 |
Secure Talk PodcastSecure Talk reviews the latest threats, tips, and trends on security, innovation, and compliance. Author: Justin Beals
Secure Talk reviews the latest threats, tips, and trends on security, innovation, and compliance. Host Justin Beals interviews leading privacy, security and technology executives to discuss best practices related to IT security, data protection and compliance. Based in Seattle, he previously served as the CTO of NextStep and Koru, which won the 2018 Most Impactful Startup award from Wharton People Analytics. He is the creator of the patented Training, Tracking & Placement System and the author of Aligning curriculum and evidencing learning effectiveness using semantic mapping of learning assets, published in the International Journal of Emerging Technologies in Learning (iJet). Justin earned a BA from Fort Lewis College. Language: en Genres: News, Tech News, Technology Contact email: Get it Feed URL: Get it iTunes ID: Get it |
Listen Now...
CMMC After the 60-Day Review: What DOD Decided, What It Didn’t, and What to Do Now
Episode 262
Tuesday, 6 October, 2026
CMMC wasn't suspended. Only one piece of it was, and the defense contractors acting like the whole program went away are the ones taking on the most risk.Eighty days after the DoD CIO paused CMMC Phase 2, the 60-day review has closed, a class deviation has written the pause into contracts, and the Reform Task Force's recommendations are still not public. Contracting officers and primes aren't waiting. Some solicitations now require a posted SPRS score before you can even open the RFP.In this SecureTalk panel, host Justin Beals sits down with three NIST SP 800-171 practitioners (a C3PAO strategist, a lead CCA and instructor, and a former Navy cryptologist turned enclave provider) to separate what DoD actually decided from what the internet decided for it.WHO THIS IS FORDefense contractors and subcontractors, compliance and IT leaders preparing Level 1 or Level 2 self-assessments, MSPs and MSSPs serving the DIB, and anyone trying to make sense of CMMC after the Phase 2 pause.TIMESTAMPS00:00 Why this episode is a panel00:39 Meet the guests04:11 "We're NIST 800-171 experts, not CMMC experts"05:16 80 days after the pause: where things stand07:21 What hasn't changed: Level 1 and Level 2 self-assessments08:26 Myth: "CMMC was suspended"11:33 No SPRS score, no RFP documents14:08 CMMC is a floor, not a ceiling14:26 The FAR overhaul and retired clauses still in contracts18:29 Myth: "CMMC got pushed to November 2028"22:02 The class deviation most people misread24:14 What a defensible self-assessment looks like29:06 Reddit, Discord and the misinformation problem33:30 Myth: "My MSSP handles CMMC for me"36:40 Myth: "Our policies prove we're compliant"40:32 Myth: "We bought an enclave, so we're done"44:07 Where the real risk lies now51:13 How to choose outside helpSOURCES REFERENCED- DoD CIO memo suspending CMMC Phase 2 (July 13, 2026), via Federal News Network: https://federalnewsnetwork.com/cybersecurity/2026/07/pentagon-suspends-cmmc-phase-two-requirements-launches-review-of-program/- Sept. 3 acquisition memo codifying the pause, via MeriTalk: https://www.meritalk.com/articles/dod-codifies-pause-of-cmmc-phase-2-dod-cio-says-more-work-needed-on-cmmc/- 32 CFR Part 170, the CMMC Program rule (phased rollout in §170.3): https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170- NIST SP 800-171 Rev. 2: https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final- NIST SP 800-171A, the assessment methodology: https://csrc.nist.gov/pubs/sp/800/171/a/final- CMMC Program Final Rule: https://www.federalregister.gov/d/2024-22905/p-1876- Free executive level class: https://www.evolvedcyberacademy.com/courses/Rev3Leadership- CMMC Level 2 Self- Assessment: Step-by-step with Templates: https://www.strikegraph.com/blog/conduct-cmmc-level-2-self-assessmentWHAT YOU'LL LEARNThe requirement never moved. The pause hit third-party C3PAO assessments, not NIST SP 800-171 compliance and not Level 1 or Level 2 self-assessments. Brian Hubbard sets the bar at a self-assessment you could defend "if the DIBCAC walked in the next day after you posted your score."November 2028 is not a new deadline. Logan Therrien explains it has always been the end of CMMC's four-year phased rollout. Reading it as a two-year reprieve is one of the costliest misreadings in the market.The market is moving faster than the policy. Vince Scott compares it to oil moving through the Strait of Hormuz: there are months of supply in the system before anyone feels the change. Primes are already asking to see SSPs and SPRS scores.GUESTSLogan Therrien, Chief Strategy Officer, Kieri Solutions (C3PAO); 24-year military veteranBrian Hubbard, President, Evolve Cyber; Lead CCA and CMMC instructor; 40+ years in cybersecurityVince Scott, CEO, Defense Cybersecurity Group; retired Navy cryptologistHOSTJustin Beals, founder of Strike Graph and host of SecureTalk, a podcast focused on security news, innovation, and excellence.🔔 Subscribe for conversations where cybersecurity, compliance and national security meet.#CMMC #NIST800171 #DefenseIndustrialBase
