CMMC for GSA Contractors?

Episode notes

Defense contractors aren't the only ones who need to implement NIST cybersecurity requirements for CUI. The big question has always been whether other agencies would require proof of implementation via the CMMC program. The GSA just revised their process for assessing nonfederal systems handling controlled unclassified information and it's way closer to NIST's Risk Management Framework than CMMC. CIO-IT Security-21-112r1 (PDF): Summit 7 Live San Diego:

Related episodes across the Index

Other episodes covering the same guests and topics, from across The B2B Podcast Index.

• CMMC Is an HR Problem, Not an Enclave Problem - Here's the ProofSecure Talk Podcast · on CMMC95 / 100
• Episode 128: Post Quantum CryptographyThe Azure Security Podcast · on NIST87 / 100
• Trump's Golden Post-Quantum EO(s)Security Cryptography Whatever · on NIST80 / 100
• AI and Cybersecurity in SMBs: Insights from Bruno LecoqSecuring the Realm · on CMMC79 / 100
• Rain Versus Flood, Making Sense of the 2026 CVE SurgeResilient Cyber · on NIST76 / 100
• The Evolution and Enforcement of CMMC with Jacob AndersonTrust Issues · on DFARS76 / 100

• The DoD's "Basic" Cybersecurity Isn't Basic at All93 / 100
• A Perfect SPRS Score Turned Into a $507K Settlement64 / 100
• The DoD Said This Was "Out of Scope"... Now They're Asking About It
• CMMC Phase 2 Is Suspended... So Why Is the DoD Still Assessing Contractors?
• CMMC Phase 2 Is Suspended... But Contractor Liability Just Went UP