Trust Issues

The opening ten minutes is a meandering career biography with low value, but the back half is dense with practical, non-obvious compliance insights (the four assessment phases, 'periodically' meaning no less than annual, the SSP being the thing assessed, Active Directory not being a system of record).

“What that's asking you to do is periodically, not every day”

“they define periodically as no less than annual”

Offers genuinely practitioner-shaped framing rather than recycled compliance platitudes - the restaurant inspection analogy, the gym/marriage analogy for documenting controls, and the Active Directory 'system of record' critique are fresh interpretations for this niche.

“You've got a restaurant, you're building a restaurant. You don't have food yet”

“It's almost like you're, you're telling like your wife that you're committed to going to the gym”

Norris Cardin is a lead certified CMMC assessor and principal consultant with CISSP/CISA, years on both the implementation and auditing sides - a genuine hands-on practitioner directly relevant to the topic, not a thought-leader.

“lead certified CMMC assessor and principal consultant for Centaur, working directly with defense contractors”

“I've been on the consulting side doing the gap assessments”

Strong on named requirements, certifications, numbers and concrete failure scenarios (3.3.3 event review, 110 requirements/320 objectives, $6,000, time source mismatch on a new firewall), though several companies and templates are deliberately anonymized.

“pulled up 3.3.3 which is event review. Review and update logged events. 5 words”

“these 320 objectives. We need to be writing our”

The hosts ask some genuinely useful clarifying questions and one sharp analogy to SOC Type 1/Type 2 history, but it's largely a collegial peer conversation with affirmations rather than probing pushback or productive disagreement.

“if I go to the SOC world... for the CMMC, when you go do the assessment, do you need to have X months prior”

“What percentage of organizations are doing the mock audit these days?”