CMMC has a price tag.  But Christine Hopkins says the number that matters is not just what the enclave, audit, or IT hire costs. It is what the entire decision costs the business.

In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson sit down with Christine Hopkins, President and CEO of Advanced Supply Chain International (ASCI), to talk about CMMC from the perspective of a small business leader who has had to make the numbers work.

Christine explains why a $10 million contract may still fail the math once NIST requirements enter the picture and why the biggest cost of compliance can sometimes be the opportunities leadership misses while preparing for it.

What You’ll Learn: 

• Why CMMC is a leadership issue, not only an IT issue
• Why Christine believes a lone NIST-required contract may need to be worth around $10 million annually to justify the cost
• How enclave costs, IT staffing, and narrow margins change the contract math
• Why leadership bandwidth is part of the real cost of compliance
• How a misunderstanding around CUI can trigger unnecessary work
• Why NIST, DCAA, procurement, ISO, and other requirements can pile up quickly
• What Christine would change to make CMMC more accessible to small businesses
• How to use AI to reduce writing without removing human judgment

Episode chapters:

00:34 Welcome to Trust Issues00:56 Meet Christine Hopkins02:57 CMMC and NIST: the small business reality05:04 When a $5M contract does not justify compliance06:14 Why waiting too long can cost opportunities07:29 The hidden opportunity cost of compliance08:07 CMMC is a company program, not an IT project08:30 Why CUI confusion gets expensive12:03 Why leadership needs to understand CMMC13:21 Preparing for CMMC with a mock audit15:50 Building a contract evaluation framework18:10 The $10M rule for NIST compliance20:45 When federal compliance requirements start stacking22:26 Understanding the full ripple effect23:01 Making CMMC easier for small businesses24:18 Building AI tools around human judgment25:41 Less writing, more thinking26:38 What happens next with CMMC?27:17 Leading through a 90% revenue loss28:43 Where to find Christine
Quotes:

1. “CMMC is not an IT project. Your entire leadership team needs to be aware of what is involved.”
2. “If it’s not worth at least $10M a year, it’s not worth it.”
3. “Take the time to understand it and understand the ripple effect impact it’s gonna have on your business, fully.”
4. “If we do it wrong, it doesn’t go to the IT person. It comes to me.”
5. “They have to do the critical thinking, and then the tool produces the output. So that’s less writing, more thinking.”
   
   

Connect with the team:

👉 Christine Hopkins on LinkedIn: https://www.linkedin.com/in/christineehopkins/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 
👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

Compliance is important, but it is not the same thing as trust.

In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson speak with Arvita Tripati about what happens when AI moves from a controlled environment into real-world workflows. Arvita explains why organizations need to look beyond written regulations and consider customer expectations, human impact, business context, and the actual behavior of AI systems.

The conversation covers the tension between moving quickly and building mature safeguards, why organizations should make room for responsible experimentation, and why AI governance needs clear ownership rather than being divided between teams.

What You’ll Learn: 

• Why regulatory compliance and customer expectations are not always the same thing
• Why AI governance has to account for the human impact of technology
• How organizations can balance grassroots AI experimentation with formal governance
• Why different AI use cases require different risk assessments
• Why AI decisions and assumptions need to be continuously reevaluated
• How clear ownership and escalation pathways make AI governance more effective
• How organizations can detect when governance processes exist on paper but fail in practice
• Why AI systems need clear accountability, monitoring, and consequences

Episode chapters:

00:26 — Welcome to Trust Issues01:51 — When Technology Creates Real Human Impact03:59 — Balancing AI Risk and Potential Benefit04:48 — Why Compliance Is Not a Checkbox08:00 — When Should You Invest in Security?09:37 — Why AI Governance Requires Constant Reevaluation10:50 — Why Visibility Matters in AI Adoption12:09 — A Two-Lane Approach to AI Adoption14:11 — Getting Leadership Behind Responsible AI17:00 — Why AI Use Cases Need Different Risk Profiles20:55 — What Boards Need to Know About AI22:03 — Why AI Accountability and Escalation Matter25:02 — How to Know if AI Governance Is Working26:32 — Who Owns AI Risk?29:21 — Why AI Managers Need Clear Accountability30:14 — Why AI Managers Need Training31:09 — Why AI Governance Can't Wait for a Crisis32:13 — What Trustworthy AI Leadership Looks Like34:32 — Key Takeaways
Quotes:

1.  “Your product needs that balance, how do you make sure it is trustworthy enough but not overbuild it?”
2. “How much risk is acceptable? How much benefit do you need to see?”
3. “Good governance with AI requires you to constantly be reevaluating your assumptions.”
4. “The escalation pathway is only as good as if somebody uses it.”
   
   

Connect with the team:
👉 Arvita Tripati on LinkedIn: https://www.linkedin.com/in/atripati/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 Jeremy Patterson on LinkedIn: linkedin.com/in/jeremypatterson2026
👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

A lot of contractors talk about compliance like it is a form to finish.

E.J. Hilbert sees it very differently.

In this episode of Trust Issues, Jeremy Patterson and Bruno Lecoq speak with E.J. Hilbert, Director of US Regulatory Compliance and Security Officer at Element Materials Technology, about the difference between compliance, security and the checkbox version of both.

What You’ll Learn: 

• Why compliance and security are related, but not the same thing
• Why checkbox compliance does not equal real protection
• Why assessors need implementation experience, not just checklists
• How HR and physical security become part of CMMC compliance
• Why U.S. person verification is not always as simple as HR assumes
• How False Claims Act exposure and whistleblower incentives create serious risk
• Why CMMC has to become a company-wide program, not an IT project
• Why contractors need to read the actual regulations instead of relying on social media opinions
  
  

Episode chapters:
00:43 Welcome to Trust Issues01:04 Meet E.J. Hilbert03:08 EJ’s path into cybersecurity and compliance06:11 Why compliance is not the enemy08:07 Why NIST 800-171 is not new08:55 Why checkbox compliance fails09:15 The problem with assessors who never built the system10:55 Good students, bad students, and the CMMC pause12:43 Why government data raises the stakes14:45 The contractor that found 35 backdoors22:19 Why CMMC needs centralized proof25:15 HR, U.S. person status, and compliance confusion29:42 Why CMMC touches every department30:02 CMMC as a program, not a project34:04 False claims, fraud, and contract penalties37:11 Why whistleblowers are a real compliance risk40:10 How false claims can threaten government work46:05 The conflict risk in the CMMC auditor model47:15 What CMMC could look like next49:29 Why government data marking needs to improve52:15 EJ’s final compliance reality check56:02 Closing thoughts from Bruno
Quotes:

1. “Compliance is not security. Security is not compliance. Compliance is understanding the regulations that have been placed on you. It’s understanding the rules under which you are supposed to work.”
2. “If you haven’t actually implemented the NIST 800-171s or the 800-53s or CSC or COBIT or any of the other ones out there, you coming in with a little checklist, that’s not compliance either.”
3. “The reason the rules are in place now with the government is because the government can’t protect its own stuff.”
4. “If I have one message to anybody out there, it's to understand the actual facts of what is being said, not the opinions of everybody else that’s being shared.”
   
   

Connect with the team: 
👉 E.J. Hilbert on LinkedIn: https://www.linkedin.com/in/ejhilbert/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 
👉 BEMO Website: https://www.bemopro.com/ Trust Issues is handcrafted by our friends over at: fame.so

AI governance is where most companies are getting it wrong. It’s not that they lack policies, but because they don’t understand what can actually go wrong with the technology they’re deploying. In this episode of Trust Issues, hosts Jeremy Patterson and Bruno Lecoq step away from their usual CMMC focus to sit down with  Dallas Bishoff, President of Process 360 and a sitting member of the ISO committees writing the rules for AI, auditing, and emerging technologies.
What You’ll Learn: 

• ISO 42001: the world’s first AI management system standard
• Why a policy document alone won’t survive an audit or a regulator
• The different flavors of AI (predictive, generative, agentic) and why each carries different risks
• The identity and permissions problem lurking inside agentic AI
• How the same AI tool can be low-risk in one department and a lawsuit waiting to happen in another

Episode chapters:

• 00:00 Episode Intro
• 00:46 Welcome to Trust Issues
• 03:26 Why History Repeats Itself in AI
• 07:29 Securing the Environment Before Deploying AI
• 10:18 Who Actually Owns AI Governance?
• 15:06 The Shadow AI Problem
• 17:51 Policy vs. Real System: What Passes an Audit
• 20:12 Internal Use vs. Building AI Into Your Product
• 23:27 The Coming 50-State AI Regulation Mess
• 26:09 Same Tool, Different Risk
• 31:02 The Legal Concept Coming for AI
• 33:18 Hallucinations, Guardrails, and the TaskRabbit Story
• 37:29 Making Decisions Without All the Answers
• 40:07 Where Can You Find Dallas?

Quotes:

1.  “AI is a very different animal in contrast to how a lot of other organizations have sort of operated, but history tends to repeat itself.”
   
   
2.  “If you want to avoid many of the challenges and stuff that you're gonna run into with AI, and if you wanna understand how to govern AI, you've got to develop an understanding of basically what can go wrong with it, and what your opportunities are.”
   
   
3.  “The number one first step in problem solving is awareness. And quite frankly, a number of organizations simply are not aware of what's happening on their networks because if all you've got are policy documents, you're so far in trouble in ways that you have no idea about.”
   
   
4.  “There are certain things that are that we absolutely will not use AI for right now that I'm not comfortable with doing. But if you don't understand what can go wrong, you're not gonna be able to protect yourself.”
   
   
5.  “You need a small matrix team of executives who basically can provide proper oversight and control and are accountable inside the organization.”
   
   

Connect with the team:
👉 Dallas Bishoff on LinkedIn: https://www.linkedin.com/in/dallasbishoff/ 

👉 PROCESS 360 Website: https://www.process360.com/contact 

👉 ISO Website: https://www.iso.org/home.html 

👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 

👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/ 

👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

A lot of contractors hear “CMMC” and immediately think of a six-figure bill.

According to Christina Reynolds, that’s the wrong place to start. 

In this episode of Trust Issues, Bruno Lecoq speaks with Christina Reynolds, Registered Practitioner Organization leader and author of Scope Small, Win Big, about where CMMC costs really come from. Her point is clear: certification is not usually the cost problem. Bad implementation decisions are.
What You’ll Learn: 

• Why CMMC certification and DFARS 7012 implementation costs are not the same thing
• How poor CUI scoping can turn a reasonable project into a million-dollar problem
• Why contractors should ask whether CUI should be present on a system, not only whether it is present
• Why Microsoft 365 Commercial can create an instant CMMC package failure
• How non-FedRAMP vendors can derail an otherwise strong package
• Why Phase One requirements still matter during the Phase Two pause
• What SPRS score metrics can block a DOD contract award
  
  

Episode chapters:

00:26 Welcome to Trust Issues00:48 Christina’s journey in defense contracting02:55 The biggest misconception about CMMC cost03:06 CMMC certification is not the real cost driver05:03 Why aggregated CUI can become a bigger security risk06:15 CMMC certification vs. DFARS 7012 implementation08:20 What the DoD actually wants to protect 10:20 The secret to scoping CUI correctly12:10 How scoping can keep CMMC costs reasonable13:19 What C3PAO assessments actually cost15:13 Why 110 self-attestation often falls apart16:19 Why self-assessment does not work16:55 Microsoft 365 Commercial as a CMMC failure point17:45 ITAR, endpoint devices, and foreign-soil violations20:10 Why GovCloud VDI matters for ITAR data21:21 CAD systems, CUI assets, and scoping decisions22:04 Why CMMC guidance is not your implementation guide24:48 Revision 3, quantum, and rising security standards25:29 What FAR changes could mean for contractors30:22 Why FedRAMP requirements are a major cost driver32:13 How FedRAMP 20x could help software vendors34:05 Why FIPS validation adds cost35:05 CMMC Pacific Northwest Conference revelations 36:03 Why the Phase Two pause is not a reason to stop37:05 Phase One requirements are still active37:35 The hidden metrics blocking DOD contract awards39:26 How SPRS scoring affects award qualification42:41 Final advice: scope small and keep moving
Quotes:

1. “CMMC doesn’t tell you to do it. All CMMC tells you is you’ve got to go seek an independent party that’s been properly trained to certify you.”
2. “When you let grade school students grade their own test, they all achieve a 100 somehow. But when you have the teacher grade their test, usually, there’s a different story to be told.”
3. “Scope small, win big.”
4. “Don’t assume that CUI is everything, everywhere, and omnipresent on every system in your environment.”
5. “All CMMC is, is show me what you’ve written for your security program, and now prove you’ve done it.”
   
   

Connect with the team: 

👉 Christina Reynolds on LinkedIn: https://www.linkedin.com/in/christina-reynolds-6705256
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 BEMO Website: https://www.bemopro.com/ Trust Issues is handcrafted by our friends over at: fame.so

The CMMC pause gave contractors more time, but it also revealed a hard truth: some companies were building security because they believed in it, while others were only reacting to the threat of being graded.
In this episode of Trust Issues, Bruno Lecoq is joined by Jeremy Patterson to unpack what the pause has shown them after weeks of conversations with contractors: the “good student vs. bad student” problem, the 88-point loophole, and why CMMC is the test, not the assignment. 
What You’ll Learn: 

• Why the CMMC pause exposed contractor behavior instead of changing it
• Why Phase One failures are often a readiness problem, not an auditor capacity problem
• Why IT reporting to the CFO can signal that security is being treated as a cost
• Why MSPs have to be treated as in-scope partners for CMMC
• Why the self-attestation mindset creates the wrong incentives
• Why CMMC should be treated as how the business operates, not a test to cram for
  
  

Episode chapters:

00:00 Welcome to Trust Issues01:00 What the CMMC pause revealed about contractor readiness03:44 Good students, bad students, and the CMMC test06:16 Why 80% fail Phase One13:20 Why some contractors keep delaying compliance15:52 Where IT reports say a lot about security culture17:04 What prepared organizations do differently20:47 Why your MSP is part of your CMMC scope27:15 What the next CMMC timeline could look like28:12 CMMC is the test, not the assignment29:17 Why self-attestation is not enough31:26 The 88-point loophole34:24 Why a longer timeline can help 35:39 Why CMMC standards will keep rising36:28 The real price of non-compliance39:43 Final takeaway: keep studying
Quotes:

1. “Some companies have been doing the reading, doing the work, the whole time, whether there’s a test on the calendar or not.”
2. “Now that it got pushed back, it seems like the people who never started still aren’t starting.”
3. “If I say that I’m an 88, they won’t check me, but if I say that I’m a 110, there’s a chance an auditor is going to check me.”

Connect with the team: 
👉 Jeremy Patterson LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 BEMO Website: https://www.bemopro.com/ 





Trust Issues is handcrafted by our friends over at: fame.so

CMMC is synonymous with confusion at this point. But this episode of Trust Issues should clear it right up. 

In this compilation episode of the podcast, Brandon and Bruno Lecoq revisit key insights from past conversations to cut through the noise around CMMC, documentation, self-attestation, and the Phase 2 suspension.

What You’ll Learn: 

• Why technical implementation can still fail if the SSP does not prove the process
• Why “periodically” needs to be clearly defined before assessors hold you to it
• Why CMMC exists because self-attestation stopped being credible
• How DFARS 252.204-7012 and NIST 800-171 led to today’s CMMC requirements
• Why the Phase 2 suspension is not permission to pause cybersecurity
• Why protecting CUI remains a contractual obligation, regardless of the audit timeline
  
  

Episode chapters:

00:00 The CMMC reality check00:26 CMMC Phase 2 suspended, cybersecurity did not00:37 Why contractors cannot relax00:56 CUI obligations under NIST 800-171 and DFARS 701202:13 False claims risk and inaccurate compliance representations03:57 Why technical implementation is not enough04:14 Your SSP has to prove your process04:32 The danger of overpromising “periodic” reviews06:13 How DFARS 252.204-7012 led to NIST 800-17106:32 Why self-attestation stopped working06:51 The SSPs and POA&Ms that exposed the problem10:45 Why CMMC became a validation requirement13:23 Final takeaway: stop treating CMMC like paperwork
Quotes:

1. You can have the most perfect implementation of the technical side and fail within 15 minutes of your assessment because you don’t have the processes to prove that you are controlling access.” - Brandon 
2. “The 252.204-7012 clause, that effort was started in like 2013. They originally said, ‘We want you to do the 800-53.’ Industry went, ‘Are you kidding? No way.’ So NIST formulated the 800-171 specifically for industry.” - Stacy 
3. “CMMC Phase 2 suspended, cybersecurity is not. You still have to continue.” - Dr. Smart
4. “The audit requirement may have changed, but the security requirement definitely has not changed.” - Dr. Smart 

Connect with the team: 

👉 Norris Carden on LinkedIn: https://www.linkedin.com/in/norriscarden/

👉 Stacy Bostjanick on LinkedIn: https://www.linkedin.com/in/stacy-bostjanick-a3b67173/

👉 Dr. Beloved Smart on LinkedIn: https://www.linkedin.com/in/belovedsmartgrcspecialistaicybersecurityinformationsecurity/

👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/

👉 Brandon Lecoq on LinkedIn: https://www.linkedin.com/in/brandon-lecoq 

👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

The CMMC Level 2 suspension has created a dangerous misunderstanding.

Some contractors are treating the pause like permission to slow down. But Dr. Beloved Smart is clear: the audit timeline may have shifted, but the obligation to protect CUI under NIST 800-171 and DFARS 7012 has not disappeared. In this episode of Trust Issues, Brandon and Bruno Lecoq speak with Dr. Smart, a Fractional CISO and AI governance strategist, about what organizations keep getting wrong about CMMC and security. 
What You’ll Learn: 

• Why the CMMC Phase Two suspension does not remove security obligations
• Why technical tools alone do not equal compliance
• How documentation and implementation gaps cause audit problems
• Why CMMC Level 1 is basic cybersecurity hygiene
• Why security needs to be owned by the C-suite, not just IT
• Why AI governance has to include training, risk assessment, and real usage visibility
  
  

Episode chapters:

01:17 Meeting Dr. Beloved Smart02:10 Dr. Smart’s path into CMMC and security governance03:49 CMMC vs. ISO 2700104:49 Documentation vs. implementation05:17 Why tools do not equal compliance06:05 Translating CMMC requirements into technical action07:12 Why half-ready customers are the biggest challenge08:07 Why the CMMC suspension is not the end of CMMC08:48 Contractors cannot relax10:30 Read past the headlines11:41 Why CMMC is not going away12:39 Why CUI clarity matters13:46 ITAR, CUI and basic security gaps15:30 CMMC level 1 is the baseline16:29 The $10B company with no security framework17:19 Why local admin is still a major problem18:18 Security is a C-suite problem20:11 Working with leadership, IT, OT and field teams20:54 Moving into AI governance21:36 Why Dr. Smart is researching robotics governance23:57 Where to start with ISO 4200125:12 AI is already inside your systems25:32 Why banning AI does not work28:45 AI risk and enterprise risk management29:15 Why BEMO mistrusts AI agents by default29:41 Prompt engineering and challenging AI outputs30:13 Matching AI agent power to operator expertise31:20 Why AI agents cannot delete data by default31:50 Why AI training matters34:00 Real-world AI adoption inside teams35:07 Using AI agents for vendor questionnaires36:38 AI for live compliance evidence collection38:04 Final thoughts with Dr. Smart
Quotes:

1. “Most organizations just believe when they have all the necessary tools in place, they’re already compliant.”
2. “One major gap I see is organizations don’t actually walk the talk.”
3. “The audit requirement may have changed, but the security requirement definitely has not changed.”
4. “Security is not an IT problem. Security is the executive problem.”

Connect with the team: 

👉 Dr. Beloved Smart on LinkedIn: https://www.linkedin.com/in/belovedsmartgrcspecialistaicybersecurityinformationsecurity/ 

👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/ 

👉 Brandon Lecoq on LinkedIn: https://www.linkedin.com/in/brandon-lecoq  

👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

CMMC Level 2 just does not work when it gets dumped on one IT person.

In this solo episode of Trust Issues, Brandon Lecoq explains why CMMC readiness has to become a company-wide initiative, not an IT side quest. He walks through the roles involved in BEMO’s own CMMC Level 2 program and shows why security, compliance, HR, operations, finance, and leadership all have real ownership.

The episode is a practical reality check for contractors who still think CMMC can be handled quietly in IT. It cannot; if leadership is not involved, if the CFO does not understand the ROI and if HR and operations are not ready to provide evidence, the program is already in trouble.
What You’ll Learn: 

• Why leadership involvement is non-negotiable for CMMC Level 2
• Why the CFO needs to understand contract value before rejecting the budget
• How one-person IT ownership creates serious compliance risk
• Why HR, operations, compliance and security all own parts of CMMC
• What BEMO’s nine-person internal CMMC support model reveals about the workload
• Why CMMC should be treated as one of the company’s biggest initiatives for the year
  
  

Episode chapters:

00:00 Introduction01:01 Why CMMC needs a real team01:30 BEMO’s own CMMC level 2 setup02:00 Why nine people are involved in BEMO’s program02:30 Why CMMC takes more than one IT person03:00 Why the CEO has to be involved03:30 Leadership silence is a CMMC failure risk04:00 Why the CFO has to understand the cost04:35 The real annual cost of CMMC level 205:15 Contract value, growth planning, and November 202606:15 Why CMMC spend needs to be tied to revenue risk07:00 Kata’s role in security engineering07:45 The single-person IT risk08:30 Why responsibilities need to be distributed09:00 Jeremiah’s role in compliance documentation09:30 Binny’s role in evidence collection10:00 Why CMMC takes a village10:15 Ron’s role in program management10:50 Cindy’s role in operations controls11:20 Sylvia’s role in HR and personnel security12:00 Why all control owners show up during the audit12:45 Julio’s role in security operations13:15 Why security owns 59% of the controls14:00 Why non-IT stakeholders still matter14:30 Building the internal coalition for CMMC15:00 Why CMMC may be your top initiative of the year15:20 Contract value vs. compliance cost
Quotes:

1. “If leadership does not get involved, you will absolutely never become CMMC Level 2 compliant.”
2. “The number one leading factor for why organizations never become ready and will not pass CMMC is because they silo everything into IT.”
3. “The CFO is really going to have to be involved because most of your companies, this is going to cost you a pretty penny.”
4. “CMMC Level 2 has many controls and assessment objectives that IT is not responsible for. You will fail if this stays within the IT organization by itself.”

Trust Issues is handcrafted by our friends over at: fame.so

A lot of contractors start CMMC Level 2 in the wrong place. They talk to five vendors, get five different answers, start drafting policies, and then realize halfway through that they still do not know who owns what or which gaps they actually need to close.

In this solo episode of Trust Issues, Brandon Lecoq walks through the more practical way to start: work backward from the audit. That means beginning with the 320 assessment objectives, going line by line with the right people in the company, and being honest about what is done, what is not, and what is unclear.

What You’ll Learn: 

• Why the 320 assessment objectives are the best place to start
• How to avoid getting stuck between conflicting vendor recommendations
• Why CMMC Level 2 is not just 110 controls
• How to build a responsibility matrix before writing policies
• What to ask vendors before buying tools or services
• Why starting with the SSP can create months of unnecessary rework
  
  

Episode chapters:

00:00 Introduction00:15 Where to start with CMMC level 2 research00:30 Why vendor advice gets confusing00:45 Working backward from the audit01:00 Start with the 320 assessment objectives01:30 CMMC as the enforcement layer of NIST 800-17102:00 The 110 controls explained02:45 Why 320 assessment objectives matter03:15 Controls vs. assessment objectives04:00 What the C3PAO actually assesses04:30 One control can have multiple parts05:28 The boring spreadsheet work you cannot skip06:30 How to run your internal gap assessment07:15 Why every assessment objective needs an owner08:00 Building your shared responsibility matrix08:45 Assigning ownership across IT, HR, operations, and vendors09:16 Ask vendors exactly what they own10:30 Why the RACI process takes time11:30 Moving from ownership into documentation11:45 What your SSP actually needs to explain12:45 Why the SSP is only one part of the documentation13:00 83 documents and 1,500+ pages of proof14:30 Policy, procedure, and proof17:15 Why does evidence come after the documentation18:15 What the C3PAO audit actually looks like19:15 Work backward from the spreadsheet20:21 Don’t start with the SSP21:15 Why early documentation creates rework22:00 When vendor conversations should begin22:30 Identifying the tools you still need23:30 Why ITAR can change your tool choices24:15 How certified MSPs, MSSPs, and RPOs can help25:30 How BEMO can share CMMC responsibility26:30 Assigning ownership across the full company27:15 Why SMBs often need outside support27:44 Bring the shared responsibility matrix to every vendor conversation28:41 Final takeaway: stop guessing before the audit
Quotes:

“You have your 110 controls, but then there are 320 assessment objectives related to those 110 controls. You just have to do it. It’s extremely boring, and it’s going to be time-consuming to go through 320 rows on a spreadsheet.”

“You should not even tackle the SSP and policies and procedures and the evidence package until you’ve truthfully completed the first three steps.”

“When you are equipped with that spreadsheet, you are no longer doing all this hand-waving when you’re talking to vendors.”

“Start by going line by line through the assessment objectives and security controls and trying to determine who owns what.”

Connect with the team: 

👉 Brandon Lecoq on LinkedIn: https://www.linkedin.com/in/brandon-lecoq  

👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/ 

👉 BEMO Website: https://www.bemopro.com/ 


Trust Issues is handcrafted by our friends over at: fame.so