some assessors push back on Windows Hello for Business
• How to sanitize and dispose of thumb drives, printers, and other devices that held CUI
• How to walk your own shop floor, follow a traveler from station to station, and document every touchpoint

Submit any questions you would like answered on the podcast!

These are the 10 questions Stacey and Brooke hear more than any other from defense suppliers, and most companies get at least half of them wrong without realizing it. If you've ever wondered whether your setup would actually hold up to a close look, this episode is your self-check.

In this episode:

• Do you actually need to worry about CMMC right now, with the certification requirement on contracts still paused?
• How to actually figure out whether you're Level 1 or Level 2 (and why you should push back on vague answers about what counts as CUI)
• What "compliant" actually looks like day to day, not just the technical controls, but the ongoing documentation and change management behind them
• Why "our IT provider handles all of it" is rarely true, and the specific questions to ask them (CRM/SRM, CCP, RP, CCA credentials)
• Why companies with mature cybersecurity programs often still fail on documentation, even when their technical controls are solid
• The biggest real-world mistakes: shared shop-floor logins that fail CUI access requirements, misunderstanding what the controls actually mean, and manually "reviewing logs" instead of using a SIEM
• What an assessor actually checks first (hint: it's your scope definition, not your tools)
• Why buying a compliance tool or downloading a template package doesn't mean you're done, and what you actually have to prove objective by objective
• How to implement all of this without grinding operations to a halt
• Where most companies actually land when they get an honest gap assessment

Submit any questions you would like answered on the podcast!

Your SPRS score can quietly decide whether your company is even eligible to bid on a DoD contract, and defense contractors have already paid millions in False Claims Act settlements for getting that number wrong. Austin and Brooke break down exactly how SPRS scoring works, what score you actually need, and how to make sure your number is accurate before a government audit finds you.

In this episode:

• What SPRS (Supplier Performance Risk System) actually is, and why it's the DoD's authoritative source for your compliance status
• How the scoring math really works: starting at 110, deducting 5, 3, or 1 points per missed control, and how you can end up as low as negative 203
• Why missing just a couple of five-point controls can put your score under 100 fast, and why negative 50 to negative 70 scores are common in real gap assessments
• The one control (3.12.4, your SSP) that can single-handedly tank your entire assessment if it's incomplete
• Why an 88 is the minimum score to bid on a contract, and what that means for your POA&M
• The six-month clock: what happens if you report a POA&M and don't close it out in time
• Why misrepresentation, not the underlying gap itself, is what actually triggers False Claims Act exposure
• The 2026 timeline of changes: the February class deviation, the July 16th revision that formalized the Phase 2 pause, and the September 3rd update
• Who can actually see your SPRS score (hint: it's not primes, and it's not your competitors)
• How to actually register and submit a score: getting a CAGE code through SAM.gov and navigating PIEE

Submit any questions you would like answered on the podcast!

What does CMMC Level 2 actually require, and how does it connect to the four-phase rollout, the POA&M process, and the assessment you'll eventually go through? Austin and Brooke break down Level 2 in plain English, a few days ahead of the DoD's September update on the Phase 2 pause.

In this episode:

• Where things stand with the Phase 2 pause right now, and what's not paused (your obligation to be compliant with NIST 800-171 R2)
• Why "just give me the CMMC checklist" doesn't work, and what CMMC actually is (a collection of DFARS rules built on NIST 800-171)
• The four-phase rollout explained: what phase you're actually in, what's paused, and what flows down regardless of the pause
• What CMMC Level 2 requires: 110 controls, 320 assessment objectives, and the "CMMC overlay" on top of NIST 800-171
• POA&M rules explained: the 180-day clock, the minimum 88 score, and which controls can never go on a POA&M
• What "ready for assessment" actually means (hint: it's a lot more than an SSP and a POA&M, often 400+ documents and artifacts)
• Self-assessment vs. C3PAO certification: what a real assessment guide-based self-assessment looks like, and why assessors can't consult or advise you
• Why the "100 assessors" claim used to justify the pause doesn't hold up (there are over 1,000 CCAs)
• Level 1 vs. Level 2 vs. Level 3: what determines which level actually applies to you, and why most companies who think they need Level 3 don't
• Why asking your IT person to self-score your own compliance program is a liability risk, even with good intentions

Submit any questions you would like answered on the podcast!

Every CMMC vendor says the same thing: "we cover 80 out of 110 controls" or "90 out of 110." Austin and Brooke break down what that claim actually means, why "maps to," "satisfies," and "supports" are not interchangeable words, and why you almost always still have work to do even after buying the solution.

In this episode:

• What vendors actually mean when they claim to cover a specific number of the 110 controls
• Why "maps to," "satisfies," and "supports" are different claims with different implications for your compliance program
• Why you can't stack vendors (40 controls from Vendor A plus 50 from Vendor B does not equal 90 covered)
• The moment your computer enters scope even when you're using a fully FedRAMP-compliant vendor: downloading, caching, or transmitting CUI through it
• Why "I never saved it to my computer, I just passed it through" doesn't get you out of scope (process, store, or transmit is the bar)
• How to use a CRM (customer responsibility matrix) or SRM (shared responsibility matrix) to know exactly where a vendor's responsibility ends and yours begins
• Why your MSP or IT provider needs a CRM too, not just your cloud vendors
• The exact questions to ask any vendor before you buy: which control numbers, full satisfaction vs. contribution, which systems and assets it applies to, and what's still on you
• Why vendors can only speak to their own product, not your specific environment, and why you need someone (in-house or outsourced) who understands your full compliance picture

Submit any questions you would like answered on the podcast!

Is the "six-figure CMMC scoping mistake" a real number, or just something people throw around to sound scary? Stacey and Brooke break down where these numbers actually come from, what over-scoping really costs versus under-scoping, and what a defensible scope actually looks like.

In this episode:

• Where the "six figures" scoping numbers actually come from (and why the DoW CIO and SBA's recent numbers conflated compliance cost with certification cost)
• What over-scoping actually costs: pulling in unnecessary cloud systems, remote users, and locations
• What under-scoping actually costs: a $30k-$40k assessment redo at best, a False Claims Act investigation at worst
• The most commonly missed scoping items: downloaded CUI, cached files, backups, CNC-connected computers, and cloud file-sync tools like Prevail Drive
• Why vendors and IT providers (MSPs, MSSPs) are an underscoping trap if their CRM/SRM documentation isn't in place
• Why most over-scoping actually traces back to primes and the government not clearly marking what is and isn't CUI
• 2026 scoping clarifications: encryption doesn't create a CUI boundary, paper-only CUI can limit flowdown, and why FedRAMP 20X won't satisfy DoW requirements
• Real False Claims Act cases where scoping was the legal basis (including a Georgia Tech case)
• What a defensible scope actually looks like in your SSP
• NIST 800-171 Revision 3 on the horizon, and why you need to start planning for it now regardless of what happens with the CMMC pause

Submit any questions you would like answered on the podcast!

This is the all-in-one CMMC checklist episode. Austin and Brooke pull together everything into one place: what the 60-day Phase 2 pause actually changed (and didn't), what CMMC Level 1 really requires, what Level 2 really requires, why scoping is the foundation everything else depends on, and where most assessments actually fall apart.

In this episode:

• What CIO Kirsten Davies' memo suspended, and what it left completely alone (spoiler: almost everything)
• Why the government's stated reasoning for the pause (cost, assessor shortage) doesn't hold up against real assessment pricing
• The RFI and task force timeline: what happens on August 14th, and what to expect around September 14th
• What happens to contracts that already have Phase 2 certification language written in
• Where to actually focus your compliance budget and effort during the pause
• CMMC Level 1: the checklist most people gloss over, and why it's not "nothing"
• CMMC Level 2: the 110 controls and 320 assessment objectives, POA&M rules, and the controls that most commonly get missed
• Why scoping has to come first, and what happens when you skip it (including a mole infestation analogy that actually makes sense)
• Whether your G-code, derivative drawings, and CAD pull-outs are CUI
• ESPs, CSPs, MSPs, and MSSPs: what each one means for your documentation and your assessment
• The two most common reasons assessments fail: documentation gaps and vendor/CRM gaps
• Justice IT Consulting's own path to CMMC Level 2 certification, completed right after the pause was announced

Submit any questions you would like answered on the podcast!

We're recapping the Cyber AB's June 2026 Town Hall, five topics every DoD contractor needs to hear, plus what's changed since (including the CMMC Phase 2 pause that landed after this town hall happened). Stacey and Brooke break down the real enforcement numbers, the paper CUI rules everyone gets wrong, how to actually vet a C3PAO, and the FAR CUI rule updates working their way through public comment.

In this episode:

• False Claims Act enforcement: why almost every case comes from whistleblowers, not breaches, and why the discrepancies are massive (think negative scores, not "110 vs. 107")
• Paper-only CUI: when you're exempt from CMMC Level 2 controls, and the exact moment that exemption disappears (scanning, photographing, emailing it)
• How the town hall's November 10th "full steam ahead" messaging got overtaken by the Phase 2 pause memo weeks later
• What to actually ask when interviewing C3PAOs (assessor headcount, 1099 vs. employee, on-site requirements, SOCI screening status)
• FAR CUI rule updates: the incident reporting window moving to 72 hours, and the mislabeled/unlabeled CUI reporting requirement getting struck
• Why NIST 800-171 and CMMC were built for ongoing management, not a one-time snapshot, and what that means for your evidence and documentation
• Justice IT Consulting's own path through certification, and why that certification still matters even during the pause

Submit any questions you would like answered on the podcast!

The Department of War's pause on CMMC Phase 2 sparked a wave of panic, and a wave of misinformation right behind it. In this episode, Stacey and Brooke go deeper than the headline: what the pause actually changes, why the stated justification (cost, assessor capacity) doesn't hold up against the numbers, and what's realistically likely to come out of the 60-day review.

In this episode:

• What "Phase 2 is paused" actually means (it's the third-party certification requirement on new contracts, not your obligation to be compliant)
• The biggest misconception floating around: "CMMC is suspended" vs. what's actually true
• Why the capacity argument (claims of "only 100 assessors") doesn't match reality (there are over 1,000 CCAs)
• Why the cost argument conflates "cost of certification" with "cost of actually being compliant," which have always been expensive
• Why self-assessments may face MORE scrutiny, not less, while third-party validation is paused
• Historical precedent: every incoming DoD/DoW CIO has paused and retooled this program since 2021, and it's never been canceled
• What to actually do this week if you're mid-remediation, mid-contract, or have a mock or certification assessment already scheduled
• The open RFI (Request for Information) the DoD posted, and why submitting a response matters
• Justice IT Consulting's own CMMC Level 2 certification news

The mark-your-calendar date: September 14th is when the 60-day window closes and we should learn more about what comes next.

 Read the actual DoD memo here: https://federalnewsnetwork.com/wp-content/uploads/2026/07/CIO-CMMC-Reform-Memo_26-P-1023.pdf?hss_channel=lcp-348902

 Submit your own response to the DoD's RFI here: https://sam.gov/workspace/contract/opp/89ef9bfb0834473791e991c712698d94/view