Sign up to save your podcasts
Or
Share You're Probably Behind on CMMC. Here’s What To Do Next. (ep 11)
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
You're Probably Behind on CMMC. Here’s What To Do Next. (ep 11)
About 100 authorized assessors. An estimated 118,000+ companies that need to be assessed. That math is the reason CMMC can't wait — and it's where this conversation starts. Brett Cox, lead CMMC Certified Assessor and head of Boeing's DFARS CMMC Program Management Office, joins host Jen Stone to explain what the Cybersecurity Maturity Model Certification actually requires, why the November 2026 third-party assessment deadline is creating a bottleneck, and how a small or mid-sized contractor should take the first step.
KEY TAKEAWAYS
- Phase 2 — the third-party (C3PAO) assessment requirement — goes live November 10, 2026. The right to waive the requirement goes away in 2028.
- Under CMMC, you must verify the subcontractor below you holds the required level before you can award them work. Their compliance is now your problem.
- The bottleneck is real: ~100 assessors vs. ~118,000 companies. Expect a months-long queue — get in line now.
- COTS (unmodified commercial off-the-shelf) is the only exemption, and there's no minimum dollar threshold. Modify a part and it's no longer exempt.
- You can't use the same company for both readiness consulting and your assessment.
- First step: decide your level (FCI vs. CUI), download the scoping and assessment guides from the DoD CIO site, and start your gap analysis.
RESOURCES
DoD CIO CMMC documentation (scoping & assessment guides): https://dowcio.war.gov/CMMC/Resources-Documentation/
Cyber AB Marketplace (find a C3PAO or consultant): https://cyberab.org/marketplace
NIST SP 800-171 https://csrc.nist.gov/Pubs/sp/800/171/r3/final
SecurityMetrics CMMC services: https://www.securitymetrics.com/product/cmmc
About the Guest
Brett Cox — Lead CMMC Certified Assessor; Principal & Team Lead, DFARS CMMC Program Management Office, The Boeing Company. LinkedIn: https://www.linkedin.com/in/brett-r-cox/
A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.
Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place
But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/
View all episodes
By SecurityMetrics
5
88 ratings
About 100 authorized assessors. An estimated 118,000+ companies that need to be assessed. That math is the reason CMMC can't wait — and it's where this conversation starts. Brett Cox, lead CMMC Certified Assessor and head of Boeing's DFARS CMMC Program Management Office, joins host Jen Stone to explain what the Cybersecurity Maturity Model Certification actually requires, why the November 2026 third-party assessment deadline is creating a bottleneck, and how a small or mid-sized contractor should take the first step.
KEY TAKEAWAYS
- Phase 2 — the third-party (C3PAO) assessment requirement — goes live November 10, 2026. The right to waive the requirement goes away in 2028.
- Under CMMC, you must verify the subcontractor below you holds the required level before you can award them work. Their compliance is now your problem.
- The bottleneck is real: ~100 assessors vs. ~118,000 companies. Expect a months-long queue — get in line now.
- COTS (unmodified commercial off-the-shelf) is the only exemption, and there's no minimum dollar threshold. Modify a part and it's no longer exempt.
- You can't use the same company for both readiness consulting and your assessment.
- First step: decide your level (FCI vs. CUI), download the scoping and assessment guides from the DoD CIO site, and start your gap analysis.
RESOURCES
DoD CIO CMMC documentation (scoping & assessment guides): https://dowcio.war.gov/CMMC/Resources-Documentation/
Cyber AB Marketplace (find a C3PAO or consultant): https://cyberab.org/marketplace
NIST SP 800-171 https://csrc.nist.gov/Pubs/sp/800/171/r3/final
SecurityMetrics CMMC services: https://www.securitymetrics.com/product/cmmc
About the Guest
Brett Cox — Lead CMMC Certified Assessor; Principal & Team Lead, DFARS CMMC Program Management Office, The Boeing Company. LinkedIn: https://www.linkedin.com/in/brett-r-cox/
A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.
Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place
But if you just want to learn how to protect yourself for free, start here: https://academy.securitymetrics.com/