Climbing Mount CMMC

The episode contains genuine operational insights - distinguishing MSPs who prepare OSCs from MSPs who run networks, the bogus certificate discovery, and the forthcoming CMMC Body of Knowledge - but these are diluted by significant conversational filler, mutual validation, and repetitive throat-clearing that inflates the runtime substantially.

“I always look at are there enough people to help companies prepare for cmmc? I feel pretty good about that. Are there enough companies to help defense contractors run their networks and actually maintain requirements to the standard? That's a different question.”

“We came across just last week, uh, a bogus level 2 certificate that a non C3PO generated, taking a valid UID from another C3PO and some poor DIB company was uh, snookered into.”

The observation that NIST 800-171 never mentions 'managed service provider' is a pointed and underappreciated structural critique, but most of the content follows the predictable CMMC ecosystem narrative - scaling concerns, financial survival during rulemaking, and credential program transitions - that circulates widely in this community.

“It always struck me that you could read NIST 800171 and never see the term managed service provider. You don't see that in any of the DoD assessment guides scoping guys. It wasn't until we saw 32 CVR where we got the external service provider.”

“I think CMMC has been catching up to that realization that you can't solve the problem of protecting CUI if you're not fully and coherently incorporating the role of the msp.”

Matt Travis is the sitting CEO of the Cyber AB - the actual accreditation body for CMMC - and shares genuine internal intelligence including the organization's financial history, active hiring plans, a live enforcement case, and pending policy developments; this is a primary-source practitioner, not a thought-leader proxy.

“I just hired a chief operating officer. We've just made an um, offer out to a compliance officer whose full time job will be to police the ecosystem”

“the Cyber B has never received a dollar of contract, uh, money, of taxpayer money, any, no government revenue at all. We generate our operating revenue from the fees that are attached to some of the economic activity that goes on in cmnc.”

The episode references specific regulatory tables by page number (32 CFR page 83176-83177), cites 105 active C3PAOs, 410 RPOs, year-by-year certification volume projections (382/1,900/6,000/12,000), and approximately 40 certified MSPs/ESPs - providing a real quantitative skeleton, though some claims rely on informal estimates and acknowledged uncertainty.

“we've got C3POs over you know 105 active in the marketplace”

“we have a 410 registered practitioner organizations. Uh, you know we're training's outdated, the quality varies among those greatly.”

The hosts ask genuinely practitioner-informed questions - the MFA inconsistency example (Hello for Business vs. Duo) and the enforcement 'wanted posters' pivot show real domain knowledge - but they overwhelmingly validate and agree with the guest rather than pushing on ambiguities, and several questions are broad scene-setting rather than targeted probes.

“What wanted posters have you put up?”

“Some organizations feel that hello for Business, you know, doing the little pin with hello for Business is acceptable for mfa. Some assessors feel that way. Some assessors are like heck to the no, that's not acceptable either.”