Climbing Mount CMMC

The episode provides practical, actionable guidance on conducting CMMC self-assessments with several concrete recommendations (e.g., hiring external assessors first, creating test procedures, documenting findings). However, significant portions are repetitive throat-clearing and casual banter that dilutes the density of novel insights. The core value - process steps and common pitfalls - is real but not exceptional.

“Well, it's kind of like where they're like, hey, I'm very safe and secure but I don't know what I'm protecting. You're like, well, how can you be safe and secure if you don't even know what you're protecting?”

“the first thing I would do is just read through the SSP first. So it's a long document a lot of times for people, but a lot of times they have the preamble section that sort of talks about things and how they operate in general.”

The episode recycles standard CMMC assessment guidance (read SSP, use NIST 800-171, understand your environment) without novel frameworks or contrarian insights. The personal anecdote about a company scoring 90 on self-assessment while not knowing where their CUI is located is illustrative but not original thinking. The conversation follows expected best-practice messaging.

“Well, you've got to look at your system security plan first. That is going to have all the information that breaks down all the authoritative documents.”

“the DOD CIO website, which you can go there, they have the resource page that you can go to that has all the authoritative documents that are related to that.”

Bobby Guerra appears to be a practitioner with actual CMMC assessment experience (conducted internal self-assessments, taught CCP courses, worked for an MSP), making him more credible than a pure consultant. However, he is not a senior executive or recognized authority figure - he's a solid mid-level operator speaking from experience, not an exceptional caliber guest.

“Bobby went through this for us internally as well.”

“I was literally teaching the CCP course, and that resource location was just gone.”

The episode includes one concrete example (company with 90 SPRs score not knowing where CUI is located) and references timelines (1-2 days to a day and a half per year for assessment, 2 weeks for initial attempt), but lacks hard data on failure rates, dollar figures for external assessor costs, or named case studies. Guidance is general-purpose rather than evidence-backed.

“they shared with us that they self assessed and they were about at a 90 SPRs score. You know, 110 is ideal.”

“it took me like two weeks to go through to do it and I was like, I was like cruising on it”

The host asks follow-up questions and allows the guest to develop points, but rarely pushes back or challenges claims. Questions are mostly soft prompts ('What's your perspective?', 'Any other things?') rather than sharp probes. The dynamic is collegial but lacks the tension that forces deeper examination of assumptions or tradeoffs.

“Bobbi, I'm curious, you've done a self assessment, multiple self assessments. What's your perspective from the first time you ever partook of a self assessment versus the most recent time?”

“But what about external documents for somebody? You know, Joe Schmo gets off the street, and he's tasked with doing this internally for his company.”