ABOUT THIS EPISODE
A lot of contractors hear “CMMC” and immediately think of a six-figure bill.
According to Christina Reynolds, that’s the wrong place to start.
In this episode of Trust Issues, Bruno Lecoq speaks with Christina Reynolds, Registered Practitioner Organization leader and author of Scope Small, Win Big, about where CMMC costs really come from. Her point is clear: certification is not usually the cost problem. Bad implementation decisions are.
What You’ll Learn:
- Why CMMC certification and DFARS 7012 implementation costs are not the same thing
- How poor CUI scoping can turn a reasonable project into a million-dollar problem
- Why contractors should ask whether CUI should be present on a system, not only whether it is present
- Why Microsoft 365 Commercial can create an instant CMMC package failure
- How non-FedRAMP vendors can derail an otherwise strong package
- Why Phase One requirements still matter during the Phase Two pause
- What SPRS score metrics can block a DOD contract award
Episode chapters:
00:26 Welcome to Trust Issues
00:48 Christina’s journey in defense contracting
02:55 The biggest misconception about CMMC cost
03:06 CMMC certification is not the real cost driver
05:03 Why aggregated CUI can become a bigger security risk
06:15 CMMC certification vs. DFARS 7012 implementation
08:20 What the DoD actually wants to protect
10:20 The secret to scoping CUI correctly
12:10 How scoping can keep CMMC costs reasonable
13:19 What C3PAO assessments actually cost
15:13 Why 110 self-attestation often falls apart
16:19 Why self-assessment does not work
16:55 Microsoft 365 Commercial as a CMMC failure point
17:45 ITAR, endpoint devices, and foreign-soil violations
20:10 Why GovCloud VDI matters for ITAR data
21:21 CAD systems, CUI assets, and scoping decisions
22:04 Why CMMC guidance is not your implementation guide
24:48 Revision 3, quantum, and rising security standards
25:29 What FAR changes could mean for contractors
30:22 Why FedRAMP requirements are a major cost driver
32:13 How FedRAMP 20x could help software vendors
34:05 Why FIPS validation adds cost
35:05 CMMC Pacific Northwest Conference revelations
36:03 Why the Phase Two pause is not a reason to stop
37:05 Phase One requirements are still active
37:35 The hidden metrics blocking DOD contract awards
39:26 How SPRS scoring affects award qualification
42:41 Final advice: scope small and keep moving
Quotes:
- “CMMC doesn’t tell you to do it. All CMMC tells you is you’ve got to go seek an independent party that’s been properly trained to certify you.”
- “When you let grade school students grade their own test, they all achieve a 100 somehow. But when you have the teacher grade their test, usually, there’s a different story to be told.”
- “Scope small, win big.”
- “Don’t assume that CUI is everything, everywhere, and omnipresent on every system in your environment.”
- “All CMMC is, is show me what you’ve written for your security program, and now prove you’ve done it.”
Connect with the team:
👉 Christina Reynolds on LinkedIn: https://www.linkedin.com/in/christina-reynolds-6705256
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 BEMO Website: https://www.bemopro.com/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 BEMO Website: https://www.bemopro.com/
Trust Issues is handcrafted by our friends over at: fame.so
English
United States
TRANSCRIPT 🔗
Are you the producer of this podcast?
Add a podcast transcript
Need Audio-to-Text?
Transcribe with Listen411 in Just 60 Seconds
OTHER EPISODES IN THIS PODCAST
A lot of contractors talk about compliance like it is a form to finish.
E.J. Hilbert sees it very differently.
In this episode of Trust Issues, Jeremy Patterson and Bruno Lecoq speak with E.J. Hilbert, Director of US Regulatory Compliance and Security Officer at Element Materials Technology, about …
The CMMC pause gave contractors more time, but it also revealed a hard truth: some companies were building security because they believed in it, while others were only reacting to the threat of being graded.
In this episode of Trust Issues, Bruno Lecoq is joined by Jeremy Patterson to unpack what t…
AI governance is where most companies are getting it wrong. It’s not that they lack policies, but because they don’t understand what can actually go wrong with the technology they’re deploying. In this episode of Trust Issues, hosts Jeremy Patterson and Bruno Lecoq step away from their usual CMMC f…
CMMC is synonymous with confusion at this point. But this episode of Trust Issues should clear it right up.
In this compilation episode of the podcast, Brandon and Bruno Lecoq revisit key insights from past conversations to cut through the noise around CMMC, documentation, self-attestation, a…
Disclaimer: The podcast and artwork embedded on this page are from BEMO, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.
EDIT
Thank you for helping to keep the podcast database up to date.
