Speak With Our Team: https://summit7.us/contactCMMC phase 2 is suspended, but what does that actually mean for defense contractors?In this episode, we sit down with government contracts attorney Eric Crusius to talk legal and regulatory questions around the phase 2 suspension. If you're a defense contractors trying to make sense of the noise, this is a deep dive into the issues that matter most. We answer:• Can the DoD CIO actually change CMMC without formal rulemaking?• What does the DFARS class deviation mean for NIST SP 800-171 Rev. 2?• What happens if FAR CUI moves to Rev. 3 while DoD remains on Rev. 2?• Can prime contractors still require CMMC from their subcontractors during the suspension?• Why the distinction between CMMC and the underlying security requirements matters• How FAR CUI could affect the future of CMMC• Why multiple security baselines could create more cost and complexity for small businesses• What contractors should be watching as the regulatory landscape continues to evolveThe conversation explores what the DoD CIO can and cannot do as well as the tension between the push for a single, government-wide security baseline and recent signals that the DoD could move in a different direction.Connect with Eric: https://www.linkedin.com/in/ericcrusius/Connect with Daniel: https://www.linkedin.com/in/danielakridge/Connect with Jacob: https://www.linkedin.com/in/jacob-evan-horne/Find Your CMMC Compliance Path in Under 5 Minutes: https://summit7.us/pathfinder

Find Your CMMC Compliance Path in Under 5 Minutes: https://summit7.us/pathfinderEven with phase 2 in review, CMMC isn't ending. In fact, the requirements are getting harder. In this episode, Daniel sits down with Fernando Machado, Managing Principal and CISO at CyberSec Investments (one of the first accredited C3PAOs), to discuss what he shared directly with the DoW CIO following recent meetings in Washington. They break down: • Why the "$600,000 CMMC assessment" claim is misleading • The difference between implementation costs and assessment costs • What could change after the current CMMC review • Potential grants, tax incentives, and other proposals for small businesses • Why most companies are still moving forward with certification • How FAR CUI could expand cybersecurity requirements across the federal supply chain • Why continuous monitoring and additional controls may be coming nextConnect with Daniel: https://www.linkedin.com/in/danielakridge/Connect with Fernando: https://www.linkedin.com/in/fernando-machado-cissp-cism-cca-ccp-5b5581124/Learn more: https://summit7.us/

The recent DoD CIO memo pausing CMMC Phase 2 certification raises a lot of questions. Is CMMC going away? Should contractors stop preparing? The answer to those is ‘no.’ In this episode, we're joined by Brett Cox, Principal of the Cybersecurity Oversight Office and DAF/CMMC Program Management Office at Boeing, to break down the latest developments and explain what the DoD's announcement actually means for contractors. Brett shares insights from his recent meeting with DoD CIO leadership and explains why this isn’t the end of CMMC. We explore the future of CMMC, the growing focus on resiliency and Zero Trust, upcoming FAR CUI requirements, and why independent C3PAO assessments continue to provide value even during the current review period.In this episode, we discuss:• The DoD CIO's CMMC Phase 2 suspension memo• Why CMMC is paused—not canceled• What contractors should be doing during the review period• Why NIST SP 800-171 compliance remains mandatory• FAR CUI and its potential impact on federal contractors• C3PAO certifications, self-assessments, and False Claims Act considerations• The future of CMMC, Zero Trust, and cybersecurity modernizationConnect with Daniel: https://www.linkedin.com/in/danielakridge/Connect with Brett: https://www.linkedin.com/in/brett-r-cox/Learn more: https://summit7.us/