CMMC Uncovered

DFARS 7012 is in your contract, but nobody will tell you what is CUI. CMMC consultant Kelly Hood walks through four mock contracts and shows where to look, who to ask, and how to write your own designation guide.Jake Celler sits down with Kelly Hood, a cybersecurity consultant who helps defense contractors scope CMMC, for a hands-on review of replica contracts. Jake plays the stressed IT leader, Kelly plays the consultant, and they cover what to search for, what the clauses mean, and what to do when the contract doesn’t say what you have to protect. They also open with a few CS5 takeaways and a discussion of a recent article on the CMMC task force.📋 Get our free resourcesThe CMMC Level 1 Readiness Checklist: https://www.secure-centric.com/level1...The CMMC 2.0 Level 2 Compliance Checklist: https://www.secure-centric.com/level2...How to Detect Unmarked CUI: https://www.secure-centric.com/cuitem...This episode is for defense contractors, government contractors, manufacturers, IT leaders, procurement teams, and compliance professionals in the defense industrial base who need to figure out what is and isn’t CUI before they scope CMMC Level 2 or NIST 800-171. Kelly notes she is not a lawyer, so run contract decisions by your counsel. The CS5 and task force discussion is based on rumors and a published article, not confirmed policy.Chapters:00:00 Introduction to guest Kelly Hood and the contract review01:27 CS5 takeaways: Rev 3 and the FAR CUI rule03:39 The task force article and what it says about CMMC next steps07:51 The $600,000 cost claim vs what RFI responses showed10:08 Contract one: setting up the mock review11:13 Finding CUI in a contract: start with the 7012 clause12:54 7012 without 7021: why even janitorial companies see these clauses15:45 Checking attachments and the data requirements list16:33 Distribution statements A through F and what they signal18:23 Asking the contracting officer for a designation guide19:36 No CUI but 7012 in your contract: asking for a contract mod22:47 Contract two: janitorial services and the 7021 clause26:04 Writing your own CUI designation guide31:18 How a designation guide narrows what you protect34:29 Contract three: a bracket assembly and the technical data package36:41 Reading the 7021 fill-in: Level 2 C3PAO vs self-assessment39:13 C3PAO in your contract during the pause: get it in writing40:37 Distribution D and the egg McMuffin example43:09 Manufacturers: COTS vs items created for the government44:05 Contract four: a purchase order with export control and ITAR flags48:00 The 10-day letter saying everything is CUI50:56 When you have CUI but no clause says so53:50 Final advice: ask questions and write it downWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who is trying to find the CUI in their contracts.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsl...LinkedIn: / secure-centric Website: https://www.secure-centric.com/

What is actually Controlled Unclassified Information (CUI), and how do you know if your company is handling it?For many defense contractors, identifying CUI is one of the hardest parts of preparing for CMMC Level 2. A document arrives marked CUI, but nobody can clearly explain which information needs protection.In this episode of CMMC Uncovered, Jake Celler sits down with Rachel Bassford, a CUI expert who has worked with NARA, the FBI, and Fortune 500 organizations, to discuss the confusion surrounding CUI identification, markings, and scoping.📋 Get our free resourcesThe CMMC Level 1 Readiness Checklist: https://www.secure-centric.com/level1checklistThe CMMC 2.0 Level 2 Compliance Checklist: https://www.secure-centric.com/level2checklistHow to Detect Unmarked CUI: https://www.secure-centric.com/cuitemplateThis episode is for defense contractors, government contractors, manufacturers, IT leaders, procurement teams, and compliance professionals in the defense industrial base who need to work out what is and isn’t CUI before making scoping and budget decisions. Rachel notes that her answers are not legal advice and should be run by your counsel.Chapters:00:00 Introduction to guest Rachel Bassford and why CUI is the top CMMC question01:17 What is CUI? A plain-English definition03:12 Why the government’s CUI determination never happened08:57 Finding CUI in your contracts beyond DFARS 701214:38 How to narrow CUI scope by ruling out what CUI cannot be21:54 Why unclear CUI marking lets some suppliers look the other way23:16 Poorly marked CUI: what primes and subs can do29:24 Game time: CUI or not CUI36:53 Why “it depends” is the honest answer on CUI40:59 The FAR CUI rule and why the standard form falls short43:22 Why SMBs struggle to resolve CUI without help46:11 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who is trying to figure out what is actually CUI.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

CMMC is paused, but CMMC Level 2 clauses are still showing up in contracts, and primes still want proof of NIST 800-171 compliance from defense contractors. Brett Cox of Boeing explains what suppliers need to show right now.Jake Celler sits down with Brett Cox, who works at Boeing as a CMMC Cybersecurity Program Management Office Principal, to cover his Pentagon meeting with the Honorable Davies, the task force listening sessions, and what he is seeing in contracts during the pause.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, manufacturers, suppliers at every tier, and compliance professionals who need to know what primes expect during the pause. If you hold CUI and wonder whether the pause means you can wait, Brett’s answer is clear: CMMC is still in effect.Note: Brett’s remarks on policy and the pause are his personal perspective.Chapters:00:00 Introduction to guest Brett Cox00:34 Boeing CUI training and supplier summit03:12 Meeting the Honorable Davies at the Pentagon05:47 How the CMMC task force tiers worked07:33 DIB listening sessions and the 60-day question09:38 CUI history and why NIST 800-171 still struggles17:42 February FAR overhaul: 7019, 7020 and FAR 52.204-2122:30 Why 7021 sets a minimum score floor25:43 Are contracts still citing 7021 during the pause29:14 7012 vs 7021: NIST 800-171 is the homework, CMMC is the test33:56 Validating your supply chain before accepting 702135:10 CMMC is still in effect: only phase two was paused38:10 What primes ask for when no C3PAO is required40:51 Is a C3PAO assessment still worth it44:59 How primes help suppliers identify CUI49:20 COTS vs commercial53:12 Getting CUI answers from the government58:22 Is the “find new suppliers” message still in effect1:03:37 Are suppliers leaving the DIB1:08:27 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who supplies a prime.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

CMMC is paused, but NIST 800-171, DFARS 7012, and False Claims Act exposure are not. Buddy Dees, who just retired after 38 years with the DoD and worked on CMMC from the start, explains what the deviation does and doesn’t change for defense contractors.Jake Celler sits down with Buddy Dees, a recently retired member of the DoW CIO’s CMMC program office, nine days into retirement. They cover CMMC’s start-stop history, why rulemaking takes so long, and what the pause means for contractors handling CUI.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, C3PAOs, MSPs, and compliance professionals in the defense industrial base who need a clear view of what the pause means for CMMC and NIST 800-171 obligations. If your company handles CUI and is deciding what to do now, this is a firsthand explanation.Note: Buddy’s remarks on policy direction and the current administration are his personal perspective, not official DoD positions.Chapters:00:00 Introduction to guest Buddy Dees01:41 The mission behind the CMMC PMO flak vest06:27 Did CMMC create a culture shift in the DIB08:58 How CMMC raised awareness of DFARS 701211:56 What CMMC 3.0 and the Rev 3 amendment looked like15:40 Why OT was deferred to phase two17:48 Can the CIO change CMMC without rulemaking23:58 How much an interim final rule really saves26:27 The rulemaking clock and the end of an administration29:50 What the Rev 3 deviation actually does33:27 Can the DoW deviate 7012 and NIST 800-17138:08 False claims and DIBCAC assessments still apply41:15 Who decides which CMMC level goes in a contract48:33 FAR CUI rule: Rev 2 vs Rev 3 explained59:45 How the FAR CUI standard form could fix CUI marking1:05:15 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs to understand the pause.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

A welder had the entire structural design of the F-22 open on his laptop, Facebook Messenger flashing right next to it, and no idea why that mattered. Stacy Bostjanick says that moment is exactly why CMMC had to exist. She spent 37 years in federal government, led CMMC through two full rulemaking processes as DoD's Chief, Defense Industrial Base Cybersecurity, and walks through the real history behind the program most people only know through headlines.Jake Celler sits down with Stacy Bostjanick, who recently retired after nearly four decades in federal service, to trace CMMC's full history from the original 2013 DFARS clause through two rulemaking processes, a change in administration, and the current pause.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, C3PAOs, compliance professionals, and anyone in the defense industrial base trying to understand how CMMC actually came to exist and where the rulemaking process could take it next. If you want the real history behind the headlines, this conversation lays it out in detail.Chapters:00:00 Introduction to guest Stacy Bostjanick00:30 Stacy's 37-year career in federal government01:40 CMMC's origins in the 2013 DFARS clause04:24 Why 800-171 was seen as a win compared to 800-5305:37 The DoD IG findings that led to DCMA DIBCAC08:59 The welder story: full F-22 access on a laptop11:30 Rulemaking, OMB desk officers, and who really holds the power17:38 Inside the two-year formal rulemaking process19:06 Over 2,000 public comments, adjudicated line by line24:23 Why the industry calls this "Groundhog Day"25:38 Whether the current pause follows the Procedures Act29:50 Why companies think the pause means nobody is checking30:02 Phase One was not suspended: the 88/110 requirement explained33:41 Why CMMC never got to operational technology37:15 The rise in whistleblower activity around DFARS contracts38:18 Can the Department of War change contract clauses at will40:11 What happens when the FAR CUI rule reaches revision three42:01 How much Washington actually prioritizes data confidentiality44:11 Stacy's reflection on her legacy and the program's future48:21 The real risk: losing the assessor ecosystem before a decision is madeWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs the real history behind CMMC.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

CMMC Level 2 compliance is not a one-time project, and one prime's internal assessment fail came down to people not doing what the con ops said they would. Anne-Marie Castrigno led NIST 800-171 at a billion-dollar defense contractor and explains how she got to a perfect external Level 2 assessment.Jake Celler sits down with Anne-Marie Castrigno, a defense industrial base leader with over 24 years of experience who started as a sysadmin and worked her way up to leading technology and NIST 800-171 at a large prime. This conversation covers how IT leaders can win funding, build a security culture, scope before buying, and keep CMMC compliance running after the assessment.This episode is for IT leaders, CIOs, defense contractors, government contractors, manufacturers, and compliance professionals in the defense industrial base working toward CMMC Level 2 and NIST 800-171 compliance. If you are deciding what to buy, what to build, and how to sustain compliance, this is a practical view from someone who has done it inside a prime.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistChapters:00:00 Introduction to guest Anne-Marie Castrigno00:48 Career advice: talking risk and revenue like a CFO04:04 Building a security culture and compliance operating model06:30 Shifting from engineering language to business language11:04 What slows NIST 800-171 progress: culture and awareness15:03 Tactical approach: walking the factory floor17:27 How compliance uncovers operational efficiencies19:16 Why IT leaders buy tools before defining scope23:10 GCC High vs lower-cost CUI solutions for manufacturers26:33 Why clean data makes future migrations easier28:52 Maintaining CMMC Level 2 compliance after assessment32:28 Patching in manufacturing: automation vs white-glove support35:25 Final advice: think about today and the futureWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who is working toward CMMC Level 2.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:Newsletter: https://secure-centricorg.com/scnewsletterLinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

Katie Arrington (Former DOW CIO) helped create CMMC after a senator told her the DIB was leaking hundreds of billions in R&D to adversaries, and she says pausing it until 2028 puts national security at risk. In her most candid interview yet, she explains why she believes the current pause contradicts the Department of War's own stated priorities.Jake Celler sits down with Katie Arrington, former DoD CIO and the driving force behind CMMC, for an unusually personal and direct conversation covering her background, why CMMC exists, and her view on the current pause in third-party assessments.📋 Get our free CMMC Level 2 Readiness Checklist: https://www.secure-centric.com/level2checklistThis episode is for defense contractors, government contractors, C3PAOs, compliance professionals, and anyone in the defense industrial base trying to understand the reasoning behind CMMC and the debate surrounding the current pause. Please note that portions of this conversation reflect Katie Arrington's personal opinions on the current pause and Department of War leadership, not confirmed facts, and some content in this episode touches on a serious personal experience involving loss of life.📬 Stay ahead of every CMMC update: subscribe to our newsletter: https://secure-centricorg.com/scnewsletterChapters:00:00 Introduction to guest Katie Arrington01:17 The personal experience that shaped Katie's view of cybersecurity07:35 Why Katie pushes back on the "CMMC is too expensive" argument09:32 Cyber risk in the age of AI and quantum computing14:10 How CMMC originated from a Senate hearing with Senator Rounds16:38 Assurance, accountability, and the DFARS 7012 self-attestation gap20:19 Katie's reaction to the pause being extended to 202825:07 Whether a corporate background limits understanding of DoD rulemaking29:17 The Paperwork Reduction Act, the Procedures Act, and how CMMC became law31:16 Momentum lost since the July pause began38:49 Crediting the people behind CMMC beyond Katie herself40:07 How Katie's public tone shifted over the course of the pause45:09 Why removing CMMC increases risk for manufacturers48:16 Comparing breach notification timelines between the US and China53:05 Katie's personal reflection on responsibility and the cost of inaction59:15 Closing remarksWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs to understand where CMMC came from and what's at stake in the current pause.Follow Secure-Centric for future CMMC episodes:LinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

Honeywell settled a False Claims Act case tied directly to NIST 800-171 and DFARS 7012 non-compliance, and the whistleblower attorney behind it says you don't have to lie to be liable, reckless disregard is enough. Renee Brooker breaks down what actually makes a strong cybersecurity fraud case and what options IT leaders have if they suspect their company isn't compliant.Jake Celler sits down with Renee Brooker, a False Claims Act whistleblower attorney who spent most of her career at the Department of Justice before moving into private practice, where she represented the whistleblower in the Honeywell settlement. This conversation breaks down what the case actually involved and what it means for IT and cybersecurity leaders working at companies that may not be compliant.This episode is for IT directors, CISOs, compliance professionals, defense contractors, and government contractors trying to understand what actually creates False Claims Act exposure around NIST 800-171 and CMMC compliance. If you suspect your company is not being truthful about its compliance status, this conversation lays out what to actually do about it.Chapters:00:00 Introduction to guest Renee Brooker00:46 Renee's background and role in the Honeywell case02:33 What the Honeywell settlement actually released05:22 The three things that make a strong FCA cybersecurity case08:01 What "knowingly" means under the False Claims Act09:31 Why the head in the sand defense does not work11:24 What whistleblowers should do if they are concerned but don't want to lose their job16:51 Is there personal liability for IT leaders who stay silent21:08 Why the fraud mastermind scenario is rare in practice22:54 Why "we're making slow progress" is not a legal defense26:14 SPRS scores and why partial compliance still counts as a false claim27:22 Should you come forward even without hard evidence30:03 Why talking to a whistleblower attorney is the right first step32:31 Why most whistleblowers are rewarded, not punished32:48 Why False Claims Act settlements always signal litigation risk33:32 The multiplier and why whistleblowers are compensatedWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in the Defense Industrial Base who needs to understand what NIST 800-171 non-compliance actually risks.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:LinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

Mastering CMMC compliance means knowing exactly where your boundary starts and stops. Get scope wrong and you're looking at the difference between a hundred thousand dollar implementation and a five hundred thousand dollar one.In this episode of CMMC Uncovered, Ben Huey, a 20-plus year IT who spent six to seven years running the floor for a large DoD contractor, breaks down exactly how manufacturers should approach CMMC scope when CUI and OT start to overlap.We cover how CUI data actually flows from a contract into engineering and onto the shop floor, how the DD-254 form and prime flow-down clauses define what counts as CUI on a given contract, and why some primes pass down blanket CUI statements rather than push back on the government. We also break down COTS versus non-COTS parts, including a real example of a rail housing electronic wires that stays commercial until it gets modified for a specific DoD purpose, and what happens when a single machine handles both. Ben explains why partial exposure still puts a machine fully in scope, and why walking the actual manufacturing floor reveals data movement that network mapping alone misses.Chapters:00:00 Introduction to manufacturing and CMMC scoping00:35 Ben Huey's background in manufacturing and IT02:15 The biggest question manufacturers ask about scope03:20 Why understanding data flow into the network comes first04:47 How the DD-254 form defines CUI on a contract06:37 Why primes flow down blanket CUI statements09:07 Pushing back on a prime and getting CUI defined in writing11:38 How to approach the middle ground of mixed manufacturing floors14:02 What COTS means and why it matters for CMMC scope15:50 A real example: rails that are COTS until they are modified18:34 How COTS gets defined during RFI, RFP, and RFQ20:45 The risk of sales teams committing to scope without IT21:00 Why partial CUI exposure still puts a machine fully in scope22:36 Why walking the floor reveals what network mapping misses26:13 Ben's key takeaways for manufacturers starting CMMC27:38 Why moving to an enclave too early can backfireWatch the full episode, subscribe to CMMC Uncovered, and share it with someone in manufacturing who is trying to figure out what is actually in scope for CMMC.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:LinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/

How do prime contractors and their partners navigate CMMC compliance together? Jake Celler sits down with Bo Birdwell from Elbit Systems to discuss the reality of collaboration.Building a strong security posture requires alignment between large defense contractors and their subcontractors. This episode breaks down the practical side of working through these requirements to ensure both parties remain secure and compliant.Beyond individual readiness, successful prime contractor relationships hinge on clear communication about cybersecurity expectations. Bo shares insights from Elbit Systems on how organizations can better prepare for these joint responsibilities.Chapters:00:00 Introduction to guest Bo Birdwell from Elbit Systems00:34 Bo's background from the Air Force to CMMC and supply chain01:24 Why Bo has not seen a mass exodus from the DIB02:36 The real root cause: lack of a clear CUI definition04:12 Why some primes mandated CMMC Level 2 universally06:38 What to do when CUI is not marked11:20 Why the government customer, not the prime, drives CUI marking13:27 How primes use data flow diagrams for requirement determination16:15 How primes handle non-CMMC regulatory requirements19:21 What assurance level primes are flowing down during the pause21:47 Why some primes still require certification beyond DOW mandates25:03 Manufacturing, resilience, and cybersecurity culture27:10 Assessor layoffs and the unintended consequences of CMMC29:09 Why tier two and tier three suppliers feel less urgency33:42 How the 48 CFR 7021 rule changed prime behavior36:21 Real world stakes: stolen R&D and adversary risk39:07 Bo's advice for suppliers navigating CMMC compliance40:36 Using a commercial item determination to avoid CMMC Level 2Watch the full episode, subscribe to CMMC Uncovered, and share it with someone in your supply chain who is trying to figure out what is actually CUI.Subscribe to stay informed and move forward with confidence. Follow Secure-Centric for future CMMC episodes:LinkedIn: https://www.linkedin.com/company/secure-centricWebsite: https://www.secure-centric.com/