Insights
New thinking, plainly put.
Readiness, assessments, and the work that wins contracts — written for the founder who has to make the call.
-
Pentagon to C3PAOs: Drop Dead
The Pentagon has all but decided to fire the 3rd party auditors they asked the industry to set up to make sure CMMC had teeth. The lawyers are still around.
Read -
What Is the Difference Between a CMMC Gap Assessment and a Readiness Assessment?
A CMMC gap assessment measures where you stand against the 110 controls and produces a score and a list. Readiness closes the list and gets you to a passable posture. Where 88 and the C3PAO fit.
Read -
How Much Does CMMC Level 2 Readiness Cost for a Small Contractor?
CMMC Level 2 readiness cost has five parts: the gap assessment, documentation, technical fixes, the C3PAO assessment, and upkeep. What drives each up or down for a 10 to 100 person defense subcontractor.
Read -
Who Should a Small Defense Subcontractor Hire to Get Ready for CMMC Level 2?
A small defense subcontractor needs to get ready before signing with a C3PAO: in house if you have the bandwidth, a readiness partner if not. How RPOs, C3PAOs, MSPs, and compliance platforms differ, what to ask on the first call, and the red flags.
Read -
Why Readiness Comes Before the Assessment
The firm that gets you ready can't be the firm that grades you. Passing your CMMC assessment starts with the work you do before the assessor shows up.
Read -
Compliance should just work
A first-principles essay on trust, verification, and why the proof of trust is about to be rebuilt.
Read -
Nobody Built the First Mile
The structural gap between CMMC assessors and the small defense contractors who need readiness work, and why the window to fix it is closing.
Read