That CMMC Show

The episode delivers substantive insights on real contractual ambiguities operators face (SPR scoring, FedRAMP gaps, False Claims Act enforcement, supply chain flowdown), but padded significantly with context-setting, personal introductions, and repeated restatement of questions. The core legal substance is concentrated in roughly half the runtime.

“the False Claims act standard is a knowing standard. Um, so you do have to knowingly misrepresent. However, that knowingly category includes reckless disregard and deliberate ignorance”

“the CMMC puts in the prime's ambit of responsibility, the need for the prime to say, you know, it's like the Oprah, like, you get a car and you get a car, you're going to get cui”

The framing of CMMC contractual issues is topical and addresses real practitioner pain points, but the underlying legal frameworks (False Claims Act, documentation standards, senior official sign-off) are standard government contracting practice. The originality lies in application to CMMC rather than novel legal theory or contrarian thinking.

“document, document, document”

“CMMC is not an IT problem. CMMC is a company problem”

Dawn Stern is a qualified, relevant guest with 15+ years in government contracts, prior DOJ litigation experience, and active CMMC advisory work at a major law firm. However, she is primarily a legal expert, not an operator who has built or scaled a defense business or navigated CMMC implementation at the ground level. Her perspective is institutional and counsel-focused rather than hands-on practitioner.

“I co chair the government contracts practice at DLA Piper”

“prior to that um, was a trial attorney at the Department of Justice where I handle government uh, contracts cases on behalf of the government”

The episode references concrete examples (Microsoft FedRAMP removal, 60,000-person contractor impact, Leidos/Elbit enforcement timelines, 800+ certifications) but most are mentioned in passing without deep detail. Legal guidance is largely principles-based (document well, be transparent, get legal counsel) rather than specific thresholds, case citations, or precise regulatory language. The SPR scoring problem is well-articulated but solutions remain vague.

“Microsoft back in, I think it was October of 2024, ripped their FedRAMP authorization off their M365 commercial cloud”

“Leidos told them, if you're not certified by October, we're taking you off our list”

Host Daniel asks pointed, well-framed questions that surface real dilemmas (SPR scoring paradoxes, FedRAMP timing gaps, significant change ambiguity) and gives the guest room to answer. However, follow-ups are often soft; when Guest gives non-answers or hedges ('it depends on company structure,' 'it's yet to be seen'), Host rarely pushes back. The conversation is collegial but not sufficiently adversarial to stress-test claims.

“So when we're talking to organizations like either, a couple things will happen”

“what happens to imminent contract awards in between that? There's so many question marks there, right”