Secure & Simple

The episode delivers solid, practical information about CMMC implementation with specific numbers (29 policies, 46 procedures, 700 evidence items, 110 controls, 320 AOs, $45-55K audit costs). However, insights are somewhat predictable for target audience (documentation requirements, phased audit process, leadership buy-in) - the core advice reiterates standard compliance wisdom. The specific operational examples (passkey/password discrepancy, onboarding workflows) add texture but don't challenge conventional thinking.

“29 policies. Uh-huh. We we have 46 procedure. Mhmm. We have 14 configuration document and more than 700 evidence.”

“C3PAO will charge today between 45,000 to $55,000 for an audit”

The framing around 'security rigor vs. technical controls' and the notion that CMMC is a 'company project, not an IT project' offer some fresh perspective. However, the broader narrative - compliance requires leadership buy-in, documentation discipline, ongoing maintenance - is standard in governance discourse. The comparison to ISO 27K and SOC2 is useful but not novel. No counterintuitive arguments or first-principles rethinking.

“CMMC is not an IT project, it's a company project and it's a way of life”

“I think the NIST, you know, the pure NIST will be the IT. And for me, what I see is on top of CMMC, they have added some, again, non IT controls”

Bruno Lecoq is a credible practitioner: CEO and CISO of a CMMC-certified MSSP, has hands-on experience with multiple certifications (27K, SOC2, HIPAA, working on 42K), has led his company through mock and full audits, regularly advises clients, and attends Cyber AB monthly meetings. He speaks from operational trenches, not theory. His firm size focus (10-1000 users) limits scope, but he's clearly done the work at scale.

“BEMO as a company is already CMMC certified together with other standards like 27,001, SOC two and HIPAA”

“we did a mock. So to explain for a mock is you your assessor is kind of they will assess you, but it doesn't count against your score”

The episode is concrete where it matters: audit costs ($45-55K + $10K mock), timeline ranges (3 months to 1 year, 9 months average), specific control/AO numbers (110 controls, 320 AOs, 66 monthly reviews), document counts (29 policies, 46 procedures, 700 evidence items), C3PAO numbers (93 registered), 87% phase-one failure rate. Lacks specifics on actual client transformations, ROI, or named customer examples (understandable due to NDAs). SSP page count cited (300 pages) but not comparative data.

“200,000 contractors in The US, and as of right now, only 3,000 are CMMC level two compliant”

“87% of the people don't pass phase one”

Host Dejan asks clarifying follow-ups ('Can you tell me about the basics?', 'What distinguishes level one and two?', 'Are all controls in NIST 171?') and gently probes contradictions ('But ISO 27K should also check records, right?'). However, questioning lacks sharpness - few pushbacks on vague claims, limited challenge to guest's framing. Host doesn't press on the cost/burden story or ask harder questions about why 87% fail or what 'security rigor' truly operationalizes. Conversation is friendly but surface-level, missing opportunities to stress-test Bruno's recommendations.

“But ISO 27,000 certification bodies should do the same. Right? They should also check the records. Yeah. But I I have I have felt like the the bar is lower”

“So what exactly do you mean by this? [on business velocity vs. security rigor]”