Trust Issues

Contains genuinely non-obvious insider detail on CMMC's origins, the 800-53-to-171 downgrade, gaming of SSPs, and the cost-accounting rationale for not directly paying for compliance, but is diluted by lengthy tangents (polygraphs, seatbelts, family stories).

“they still gamed it because they went out to the Internet and they downloaded a system security plan that had a line that said, insert company name here”

“you'll pay for it, but you're not going to directly pay for it”

The rulemaking-process narrative and the taxpayer/cost-accounting framing are fresh insider angles rarely heard publicly, though the broader security arguments are somewhat familiar.

“had you begun in 2013, 14, 15, when this started, then you could have incrementally done it”

“the money that they would have spent to develop, they can now apply to manufacturing and they outmaneuver us”

The guest was the Director of CMMC policy at OUSD A&S and CIO, former head of contracting at DIA, with 37 years directly building and shepherding the rule through government - an exceptionally relevant practitioner.

“you were the Director of cmmc, uh, uh, policy, uh, prior to this”

“before I was at the Pentagon, I worked for the Defense Intelligence Agency as their head of contracting”

Rich with named clauses, revisions, agencies, timelines, CFR sections, real companies, and cost ranges, though some claims remain anecdotal.

“There was the 252, 204, 7012 clause”

“We've seen costs where companies have gotten compliant with all 110 for $5,000”

The host largely affirms and cheerleads the guest rather than probing or challenging, offering supportive prompts and his own MSSP endorsements with no pushback on any claims.

“I thoroughly believe in, like, what, what you've done for sure”

“it truly does make, uh, the United States safer, like, hundred percent”