Advertise on podcast: Cyberspin

In this September edition of CMMC Connect, Redspin's assessors and consultants broadcast live from the National Cyber Summit in Huntsville to work through the questions defense contractors are asking right now. The panel covers what actually counts as a significant change that triggers recertification (spoiler: your affirming official owns the call), how to give subs guest access to CUI drawings using VDI without flowing DFARS down, why Rev 3 is being pushed and what to do about it before it lands, whether a screenshot of Entra ID is enough evidence for AC.L2 3.1.1(a), and what the Revolutionary FAR Overhaul means for contractors juggling DoD and civilian contracts. Plus a field update on the ended 60 day pause (now under CIO review), a fresh ecosystem snapshot (2,105 Level 2 certs and climbing), and a peek at the industry pulse survey landing this week. Hit play for straight talk from the show floor. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

CMMC conversations usually get lost in regulations and timelines, but Rob Teague sits down with Robert Hill to ask the question everyone forgets: why does this data need to be protected in the first place?   Robert shares the story of a five person shop in South Texas making a single gasket for the F 35, and how one small out of tolerance change from a supply chain breach could ground an entire fleet. The conversation covers Phase 2 confusion and cost, whether contractors should keep pressing forward or pause, and why file integrity basics (like checking a hash) often matter more than the biggest, most expensive security stacks. If you needed a reminder of what CMMC is actually protecting, this is it.

In this August session, we are joined by John Fitch, Redspin's lead Azure Architect, and Carley Salmon from Microsoft for a joint session on the cloud questions defense contractors ask most. The panel breaks down GCC vs. GCC High (and Azure Commercial vs. Azure Gov), when G3 licensing is enough versus when G5 pays for itself, and how to prevent CUI from leaking out of a commercial O365 mailbox using Purview DLP, labels, and conditional access. Plus a field update from DoW CIO Kirsten Davies at Black Hat (officially a pause, not a suspension), what primes are telling us about third party validations, a fresh ecosystem snapshot (1,130 CCAs, 2,140 CCPs, 113 C3PAOs), what the Revolutionary FAR Overhaul Release 1 signals for Rev 3, and what year two of certification really looks like. Hit play for the Microsoft cloud clarity you've been waiting for.   CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

In this July edition of CMMC Connect, Redspin tackles the biggest news of the year: the CMMC Phase 2 pause. Rob Teague shares takeaways from his in-person meeting at the Pentagon with DoW CIO Kirsten Davies, including her real feedback on NIST 800 171 (she thinks it's too governance heavy) and what she's actually considering next. The panel walks through what's paused, what's still in effect (spoiler: DFARS 7012 and every NIST 800 171 requirement), why third party assessments still matter, and how to make your voice heard through the open RFI. Plus a Rev 3 timeline update, whether your Level 2 certificate is CUI, what to do about uncertified subs mid pause, a fresh ecosystem snapshot (1,866 Level 2 certs, 111 C3PAOs), and a guest appearance from Carly Salmon at Microsoft. Hit play to hear what's actually happening, straight from the people in the room. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

In this June edition of CMMC Connect, Redspin's assessors and consultants cut through the noise on the questions defense contractors are asking right now: Why November 10, 2026 is a phase milestone (not a drop dead deadline) What the re-released federal CUI rule signals about the shift to NIST 800 171 Rev 3 The new post quantum cryptography (PQC) strategy and its December 31, 2030 enforcement date What actually triggers a reassessment when AI/ML tools, M&A, or cloud changes hit your environment Multi-tenant organization (MTO) considerations across GCC High tenants The real rules for remote work and telework agreements. Plus a Canadian compliance scenario that exposes a lot of FedRAMP confusion. Hit play for real questions, real answers, zero LinkedIn doom scrolling required.   CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

The panel digs into what FIPS 140-2 moving to historical status on September 21, 2026 means for your tech stack, how to tell if your MSP is actually doubling as a CSP, what does and doesn't count as CUI when COTS items and PII (CUI//SP PRVCY) are in play, whether non US citizens can serve as admins in a GCC High environment, what to do when your SSP says whitelisting but your tools are actually blacklisting under CM.L2 3.4.8, and how strict the separation between administrative and standard user accounts really needs to be (spoiler: admins demonstrating they can't open user files is now part of the assessment). You'll also hear a Cyber AB Town Hall recap, the rule on mock versus formal assessments (you can flip one direction, not the other), the latest ecosystem snapshot (1,391 final Level 2 certifications, a new record), and a reality check on the November 10, 2026, versus November 10, 2027 dates. An unfiltered hour from the team running these assessments every day. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

In this April edition of CMMC Connect, Redspin's assessors and consultants take on the questions defense contractors are asking most right now. The panel digs into whether OSCs in the middle of a Level 2 assessment can keep working as subs on prime contracts, when NIST 800 171 Rev3 will become the standard and what's new in it, how to handle CUI when running AI tools on AWS GovCloud, how strict the separation between administrative and standard user accounts really needs to be, and the most common pitfalls that send "ready" organizations into a failed Level 2 assessment. You'll also get the latest ecosystem numbers (1,198 final Level 2 certifications as of April 2026), a reality check on the November 10, 2026, Phase 2 milestone (spoiler: it's not the deadline most people think it is), and a look at the new Cyber EF. Listen to get practical, assessor-backed guidance you can put to work this week. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

What are organizations getting wrong when it comes to CMMC? In this replay of March’s CMMC Connect, Redspin’s assessors break down the real-world questions organizations are asking right now, from Rev. 2 vs. Rev. 3 implications to scoping decisions, shared environments, and what truly changes when you add systems into your boundary. We cover what happens after certification, how to think about inherited controls and micro-business models, what differentiates C3PAOs, and how to determine if you’re truly assessment-ready—not just policy-ready. If you’re navigating CMMC Level 2, managing CUI, or preparing for (or maintaining) certification, this is your practical, field-driven breakdown of what assessors are actually seeing and advising. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

How did this much happen in just 30 days? In this replay episode of February's CMMC Connect, we break down the latest DFARS Class Deviations, GSA’s new “CMMC-like” program, key takeaways from the Cyber AB Town Hall, and the biggest questions shaping the CMMC landscape right now. We cover why mock assessments can’t convert to formal certifications, why documentation is everything, how contract requirements drive CMMC Levels, and what you need to know about CUI access, training, and assessment readiness.  If you’re navigating CMMC, FAR/DFARS, or federal contract compliance, this is your 60-minute briefing on what matters most. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

CMMC is moving fast, and the questions from the DIB are getting more specific... In this January 2026 replay of Redspin's live CMMC Connect, our CMMC Certified Assessors (CCAs) unpack the latest updates from the field and answer real-world questions OSCs are facing as CMMC Level 2 assessments ramp up. This episode (literally) covers: Recent DoD CMMC FAQ updates and what they clarify (and don’t) ISACA’s new role as CAICO and what it means for CCP and CCA certifications The growing pace of completed CMMC assessments and what that signals for 2026 Scoping challenges: virtual machines, shared resources, boundaries, and asset definitions Flow-down realities. Why primes are increasingly requiring Level 2 from subs CMMC vs. FedRAMP, and how to tell if you’re an ESP or a CSP CUI marking, mishandling, and what to do when CUI shows up where it shouldn’t FIPS validation pitfalls assessors see all the time Evaluating AI-enabled tools when CUI is involved Common reasons organizations struggle or fail during assessment NIST 800-171  The session wraps with live audience Q&A, candid assessor perspectives, and practical advice drawn directly from active CMMC engagements, no theory, no fluff. If you’re supporting DoD contracts, preparing for CMMC Level 2, or navigating compliance decisions in real time, this episode delivers clarity where it matters most. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

In this holiday edition of CMMC Connect, the Redspin team wraps up a busy year by tackling real questions from the Defense Industrial Base, sharing practical best practices, and looking ahead to what 2026 may bring for CMMC. From lessons learned in the field to what contractors should be thinking about next, this session covers a wide range of timely topics — with a little holiday fun mixed in. We also share what’s new for CMMC Connect in 2026. Sessions will continue on the last Thursday of every month, starting January 29, but with a simplified registration process. Going forward, you’ll only need to register once for the year, and calendar invites will be sent out quarterly to make planning easier. Whether you joined us live or are catching up on the replay, this episode is a great way to close out the year and get oriented for what’s ahead in CMMC. Listen now and be sure to register for CMMC Connect to stay on the list for upcoming 2026 sessions. CMMC Connect happens on the last Thursday of every month at 1 PM ET. Register for the series and submit questions here: https://redspin.com/cmmc-connect-hub/ Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

Phase 1 of CMMC is officially here, and this month’s CMMC Connect dives straight into what contractors are experiencing on the ground. Redspin’s panel of CCAs break down the newest DoD updates, rising assessment backlogs (or is it rising false-starts?), early Level 2 contract requirements, and the most common “not met” trends they’re seeing in real assessments. They also unpack key findings from Redspin’s new Momentum but Slow Movement report, based on data from 180 DoD contractors, including the growing wave of flow-down demands from primes. If you want clear, practical answers on scoping, evidence, encryption, specialized assets, subcontractor management, or what counts as a “significant change,” this episode has it. Plus: Redspin is hiring CCAs as demand skyrockets. CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

In this special Halloween edition of CMMC Connect, the Redspin team swapped their suits for costumes and dove into what’s next as CMMC Phase 1 officially begins on November 10. Join Dr. Thomas Graham, Jeremy Mares, Rob Teague, and Phil Conrad, hosted by Lauren Frickle, as they unpack: Why November 10 marks the start of CMMC, not the finish line What to do before the rollout — including updating your SPRS scores When service providers (like CPA firms) come into scope Key insights from the field — over 430 Level 2 assessments completed and counting Tips to prepare for the 2026 Phase 2 rollout and avoid assessment backlogs Sooooooo much more Of course, things got a little fun — proving once again that CMMC doesn’t have to be scary.   CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

CMMC timelines, DFARS 7025, FedRAMP CRM responsibilities, interim compliance signals, and what’s next for NIST 800-171 Rev. 3, our team of CMMC Certified Assessors (CCAs) covered the hottest questions the DIB is asking right now. If you’re aiming for Level 2 or fielding customer requests for proof of certification in Phase 1, this conversation is your quick-hit guide to what matters most.   CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.

The long-awaited final 48 CFR DFARS 7021 rule has dropped, and CMMC is officially headed into contracts. In this special live call-in edition of Cyberspin, the Redspin team gives their quick breakdown to the finalized rule before answering audience questions on everything from SSO/MFA and joint ventures to whether small contractors can realistically achieve Level 2 certification. We also dive into separation of duties, prime pressure on subs, and the most cost-effective paths to certification, and so much more   Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.