CMMC Compliance Guide

Submit any questions you would like answered on the podcast!

🎯 Get your Free SPRS Roadmap Session: https://cmmccomplianceguide.com/free-sprs-roadmap
Our experts will review your SPRS score, documentation, and setup to help you hit 110 with a clear action plan at no cost.

Prime contractors like Lockheed Martin, Raytheon, and Parker Hannifin are demanding proof of compliance before awarding new work — and subcontractors who can’t prove it risk losing contracts.

In this episode, Brooke and Austin from Justice IT Consulting explain exactly what primes are asking for, what documentation they expect (SPRS, SSP, POA&M), and the most common mistakes subcontractors make when trying to prove compliance.

You’ll learn:

•  Why primes are suddenly enforcing subcontractor compliance
•  What documents and proof you need ready (SPRS, SSP, POA&M)
•  The biggest mistakes that lead to false claims risk
•  What happens when you inflate your SPRS score
•  How to show compliance even before your Level 2 certification
•  What steps to take now to get audit-ready and stay competitive

Whether you’re still working toward compliance or just need a second set of eyes, this episode breaks down how to prove your CMMC compliance with confidence — before your primes stop sending work your way.

Submit any questions you would like answered on the podcast!

The September 2025 Cyber AB Town Hall dropped big updates for contractors navigating CMMC and NIST 800-171 compliance. 

In this episode of the CMMC Compliance Guide Podcast, Brooke and Austin break down what the final CMMC rule (Title 48A) means for defense contractors, subcontractors, and service providers.

We cover the timeline for implementation, prime and subcontractor flow-down requirements, service provider risks (MSPs, CSPs, ESPs), and how a government shutdown could affect CMMC. You’ll also hear insights on ongoing compliance, documentation, FedRAMP requirements, advisory councils, and what primes will expect from their supply chains.

Whether you’re a compliance officer, program manager, or DoD subcontractor, this episode gives you clear, actionable takeaways so you can prepare before deadlines hit.

Submit any questions you would like answered on the podcast!

Worried about mishandling Controlled Unclassified Information (CUI)? 

In this episode of the CMMC Compliance Guide Podcast, Brooke and Stacey break down what CUI really is, why it matters in defense contracting, and the biggest mistakes contractors make when handling it.

You’ll also learn the real-world risks of CUI mishandling, how assessors check compliance during a CMMC Level 2 assessment, and the low-cost, practical solutions you can implement right now to protect sensitive data.

Submit any questions you would like answered on the podcast!

The wait is over: the Department of Defense has finalized the CMMC rule, officially making it part of DFARS. That means compliance isn’t “coming soon”, it’s now in your contracts.

In this episode of the CMMC Compliance Guide Podcast, Austin and Brooke from Justice IT Consulting break down what the final rule means for DoD contractors and subcontractors, the key deadlines you need to know, and the exact steps to prepare for Level 2 certification before requirements hit contracts in November 2026.

What you’ll learn in this episode:

- The new CMMC final rule and when it goes into effect
- How the 4-phase rollout impacts primes and subcontractors
- What’s different about this update (and why it’s not another delay)
- Key requirements: SPRS score, POAM limits, affirming officials, and more
- How to prepare your subcontractors with questionnaires and attestations
- Why you need to start engaging with C3PAOs now before schedules fill up

If you’re a DoD contractor, aerospace manufacturer, or subcontractor, this is the update you can’t afford to ignore.

Submit any questions you would like answered on the podcast!

Confused about where NIST 800-171 fits into your CMMC 2.0 assessment? You’re not alone. 

In this episode of the CMMC Compliance Guide, Brooke and Stacey from Justice IT Consulting break it all down in plain English.

We cover the foundation of NIST 800-171, how it maps into the CMMC levels, what assessors actually look for during an audit, and the most common mistakes contractors make. We’ll also touch on the latest updates including: NIST 800-171 Rev 3 and the DoD’s enforcement timelines and finish by answering real listener questions on VoIP, Microsoft 365, and more.

Whether you’re a small defense contractor or managing compliance for a larger team, this episode gives you the practical steps you need to stay compliant, stay secure, and stay ready for your assessment.

Submit any questions you would like answered on the podcast!

Thinking about building an enclave for CMMC compliance? Not so fast. 

In this episode of the CMMC Compliance Guide Podcast, Austin and Brooke from Justice IT Consulting break down:

• What an enclave actually is (in plain English)
• When an enclave makes sense (and saves you money)
• When it can hurt your compliance efforts
• What assessors will really be looking for in your audit

If you’ve ever asked, “Do I need an enclave for CMMC?”, this episode is your roadmap to making the right call for your business.

Submit any questions you would like answered on the podcast!

Think you’re ready for your CMMC assessment? 

In this episode of the CMMC Compliance Guide Podcast, Austin and Brooke break down the difference between being “paper ready” and truly “assessment ready.” From documentation gaps to overlooked technical controls, they share insider tips to help you pass with confidence.

We’ll walk you through the common blind spots that can derail an assessment, how to stress test your compliance program, and what assessors really look for when they walk in the door.

Submit any questions you would like answered on the podcast!

Marking a CMMC control as “Not Applicable” might feel like an easy shortcut but get it wrong, and you could fail your assessment, lose contracts, or even face legal trouble.

In this episode of The CMMC Compliance Guide, Brooke and Stacey from Justice IT Consulting break down the real risks of misusing N/A, share common mistakes companies make, and explain how to properly justify a not applicable control so you stay compliant and avoid False Claims Act issues.

We cover everything from Wi-Fi misconceptions to remote access oversights, mobile device scoping, assessor validation methods, and the legal risks nobody talks about. Whether you’re a one-person shop or managing a complex network, these insights could save you from major headaches come assessment day.

CyberAB Marketplace

Submit any questions you would like answered on the podcast!

Schedule your free SPRS Roadmap Session and get a step-by-step plan to close gaps and stay defensible:
👉 https://cmmccomplianceguide.com/free-sprs-roadmap

Is CMMC just one of many hats you wear at your company? You’re not alone and you’re not out of luck.

In this episode of the CMMC Compliance Guide, we break down how overworked and under-resourced compliance leads can still make meaningful progress toward CMMC and NIST 800-171. Whether you're a part-time compliance officer, the IT guy, or the quality manager who just got handed CMMC, we’ll walk you through a phased, practical approach you can tackle in just a few hours a week.

From identifying CUI and building your data flow diagrams to implementing MFA, FIPS, and policy templates the right way—this is your guide to making CMMC doable without the burnout.

Submit any questions you would like answered on the podcast!

48 CFR UPDATE: https://www.ecfr.gov/current/title-48/chapter-2/subchapter-A/part-204/subpart-204.75

Missed the June 2024 Cyber AB Town Hall? We’ve got you covered.

In this episode of the CMMC Compliance Guide, Brooke and Austin break down the biggest takeaways — including how recent leadership changes, service provider requirements, and G-code classification are shaping the path to CMMC compliance.

If you're a DoD contractor or MSP supporting government clients, this is the update you can't afford to miss.

INSIDE THE EPISODE:
- What the new Undersecretary means for CMMC rulemaking
- ESP vs. CSP vs. MSP — and why the difference matters
- Why your IT provider will be assessed with your environment
- How your CAGE code could delay certification
- What assessors say about G-code and CUI
- Upcoming CMMC events you should have on your calendar

UPCOMING CMMC EVENTS MENTIONED:
- Carahsoft CMMC Webinar Series: https://www.carahsoft.com/learn/event/71021-proofpoint-and-microsoft-cmmc-webinar

- National Cyber Summit: https://www.nationalcybersummit.com/

- CS5 East 2025: https://cyberab.org/News-Events/CS5-Conference