CMMC Wars

Could CMMC have saved the Empire? Kelly and Greg head to the forest moon of Endor to dig into physical security under NIST SP 800-171, using the Rebels' break-in at the shield generator bunker as a case study for every door, badge, and visitor your own facility has to account for.

They cover what the 3.10 family actually requires, what "organizational systems," "support infrastructure," and "alternative work sites" really mean, and who counts as a visitor versus an authorized individual (including your MSP and your cleaning crew). Plus: why cameras alone will not secure your server rack, why printers drag manufacturers into scope, how to check out CUI drawings across three shifts with a folder and a sign-out sheet, why a policy by itself is not real protection, and why your AI-written SSP is probably too long.

🎧 New episodes monthly. May the CUI be with you.

Timestamps:

0:00 Welcome to CMMC Wars
5:18 Welcome to Endor
7:35 The old access code
11:06 Propped doors and hot shop floors
14:10 What "organizational systems" really means
20:09 Visitor or authorized individual?
22:56 What to do about the cleaning crew
28:23 What counts as a remote employee?
41:08 Printers are computers
48:13 Checking out prints across three shifts
52:03 Cameras do not control access
58:26 Visitor logs vs. audit records
1:05:50 Alternative work sites
1:10:53 Say what you do, do what you say, prove it
1:12:47 Keep your policies short (and watch the AI)
1:24:33 Run the scenarios: CUI is an infection
1:29:32 Closing thoughts

#CMMC #NIST800171 #CUI #CyberSecurity #PhysicalSecurity #StarWars

One device or two? Kelly and Greg tackle "the rule of two," the question every defense contractor eventually has to answer: how do you actually keep CUI separated from your everyday business systems, without grinding your operations to a halt in the process?

They cover the real tradeoffs of running two devices versus two tenants, what it costs (in dollars and in sanity) to do it properly, the shortcuts employees take when the setup gets in their way, and why "we bought GCC High" doesn't mean you're compliant. Plus: the castle analogy that makes CUI scoping click, and what actually happens if someone accidentally emails you sensitive data.

🎧 New episodes monthly. May the CUI be with you.

Timestamps:

0:00 Intro
6:29 The rule of two
10:44 One device or two?
15:39 What is a "swivel seat"?
20:31 The manufacturing problem with two systems
22:30 Same part, different process
23:10 The shortcuts that fail your assessment
29:20 The castle analogy
30:26 Getting two tenants to talk
34:37 Can you trust the other tenant?
38:44 Keep them separated
41:33 The real cost of two tenants
44:29 Why is GCC High so expensive?
46:57 CMMC in three words
48:10 The two-inbox problem
51:17 Make the right thing easy
53:02 Does an accidental CUI email put you in scope?
57:12 Protecting the holocron
58:19 No printing, no exceptions
59:25 Getting your network out of scope
1:01:25 The VLAN myth
1:02:38 What counts as a security protection asset?
1:05:33 Two laptops, twice the work
1:08:19 The price of carrying two laptops
1:09:07 The Goldilocks zone
1:10:43 Plan first, build once

#CyberSecurity #TechTok #Explained #BusinessTips #DataPrivacy #CMMC

Your MSP could be the reason you pass your CMMC assessment, or the reason you fail it. In this episode of CMMC Wars, Greg and Kelly break down how to tell whether your managed service provider is a Jedi (a true partner who understands their role and produces evidence) or a Jawa (someone selling you a broken protocol droid and hoping you don't check under the hood).

They walk through the official CMMC definitions of an External Service Provider, MSP, and Cloud Service Provider, how different data types (FCI, CUI, and Security Protection Data) change your scope, what belongs in a real Shared Responsibility Matrix, and the eight questions every manufacturer should ask their IT provider before an assessment. If you rely on an MSP for any part of your CMMC environment, and most companies do, this episode will change how you think about that relationship.

----

04:46 What is a Managed Service Provider?
08:46 ESP vs. MSP vs. CSP: the official definitions
12:40 Why scope matters (a real assessment horror story)
15:44 Is your MSP secretly a Cloud Service Provider?
18:10 FCI, CUI, and SPD: what data is your MSP touching?
22:24 What happens if your MSP holds CUI?
26:52 8 questions to ask any MSP
28:55 Level One scoping and service level agreements
32:11 Level Two scoping and the Shared Responsibility Matrix
38:30 Building your Shared Responsibility Matrix
45:39 Two ways to keep your MSP out of scope
56:35 Decompose the handoff: evidence collection
59:15 Jawa vs. Jedi: spotting the warning signs
1:00:24 Three MSP models: Bounty Hunter, Partnership, Jedi and Padawan
1:13:13 Five closing questions for the Jedi Council

Subscribe for a new episode every month, and share this with anyone who thinks "my MSP handles that" is a complete CMMC answer.

#CMMC #CMMCWars #Cybersecurity #ManufacturingCybersecurity #CUI #ManagedServiceProvider #DefenseContractors #NIST800171 #ITCompliance #StarWars