The CMMC Hot Mic

Regis DeVeaux and Khanh Tran of Biorn Group Cyber unpack who owns what when government contractors work toward CMMC compliance. They distinguish the MSP’s technical role from the compliance advisor’s work on policies, evidence, and program oversight—and explain why the organization remains accountable for its security. The conversation highlights practical ways to define shared responsibilities, set the right scope, and strengthen access controls. Tran also explains why continuous maintenance and monitoring matter long after an assessment, including regular reviews of evidence and organizational changes. From cybersecurity basics to mentorship, the discussion offers a candid look at building a stronger, more collaborative defense industrial base.

Quotes:

1. “You cannot depend on people. You have to depend on your policies and procedures.”
2. “The hardest thing to do is taking the first step.”
3. “You have to find a mentor that listens and asks you questions, not talks about their life.”

Takeaways:

1. Make responsibilities explicit. Define what the organization, MSP, and compliance advisor each own using a shared responsibility matrix or RACI chart.
2. Get scope and access controls right. Confirm system boundaries and asset inventories, assign role-based access, and establish clear joiner, mover, and leaver procedures.
3. Treat compliance as ongoing work. Pair technical maintenance with regular monitoring, evidence reviews, and risk analysis when the organization changes.

Timestamp:

00:00 — Welcome to the CMMC Hot Mic  
02:10 — Khan Tran’s Journey into Cybersecurity  
07:39 — Education-First Cybersecurity  
11:48 — What an MSP Covers and What It May Miss  
16:39 — IT Management vs. Compliance  
20:00 — The CMMC Pause and Its Impact  
24:43 — CMMC as a Cybersecurity Maturity Journey  
30:36 — Defining Shared Responsibilities  
36:37 — Incident Response, Risk, and Insurance  
43:38 — Closing Access Control Gaps  
49:18 — Physical Security and Visitor Procedures  
51:05 — How Cybersecurity Frameworks Fit Together  
59:58 — Continuous Monitoring and Maintenance  
01:05:03 — The First Step Toward Closing the IT-Compliance Gap  
01:12:30 — Protecting the Warfighter, Mentorship, and Perspective

Conclusion

Strong cybersecurity depends on clear ownership between the organization, its MSP, and its compliance advisor. A shared responsibility matrix helps everyone understand who implements safeguards, verifies them, and keeps them working. CMMC is an ongoing effort that calls for regular monitoring, evidence reviews, and thoughtful change management, not a one-time checkbox. Organizations can make progress by defining their scope, addressing security gaps, and taking the next practical step. By working together and investing in education, the defense industrial base can better protect sensitive information and the warfighter.

Ready to strengthen your cybersecurity and understand CMMC? 
Connect with Khan Tran of Biorn Group Cyber for education-first guidance on defining your scope, clarifying shared responsibilities, and building a continuous compliance program so you know who fixes each gap, who verifies it, and who keeps it fixed.

 ✉️ Email: [email protected]
💼 Connect on LinkedIn: https://www.linkedin.com/in/khanh-t-48842151/ 
🌐 Visit : https://biorngroupcyber.com/about/leadership/khanh-tran/

Host Regis DeVeaux interviews Judy Bradt, CEO of Summit Insight, on why federal contractors must move beyond small business certifications as “borrowed advantage” and instead articulate the enduring value and outcomes they deliver. Judy explains that certifications help vendors get to award but don’t keep them there, and she urges companies to lead with clearly defined capabilities, differentiators, and results. She shares a three-part framework: focus, connection, and consistency, and breaks down the five key relationship layers in the federal space, from end users and contracting officers to small business specialists, primes, and high-level stakeholders. The discussion also explores resilience in sales, reframing rejection as “not right now,” and how human connection and empathy underpin long-term success in federal contracting, cybersecurity, and CMMC-related work.

Takeaways:

1. Certifications are a borrowed advantage - set-asides and small business labels help you get to contract award, but they don’t keep you there; enduring advantage comes from the value, outcomes, and trust you deliver over time.
2. Win with focus, connection, and consistency - choose your market based on data, build relationships across all five federal roles (end users, contracting, small business office, primes, stakeholders), and show up regularly with real value.
3. Rejection isn’t the end; it’s information - “no” usually means “not right now,” and the silence between responses is where strong sellers learn, adjust, and deepen relationships instead of walking away.

 Quotes:

1. “If you build it, they will only happen in the movies.” 
2. “What problem do you solve, and who do you solve it for? Because when somebody has introduced themselves by listing their certifications, I haven’t learned anything about what they do.”
3. “If you serve all, then you serve no one. You must choose, and choose with confidence where you’re going to be spending over 80% of your outbound relationship building and time and effort.” 

Timeline:

00:00 Borrowed Advantage vs. Enduring Advantage

02:15 Judy Bratt’s 38 Years in Federal Contracting

04:10 Why Leading with Certifications Falls Short

07:05 What Federal Buyers Really Want to Hear

10:20 Defining “Borrowed Advantage” in Government Contracting

13:05 Defining “Enduring Advantage” and Why It Matters

16:10 Using Certifications Without Letting Them Define You

19:00 Best Values: Quantifiable, Verifiable Differentiators

22:15 Building Everyday Value Through Micro-Purchases

25:30 The Three Pillars: Focus, Connection, Consistency

29:10 How to Focus Using Federal Contract Data

32:30 The Five Federal Relationship Layers Explained

37:10 The Danger of “Unearned Introductions” to Stakeholders

41:00 Handling Rejection and Silence in Federal Sales

45:00 Mindset, Resilience, and Long-Game Relationship Building

48:00 How to Learn More About Borrowed vs. Enduring Advantage 

Conclusion:

A sustainable federal contracting strategy can’t rest on certifications alone; it has to be built on the enduring advantage of clearly defined value, proven outcomes, and trusted relationships. Judy Brat’s framework of focus, connection, and consistency shows contractors exactly where to aim their efforts, who they truly need to build relationships with, and how to keep showing up with value over the long sales cycle. By shifting from “we’re 8(a), woman-owned, HUBZone” to “here’s the problem we solve and the mission outcomes we improve,” companies position themselves to win, perform, and re-win work even as rules and programs change. Contractors who embrace this mindset and learn to see “no” as “not right now” will keep growing in federal, cybersecurity, and CMMC-driven markets.

CMMC Phase 2 is paused, but NIST SP 800‑171, DFARS 7012, and Phase 1 self‑assessments are still fully in force, so contractors cannot treat CMMC as “over.” Derrich Phillips explains that third‑party C3PAO assessments are likely to remain a core part of the ecosystem and that Level 2 certification is already a competitive advantage with primes and the DoD. A defensible SPRS score requires a detailed System Security Plan, adequate and sufficient evidence, and tight alignment between written policies, staff behavior, and technical configurations. Small and midsize contractors often struggle with scoping (over‑including systems and users, creating a costly “CMMC tax”) and with treating CMMC as a checkbox rather than a culture shift built on training, incident response planning, and continuous improvement. Derek recommends that unprepared orgs urgently fix scope and cloud usage, “paper‑thin” orgs shore up POA&Ms and evidence with expert help, and nearly‑ready orgs move ahead with Level 2 certification to gain ground while others stall during the pause. 

Takeaways: 

1. CMMC Pause: What Actually Changed (and What Didn’t) 
2. Defensible SPRS Scores and the Real Compliance Burden 
3. Smart Scoping, Culture Shift, and Using Level 2 as a Competitive Edge 

Quotes:

1. “Checking your own homework self‑attestation is not a viable path forward to securing national security and sensitive information.” 
2. “Your system security plan tells your compliance story; it can’t be a three‑page document if you’re trying to address 110 requirements and 320 assessment objectives.” 
3. “Our adversaries aren’t pausing, so if you pause your CMMC efforts now, you’re going to pay a much higher price trying to regain that momentum later.” 

Conclusion: 

CMMC’s Phase 2 pause might have rattled the headlines, but Derrich Phillips makes it clear that the real obligations, risks, and opportunities for defense contractors haven’t gone anywhere. The organizations that treat this period as extra runway, tightening scope, hardening their SPRS story, and building a true security culture will be the ones primes and the DoD trust most when the dust settles. Rather than waiting for perfect clarity from Washington, Derek’s guidance is to keep moving: get your environment compliant, your evidence defensible, and, if you’re close, push through to Level 2. The pause is temporary; the need to safeguard national security data is permanent.