Trust Issues

Cybersecurity has changed significantly since BEMO first shared its nine tips for preventing cyberattacks in 2022. Yet, even as new technologies and AI-driven threats emerge, organizations continue to face challenges implementing the fundamentals consistently.

In this episode of Trust Issues, host Bruno Lecoq sits down with Laura Arce to revisit the cybersecurity practices businesses need to take seriously in 2026. They explore why multi-factor authentication remains one of the most effective ways to reduce account compromise risks, how passkeys are changing authentication, and why password vaults and timely software updates remain essential.

The conversation also examines the growing challenge of managing access in an environment where employees, administrators, and AI agents may all require different levels of permission.  

A particularly memorable example demonstrates how a fake hotel Wi-Fi network can trick unsuspecting users into connecting to the wrong network, illustrating how easily everyday habits can create security vulnerabilities.

What You’ll Learn

• Why multi-factor authentication remains one of the most important safeguards against account compromise.
• How passkeys can reduce reliance on traditional passwords.
• Why password vaults support stronger password habits.
• How delayed software updates can leave organizations exposed to known vulnerabilities.
• Why access permissions should be limited to what each person or system actually needs.
• How AI agents introduce new questions around access, ownership and governance.
• Why just-in-time administrative access can reduce unnecessary privilege exposure.
• Why collecting security logs is not enough without reviewing them.
• How fake public Wi-Fi networks can expose users to security risks.
• How backups and phishing simulations contribute to a stronger security posture.
• Why employee awareness and consistent security practices matter as much as technology.
  
  

Episode Chapters: 
00:00 - Welcome
 02:27 - Revisiting BEMO’s Cybersecurity Tips in 2026
 02:47 - MFA and Passkeys: Strengthening Authentication
 05:21 - Password Vaults and Stronger Password Habits
 08:51 - Why Software Updates Shouldn’t Be Delayed
 11:04 - Access Control and the New Challenge of AI Governance
 14:29 - Just-in-Time Access: Limiting Administrative Privileges
 18:13 - Endpoint Protection and Why Log Reviews Matter
 21:52 - The Public Wi-Fi Trap: A Social Engineering Demonstration
 25:59 - Data Backups and Understanding Your Responsibilities
 27:39 - Phishing Simulations and Employee Security Awareness
 30:32 - Three Cybersecurity Priorities for Businesses
 31:32 - Closing Thoughts

Quotes:
"If you have MFA enabled, you already remove a 90% chance of being hacked."
"You have the logs, but are you reviewing it?"
"MFA is putting a key on your identity."
"By default, no one in the company has global admin. By default, you have to always request access"Trust Issues is handcrafted by our friends over at: fame.so

When compliance becomes another job for the one person already running IT, nothing good is coming out of that. 
In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson dig into the people problem hiding inside CMMC, ISO, SOC 2, and other compliance programs. They talk about why one IT person should never carry the whole program, how BEMO automated away the monthly screenshot grind, and why a “110 out of 110” CMMC score deserves questions, not applause.

Plus, a deep dive into what happens when critical security knowledge lives in one employee’s head, why an SSP should help the next person understand the environment and where AI actually helps without replacing human judgment.

What You’ll Learn: 

• Why compliance should never be dumped on one IT person
• How to tell when security work has become administrative overload
• Why BEMO automates screenshot and evidence collection
• Why a claimed 110/110 CMMC score can fall apart under basic questions
• Why good documentation protects you when key employees leave
• What perpetual audit readiness actually feels like
• Why AI should support expertise, not replace it
• Why leaders need to watch overtime, weekend work, and team capacity
• Why IT and compliance should not be the same function
  
  

Episode chapters:

00:00 Why Bruno doesn’t trust AI00:45 Welcome to Trust Issues01:38 Why compliance needs the right team03:29 The “Can you get CMMC done by Monday?” problem04:09 How much security is actually enough?05:50 Automating the compliance evidence grind07:27 Why 110 out of 110 deserves questions09:18 Why cybersecurity burnout is so common10:47 Documentation that survives employee turnover12:15 What perpetual audit readiness feels like14:39 When one IT person leaving breaks everything16:35 Why standardized IT reduces key-person risk18:45 AI should be the co-pilot, not the pilot23:53 Leaders need to catch burnout early24:44 When the team has 12 projects and capacity for 1026:41 Why compliance and IT need separation27:27 Final takeaway28:03 Closing thoughts from Trust Issues
Quotes:

Jeremy Patterson:

“Compliance is supposed to make a company safer, but if the people doing the work are worn out, you could end up losing the very thing you were trying to protect: knowledgeable people.” 


“A healthy compliance program could cross the line into administrative burden.” 


“Reading policies and procedures isn’t like reading a novel; it’s tedious, and there are many details you really have to pay attention to. It takes a lot of brainpower and a heavy cognitive load.”

Bruno Lecoq: 

“If you don’t need to do compliance, don’t go there. Once you start, compliance is expensive, and you have to keep doing it.”

“I don’t trust AI, even though I use it all the time. You couldn’t take it away from me, but I don’t trust it; I challenge it and use it to challenge me.” 

“If you have capacity for 10 projects but have 12, figure out which two to drop.”
Connect with the team: 

👉 Jeremy Patterson LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 

👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/ 

👉 BEMO Website: https://www.bemopro.com/ 



Trust Issues is handcrafted by our friends over at: fame.so

CMMC comes with plenty of outside help in the form of RPOs, consultants, assessors, and even tools. But know this: none of them can own it for you.

In this Greatest Hits edition of Trust Issues, Bruno Lecoq revisits standout moments with Cindy Oliveto, Brandon Lecoq, Jeremy Patterson, Jacob Anderson and Christine Hopkins.

Five moments from five very different perspectives bring out one recurring lesson: You cannot outsource ownership.
What You’ll Learn: 

• Why working with an RPO does not transfer accountability
• Why the 320 assessment objectives belong with more than IT
• What Jeremy’s 81/19 rule says about consultant support
• Why CMMC requires real internal follow-through
• Why finding your CUI boundary should come before building outward
• How cross-functional ownership changes CMMC readiness
• Why transparency can matter as much as controls when a team is under pressure
  
  

Episode chapters:

00:01 Welcome to Trust Issues00:23 Why CMMC accountability stays with the customer01:19 The 320 assessment objectives nobody wants to read02:05 The 81/19 rule for CMMC readiness03:04 Start with where your CUI lives03:23 The team that stayed through the “chart of death”04:07 Why CMMC Level 2 takes a village04:33 Closing thoughts
Quotes:

1. Cindy Oliveto: “We are just surfacing the information they need to know, and then decisions are made, and they are the approvers of those decisions.”
   
   
2. Brandon Lecoq: “The most important part of where you should start is simply looking at the spreadsheets. It’s extremely boring, right? But you just have to do it.”
   
   
3. Jeremy Patterson: “We can help you get 81% of the way there. But you need to study. You need to do your work.”
   
   
4. Jacob Anderson: “That’s all we care about: where CUI is going to be.”
   
   
5. Christine Hopkins: “Probably the proudest thing would be that they all stayed during the darkest period. For about two and a half years, we were running out of cash within three months, and none of them left during that period.”
   
   

Connect with the team: 

👉 Cindy Oliveto on LinkedIn: https://www.linkedin.com/in/cindyoliveto/?isSelfProfile=false  

👉Brandon Lecoq on LinkedIn: https://www.linkedin.com/in/brandon-lecoq/?isSelfProfile=false 

👉Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 

👉Jacob Anderson on LinkedIn: https://www.linkedin.com/in/jacobwanderson/?isSelfProfile=false 

👉Christine Hopkins on LinkedIn: linkedin.com/in/christineehopkins 

👉Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/ 

👉 BEMO Website: https://www.bemopro.com/ Trust Issues is handcrafted by our friends over at: fame.so

What does a CMMC assessor notice before the scoring even starts? Quite a lot, it turns out. 

In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson sit down with Erin O’Donnell, CMMC assessor at Wise Technical Innovations, to talk about what separates organizations that genuinely understand their environment from those that look prepared on paper.

Erin gets into why every company should read its System Security Plan line by line, how assessors think about data flows, security boundaries, and evidence, and why a pause or imperfect answer is not necessarily the problem. The bigger concern is when nobody inside the company can explain how its own environment actually works.
What You’ll Learn: 

• Why your SSP can become either your strongest asset or a major liability
• What assessors notice when a company does not fully understand its own environment
• Why data flows, security boundaries, and asset inventories matter so much
• Where AI-generated compliance documentation can create problems
• Why CMMC has to continue long after certification day
• Why missing one objective can leave an entire control “not met”
• How honesty about missing evidence can work better than bluffing
• Why a good consultant should teach you to defend the environment yourself
• Why mock assessments can expose problems while you still have time to fix them
  
  

Episode chapters:

00:00 Welcome to Trust Issues by BEMO01:00 Meeting Erin O’Donnell02:01 What assessors are seeing as CMMC changes03:09 Erin’s assessor and small business perspectives05:03 Why you need to read every line of your SSP05:52 The AI documentation trap07:03 What assessors notice in the room09:21 Data flows, boundaries and knowing your environment10:43 The art of the pause during an assessment13:19 What a good CMMC consultant actually looks like15:35 Why CMMC has to become part of the culture17:23 Certification is not the finish line19:58 Rev 2, Rev 3 and what comes next22:07 Why every control objective needs evidence23:47 Why honesty beats pretending25:32 Cloud vs. on-prem assessment realities27:29 What to do 90 days before assessment29:00 The “hit by a bus” test for your SSP30:21 Building compliance you can actually maintain30:45 Avoiding consultant dependency31:16 Mock assessments, training and where to find Erin33:25 Final thoughts33:48 Closing thoughts from Trust Issues
Quotes:

1. “Read every line of your SSP. You don’t want to be in an assessment and get surprised by the wording in your documentation.”
2. “Companies that embrace it as a cultural mindset: all of the data that enters that company is better protected.”
3. “This is supposed to be going on and on and on for the life of CUI in your organization. It’s not a one-time compliance exercise.”
4. “The mark of a really good consultant is when the consultant doesn’t have to describe the environment to me, but the client can.”
5. “If you’re going to use a consultant, find someone who is going to make it so that you can defend your own environment.”
   
   

Connect with the team: 

👉 Erin O’Donnell on LinkedIn: https://www.linkedin.com/in/erinodonnellbend/ 

👉 Wise Technical Innovations Website: https://wtinetworks.com/ 

👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/ 

👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/  

👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

A lot of companies are trying to govern AI with a policy document and a prayer.

Ashley Casovan calls out that misguided approach in this episode of Trust Issues. 

Jeremy Patterson and Bruno Lecoq speak with Ashley, Managing Director at the IAPP’s AI Governance Center, about what it really takes to govern AI when the technology keeps moving faster than the rules. The conversation gets into why AI governance needs policies, processes, and people, why technical teams and policy teams often talk past each other, and why the “innovation vs. regulation” debate is the wrong fight.

What You’ll Learn: 

• Why AI governance depends on people, not only policies
• How Ashley helped build Canada’s first national responsible AI policy
• Why ISO 42001 pushes organizations to look at the whole AI management system
• How BEMO thinks about AI agents as digital workers
• Why powerful AI agents need experienced human owners
• Why technical, policy, legal, and security teams need a shared language
• Why AI harms are real, even if panic is not useful
• Why “innovation vs. regulation” is the wrong way to frame the AI debate

Episode chapters:

00:34 Welcome to Trust Issues00:52 Meeting Ashley Casovan01:46 Ashley’s path from Alberta politics to AI governance04:12 How do you govern a moving target?06:28 Ashley’s path to IAPP08:33 ISO 42001 and governing AI agents10:35 What AI governance really means11:46 How BEMO manages digital workers13:31 Building Canada’s first responsible AI policy21:17 Why data and AI governance are connected23:51 Can policy keep up with AI?25:07 Why AI governance needs many roles27:06 Why AI guardrails need real-world consequences32:31 Why standards and community matter34:07 Why technical and policy teams talk past each other36:46 Managing uneven AI adoption inside a company41:43 Individual choice vs. systemic AI risk43:18 Why innovation vs. regulation is the wrong debate45:27 Where to find Ashley46:06 Closing thoughts
Quotes:

1. “AI governance is all of the different types of policies, processes and people considerations needed to effectively manage your AI system in a safe and trusted manner.”
2. “The same concepts that have applied in other types of safety or trust environments where we’re working with tools and technology are still relevant.”
3. “We need to have people with multiple perspectives in the room to tackle any governance attempt.”
4. “We need to stop having these conversations about innovation versus regulation.”
   
   

Connect with the team: 

👉 Ashley Casovan on LinkedIn: https://www.linkedin.com/in/ashley-casovan-b3247211/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 
👉 BEMO Website: https://www.bemopro.com/ Trust Issues is handcrafted by our friends over at: fame.so

CMMC has a price tag.  But Christine Hopkins says the number that matters is not just what the enclave, audit, or IT hire costs. It is what the entire decision costs the business.

In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson sit down with Christine Hopkins, President and CEO of Advanced Supply Chain International (ASCI), to talk about CMMC from the perspective of a small business leader who has had to make the numbers work.

Christine explains why a $10 million contract may still fail the math once NIST requirements enter the picture and why the biggest cost of compliance can sometimes be the opportunities leadership misses while preparing for it.

What You’ll Learn: 

• Why CMMC is a leadership issue, not only an IT issue
• Why Christine believes a lone NIST-required contract may need to be worth around $10 million annually to justify the cost
• How enclave costs, IT staffing, and narrow margins change the contract math
• Why leadership bandwidth is part of the real cost of compliance
• How a misunderstanding around CUI can trigger unnecessary work
• Why NIST, DCAA, procurement, ISO, and other requirements can pile up quickly
• What Christine would change to make CMMC more accessible to small businesses
• How to use AI to reduce writing without removing human judgment

Episode chapters:

00:34 Welcome to Trust Issues00:56 Meet Christine Hopkins02:57 CMMC and NIST: the small business reality05:04 When a $5M contract does not justify compliance06:14 Why waiting too long can cost opportunities07:29 The hidden opportunity cost of compliance08:07 CMMC is a company program, not an IT project08:30 Why CUI confusion gets expensive12:03 Why leadership needs to understand CMMC13:21 Preparing for CMMC with a mock audit15:50 Building a contract evaluation framework18:10 The $10M rule for NIST compliance20:45 When federal compliance requirements start stacking22:26 Understanding the full ripple effect23:01 Making CMMC easier for small businesses24:18 Building AI tools around human judgment25:41 Less writing, more thinking26:38 What happens next with CMMC?27:17 Leading through a 90% revenue loss28:43 Where to find Christine
Quotes:

1. “CMMC is not an IT project. Your entire leadership team needs to be aware of what is involved.”
2. “If it’s not worth at least $10M a year, it’s not worth it.”
3. “Take the time to understand it and understand the ripple effect impact it’s gonna have on your business, fully.”
4. “If we do it wrong, it doesn’t go to the IT person. It comes to me.”
5. “They have to do the critical thinking, and then the tool produces the output. So that’s less writing, more thinking.”
   
   

Connect with the team:

👉 Christine Hopkins on LinkedIn: https://www.linkedin.com/in/christineehopkins/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 
👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

Compliance is important, but it is not the same thing as trust.

In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson speak with Arvita Tripati about what happens when AI moves from a controlled environment into real-world workflows. Arvita explains why organizations need to look beyond written regulations and consider customer expectations, human impact, business context, and the actual behavior of AI systems.

The conversation covers the tension between moving quickly and building mature safeguards, why organizations should make room for responsible experimentation, and why AI governance needs clear ownership rather than being divided between teams.

What You’ll Learn: 

• Why regulatory compliance and customer expectations are not always the same thing
• Why AI governance has to account for the human impact of technology
• How organizations can balance grassroots AI experimentation with formal governance
• Why different AI use cases require different risk assessments
• Why AI decisions and assumptions need to be continuously reevaluated
• How clear ownership and escalation pathways make AI governance more effective
• How organizations can detect when governance processes exist on paper but fail in practice
• Why AI systems need clear accountability, monitoring, and consequences

Episode chapters:

00:26 — Welcome to Trust Issues01:51 — When Technology Creates Real Human Impact03:59 — Balancing AI Risk and Potential Benefit04:48 — Why Compliance Is Not a Checkbox08:00 — When Should You Invest in Security?09:37 — Why AI Governance Requires Constant Reevaluation10:50 — Why Visibility Matters in AI Adoption12:09 — A Two-Lane Approach to AI Adoption14:11 — Getting Leadership Behind Responsible AI17:00 — Why AI Use Cases Need Different Risk Profiles20:55 — What Boards Need to Know About AI22:03 — Why AI Accountability and Escalation Matter25:02 — How to Know if AI Governance Is Working26:32 — Who Owns AI Risk?29:21 — Why AI Managers Need Clear Accountability30:14 — Why AI Managers Need Training31:09 — Why AI Governance Can't Wait for a Crisis32:13 — What Trustworthy AI Leadership Looks Like34:32 — Key Takeaways
Quotes:

1.  “Your product needs that balance, how do you make sure it is trustworthy enough but not overbuild it?”
2. “How much risk is acceptable? How much benefit do you need to see?”
3. “Good governance with AI requires you to constantly be reevaluating your assumptions.”
4. “The escalation pathway is only as good as if somebody uses it.”
   
   

Connect with the team:
👉 Arvita Tripati on LinkedIn: https://www.linkedin.com/in/atripati/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 Jeremy Patterson on LinkedIn: linkedin.com/in/jeremypatterson2026
👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

A lot of contractors talk about compliance like it is a form to finish.

E.J. Hilbert sees it very differently.

In this episode of Trust Issues, Jeremy Patterson and Bruno Lecoq speak with E.J. Hilbert, Director of US Regulatory Compliance and Security Officer at Element Materials Technology, about the difference between compliance, security and the checkbox version of both.

What You’ll Learn: 

• Why compliance and security are related, but not the same thing
• Why checkbox compliance does not equal real protection
• Why assessors need implementation experience, not just checklists
• How HR and physical security become part of CMMC compliance
• Why U.S. person verification is not always as simple as HR assumes
• How False Claims Act exposure and whistleblower incentives create serious risk
• Why CMMC has to become a company-wide program, not an IT project
• Why contractors need to read the actual regulations instead of relying on social media opinions
  
  

Episode chapters:
00:43 Welcome to Trust Issues01:04 Meet E.J. Hilbert03:08 EJ’s path into cybersecurity and compliance06:11 Why compliance is not the enemy08:07 Why NIST 800-171 is not new08:55 Why checkbox compliance fails09:15 The problem with assessors who never built the system10:55 Good students, bad students, and the CMMC pause12:43 Why government data raises the stakes14:45 The contractor that found 35 backdoors22:19 Why CMMC needs centralized proof25:15 HR, U.S. person status, and compliance confusion29:42 Why CMMC touches every department30:02 CMMC as a program, not a project34:04 False claims, fraud, and contract penalties37:11 Why whistleblowers are a real compliance risk40:10 How false claims can threaten government work46:05 The conflict risk in the CMMC auditor model47:15 What CMMC could look like next49:29 Why government data marking needs to improve52:15 EJ’s final compliance reality check56:02 Closing thoughts from Bruno
Quotes:

1. “Compliance is not security. Security is not compliance. Compliance is understanding the regulations that have been placed on you. It’s understanding the rules under which you are supposed to work.”
2. “If you haven’t actually implemented the NIST 800-171s or the 800-53s or CSC or COBIT or any of the other ones out there, you coming in with a little checklist, that’s not compliance either.”
3. “The reason the rules are in place now with the government is because the government can’t protect its own stuff.”
4. “If I have one message to anybody out there, it's to understand the actual facts of what is being said, not the opinions of everybody else that’s being shared.”
   
   

Connect with the team: 
👉 E.J. Hilbert on LinkedIn: https://www.linkedin.com/in/ejhilbert/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 
👉 BEMO Website: https://www.bemopro.com/ Trust Issues is handcrafted by our friends over at: fame.so

AI governance is where most companies are getting it wrong. It’s not that they lack policies, but because they don’t understand what can actually go wrong with the technology they’re deploying. In this episode of Trust Issues, hosts Jeremy Patterson and Bruno Lecoq step away from their usual CMMC focus to sit down with  Dallas Bishoff, President of Process 360 and a sitting member of the ISO committees writing the rules for AI, auditing, and emerging technologies.
What You’ll Learn: 

• ISO 42001: the world’s first AI management system standard
• Why a policy document alone won’t survive an audit or a regulator
• The different flavors of AI (predictive, generative, agentic) and why each carries different risks
• The identity and permissions problem lurking inside agentic AI
• How the same AI tool can be low-risk in one department and a lawsuit waiting to happen in another

Episode chapters:

• 00:00 Episode Intro
• 00:46 Welcome to Trust Issues
• 03:26 Why History Repeats Itself in AI
• 07:29 Securing the Environment Before Deploying AI
• 10:18 Who Actually Owns AI Governance?
• 15:06 The Shadow AI Problem
• 17:51 Policy vs. Real System: What Passes an Audit
• 20:12 Internal Use vs. Building AI Into Your Product
• 23:27 The Coming 50-State AI Regulation Mess
• 26:09 Same Tool, Different Risk
• 31:02 The Legal Concept Coming for AI
• 33:18 Hallucinations, Guardrails, and the TaskRabbit Story
• 37:29 Making Decisions Without All the Answers
• 40:07 Where Can You Find Dallas?

Quotes:

1.  “AI is a very different animal in contrast to how a lot of other organizations have sort of operated, but history tends to repeat itself.”
   
   
2.  “If you want to avoid many of the challenges and stuff that you're gonna run into with AI, and if you wanna understand how to govern AI, you've got to develop an understanding of basically what can go wrong with it, and what your opportunities are.”
   
   
3.  “The number one first step in problem solving is awareness. And quite frankly, a number of organizations simply are not aware of what's happening on their networks because if all you've got are policy documents, you're so far in trouble in ways that you have no idea about.”
   
   
4.  “There are certain things that are that we absolutely will not use AI for right now that I'm not comfortable with doing. But if you don't understand what can go wrong, you're not gonna be able to protect yourself.”
   
   
5.  “You need a small matrix team of executives who basically can provide proper oversight and control and are accountable inside the organization.”
   
   

Connect with the team:
👉 Dallas Bishoff on LinkedIn: https://www.linkedin.com/in/dallasbishoff/ 

👉 PROCESS 360 Website: https://www.process360.com/contact 

👉 ISO Website: https://www.iso.org/home.html 

👉 Jeremy Patterson on LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/ 

👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/ 

👉 BEMO Website: https://www.bemopro.com/ 

Trust Issues is handcrafted by our friends over at: fame.so

A lot of contractors hear “CMMC” and immediately think of a six-figure bill.

According to Christina Reynolds, that’s the wrong place to start. 

In this episode of Trust Issues, Bruno Lecoq speaks with Christina Reynolds, Registered Practitioner Organization leader and author of Scope Small, Win Big, about where CMMC costs really come from. Her point is clear: certification is not usually the cost problem. Bad implementation decisions are.
What You’ll Learn: 

• Why CMMC certification and DFARS 7012 implementation costs are not the same thing
• How poor CUI scoping can turn a reasonable project into a million-dollar problem
• Why contractors should ask whether CUI should be present on a system, not only whether it is present
• Why Microsoft 365 Commercial can create an instant CMMC package failure
• How non-FedRAMP vendors can derail an otherwise strong package
• Why Phase One requirements still matter during the Phase Two pause
• What SPRS score metrics can block a DOD contract award
  
  

Episode chapters:

00:26 Welcome to Trust Issues00:48 Christina’s journey in defense contracting02:55 The biggest misconception about CMMC cost03:06 CMMC certification is not the real cost driver05:03 Why aggregated CUI can become a bigger security risk06:15 CMMC certification vs. DFARS 7012 implementation08:20 What the DoD actually wants to protect 10:20 The secret to scoping CUI correctly12:10 How scoping can keep CMMC costs reasonable13:19 What C3PAO assessments actually cost15:13 Why 110 self-attestation often falls apart16:19 Why self-assessment does not work16:55 Microsoft 365 Commercial as a CMMC failure point17:45 ITAR, endpoint devices, and foreign-soil violations20:10 Why GovCloud VDI matters for ITAR data21:21 CAD systems, CUI assets, and scoping decisions22:04 Why CMMC guidance is not your implementation guide24:48 Revision 3, quantum, and rising security standards25:29 What FAR changes could mean for contractors30:22 Why FedRAMP requirements are a major cost driver32:13 How FedRAMP 20x could help software vendors34:05 Why FIPS validation adds cost35:05 CMMC Pacific Northwest Conference revelations 36:03 Why the Phase Two pause is not a reason to stop37:05 Phase One requirements are still active37:35 The hidden metrics blocking DOD contract awards39:26 How SPRS scoring affects award qualification42:41 Final advice: scope small and keep moving
Quotes:

1. “CMMC doesn’t tell you to do it. All CMMC tells you is you’ve got to go seek an independent party that’s been properly trained to certify you.”
2. “When you let grade school students grade their own test, they all achieve a 100 somehow. But when you have the teacher grade their test, usually, there’s a different story to be told.”
3. “Scope small, win big.”
4. “Don’t assume that CUI is everything, everywhere, and omnipresent on every system in your environment.”
5. “All CMMC is, is show me what you’ve written for your security program, and now prove you’ve done it.”
   
   

Connect with the team: 

👉 Christina Reynolds on LinkedIn: https://www.linkedin.com/in/christina-reynolds-6705256
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 BEMO Website: https://www.bemopro.com/ Trust Issues is handcrafted by our friends over at: fame.so