We're coming up on our 50th CMMC Q&A livestream.
First, we never get tired of answering questions.
Second, it's amazing how often the same questions come up.
It's also amazing how often new questions come up about old information.
For example, the most recent DFARS class deviation simply reinforces CMMC policy guidance that went into effect in December 2024:
The CMMC phased roll-out begins on the effective date of the 48 CFR CMMC final rule - NOT on October 1st.
We won't know the effective date until the 48 CFR CMMC final rule is published in the federal register (which could be literally any day now).
We've been sitting down answering questions live every week for nearly a year and we don't plan to stop any time soon.

CUI HOTLINE - EMERGENCY EDITION
ICYMI: The 48 CFR CMMC final rule is out.
CMMC Phase 1 begins November 10th, 2025.
Today, 9/9/25, the 48 CFR CMMC final rule is out for public inspection.
Tomorrow, 9/10/25, the rule will be officially published in the Federal Register.
60 days later, 11/10/25, the rule officially goes into effect.
From that day forward, all new DoD solicitations and contracts will include some level of CMMC requirement as a condition of contract award.
Join us today for our instant reaction episode!

Not every question has an answer.
For example: Will CMMC Phase 1 include Level 2 certification assessments?
A lot of people have convinced themselves that Phase 1 will only include self-assessments.
We've read the relevant policies roughly 3,185 times and that's not what they say.
The real question is how to strategize and operate your business under uncertainty.
We sit down every week to try and help with that problem - even if there isn't a black and white answer.

The most confusing part about CMMC is where people get their wacky ideas from.
It is incredibly unlikely that CMMC will be required on October 1st.
It is incredibly likely it will start being required in Q4.
Not every contract will require certification in the first 12 months.
But it's more likely than not that you'll be asked for certification during that same time period.
Want straight answers with citations?
We host a Q&A livestream every Friday at 10am PST.
Check it out.

The latest edition of CMMC whataboutism: L2 certified service providers.
There are nearly 300 Level 2 certified companies out there.
A common reaction I'm seeing:
"Yeah, well, I'll bet a lot of those are just MSPs, not contractors"
This is bizarre because not that long ago everyone was complaining that MSPs wouldn't get certified ahead of their clients, creating a huge bottleneck.
We should want as many of the early adopters to be MSPs as possible.
The MSP Collective Directory lists 24 certified MSPs.
That's ~10% of the current L2 certs.
In addition to our own L2 cert(s) we are coming up on 50 certified clients.
We've seen quite a bit and we answer questions live every Friday.

People have been asking about the CMMC "small biz roll-out".
There is no such thing.
CMMC will be rolled out by contract and the level required will be determined by the type of data handled pursuant to that contract.
The size of the company involved (or the amount of controlled information) is irrelevant.
Every Friday we spend an hour taking live questions on CMMC, DFARS, NIST, etc.
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

This has been the busiest 45 day stretch in CMMC-land I can remember.
- The 48 CFR CMMC final rule is in final regulatory review
- Supplier memos from Lockheed and Boeing re: CMMC
- Official CMMC notices from the Army Corps of Engineers
- SECDEF memo emphasizing CMMC as a strategic priority
That's a lot to keep up with.
Luckily we sit down every Friday to answer questions live.
Don't have time to stop by?
Call the hotline today: 1-866-CUI-7021 (it's a real number)

The longest pole in the CMMC tent isn't the total number of assessors.
It's the collective capacity to implement requirements.
Most companies affected by DoD cyber requirements don't have the ability to implement those requirements.
Only now that CMMC (which verifies implementation) is around the corner are people realizing how far behind they are.
Every Friday we sit down and answer any and every kind of question that we hear from that week and any live questions from the audience.
Don't have time to stop by?
Call the hotline today: 1-866-CUI-7021 (it's a real number)