That CMMC Show

The episode surfaces a handful of genuinely non-obvious operational points - DPRK IT worker infiltration through outsourced HR, the DNS-record protest angle, and the C3PAO-to-DIB-company ratio problem - but roughly half the runtime is spent on broad cyber-warfare framing and book promotion that delivers little actionable per-minute value for a B2B operator.

“how many CISOs, how many executives are actually involved in the process of vetting that HR company from a security perspective, thinking to themselves, are we going to be giving access to North Koreans by using this HR company?”

“The easiest way to find out is to look up their DNS records and see if they're still pointed to non-FedRam clouds.”

The framing of CMMC as a rising-tide baseline rather than a panacea is a useful reframe, and the protest-via-DNS-lookup angle is fresh, but most of the geopolitical cyber-warfare content and 'compliance is security' argument are well-worn talking points in the CMMC/DIB community.

“it's more like death by a thousand cuts than it is a Pearl Harbor or a 9-11 event”

“Compliance is absolutely security because you're not complying with a specific framework. You are inherently going to be insecure.”

McLaughlin is a genuine practitioner - 15 years Navy counterintelligence including six as senior CI advisor to US Cyber Command, now a cybersecurity attorney and published author - not a career podcast guest; his depth shows in operational specifics that only come from direct experience.

“I did about 15 years in the Navy as a counterintelligence officer, about six of which I was senior counterintelligence advisor for U.S. Cyber Command”

“I'm the co-lead of the Cybersecurity and Data Privacy Practice Group at the law firm of Buchanan, Yersall & Rooney”

There are real specific data points - approximately 100 C3PAOs vs. 300,000 DIB companies by 2028, negative 203 SPRS scores winning contracts, a 20-slide PowerPoint submitted as an SSP - but key figures are hedged ('I could be wrong about that number') and there are no dollar amounts, named breach cases, or sourced statistics, which limits the evidential weight.

“there are only, I think about a hundred, and I could be wrong about that number, but about a hundred C3 PAOs that have actually been certified for somewhere in that ballpark, but for 300,000 dib companies that need certified by 2028”

“somebody delivered a 20 slide PowerPoint deck and said, this is my SSP to an assessor”

The host occasionally adds substantive color (SPRS negative 203 anecdote, server-in-the-attic story) and asks a reasonably structured question about organizational risk, but there is no meaningful pushback on any claim, the 90% credentials statistic goes completely unchallenged, and the closing prompt degrades into asking about favorite food and restaurants.

“what organizational risks should they be aware of when it comes to cmmc or better yet maybe legacy dfar 7012 and false claims acts”

“Any bits of wisdom, your favorite food, best restaurants, whatever your closing remark wants to be, the floor is yours, my friend.”