GAO Gave CMMC a 95%... Then Called It a Problem

Episode notes

GAO's latest report on CMMC sounds cautious. They warn about external risks, ecosystem constraints, and gaps in DoD's strategy. But that framing misses the bigger story. Since the 2021 report, CMMC has gone from a fragmented concept to a functioning system. The ecosystem exists. Training exists. Small business support is working. So why does the report feel so negative? In this episode, we break down where GAO is right, where they're overstating the risk, and why the real story is the program's quiet but meaningful progress. Register for Summit 7 Live: GAO Report (2026): GAO Report (2021):

Related episodes across the Index

Other episodes covering the same guests and topics, from across The B2B Podcast Index.

• CMMC Is an HR Problem, Not an Enclave Problem - Here's the ProofSecure Talk Podcast · on CMMC95 / 100
• Episode 128: Post Quantum CryptographyThe Azure Security Podcast · on NIST87 / 100
• Trump's Golden Post-Quantum EO(s)Security Cryptography Whatever · on NIST80 / 100
• AI and Cybersecurity in SMBs: Insights from Bruno LecoqSecuring the Realm · on CMMC79 / 100
• Rain Versus Flood, Making Sense of the 2026 CVE SurgeResilient Cyber · on NIST76 / 100
• The Evolution and Enforcement of CMMC with Jacob AndersonTrust Issues · on DFARS76 / 100

• The DoD's "Basic" Cybersecurity Isn't Basic at All93 / 100
• A Perfect SPRS Score Turned Into a $507K Settlement64 / 100
• The DoD Said This Was "Out of Scope"... Now They're Asking About It
• CMMC Phase 2 Is Suspended... So Why Is the DoD Still Assessing Contractors?
• CMMC Phase 2 Is Suspended... But Contractor Liability Just Went UP