CUI Hotline: Live CMMC Q&A

The government shutdown continues, but CMMC phase 1 is still 11/10/2025.A trickle of notices are still going out on SAM[.]gov and they clearly include CMMC requirements. Have questions? We have answers live every Friday!

We're less than 30 days away from the start of CMMC phase 1.That means lots of people with lots of questions.We sit down for an hour every Friday to answer questions live.CMMC, DFARS, NIST, you name it. Come hang out!

We're just 35 days away from the start of CMMC phase 1. Have questions? We've been streaming live every Friday for over a year.Come hang out!

Every week we sit down to answer as many questions as possible in an hour.And we do it live!I used to think an hour was too long, but with nearly 100 live viewers every week we can barely get through everything.See you there!

Some of the most interesting questions are the ones that don't get asked.Lots of people assume they will be allowed to self-assess CMMC level 2 during phase 1 of the roll-out.First, DoD policy has a caveat to phase 1 so big you could drive a truck through it - level 2 certifications will absolutely be required.Second, according to the final rule estimate, only 2% of defense contractors would qualify for a level 2 self-assessment.With such a large policy gap and such a small % chance, where is the confidence in self-assessments coming from?Tune in Fridays at 10am PST and we'll try to figure it out together.

Here we are nearly a year later at live episode no. 50!And the Summit 7 YouTube channel recently crossed 60,000 subscribers!Our audience has collectively spent over 15,000 hours watching our CUI Hotline livestreams alone.We absolutely love interacting with everyone each week.Here's to 50 more!

We're coming up on our 50th CMMC Q&A livestream.First, we never get tired of answering questions.Second, it's amazing how often the same questions come up.It's also amazing how often new questions come up about old information.For example, the most recent DFARS class deviation simply reinforces CMMC policy guidance that went into effect in December 2024:The CMMC phased roll-out begins on the effective date of the 48 CFR CMMC final rule - NOT on October 1st.We won't know the effective date until the 48 CFR CMMC final rule is published in the federal register (which could be literally any day now).We've been sitting down answering questions live every week for nearly a year and we don't plan to stop any time soon.

CUI HOTLINE - EMERGENCY EDITIONICYMI: The 48 CFR CMMC final rule is out.CMMC Phase 1 begins November 10th, 2025.Today, 9/9/25, the 48 CFR CMMC final rule is out for public inspection.Tomorrow, 9/10/25, the rule will be officially published in the Federal Register.60 days later, 11/10/25, the rule officially goes into effect. From that day forward, all new DoD solicitations and contracts will include some level of CMMC requirement as a condition of contract award.Join us today for our instant reaction episode!

Not every question has an answer. <br>For example: Will CMMC Phase 1 include Level 2 certification assessments?<br>A lot of people have convinced themselves that Phase 1 will only include self-assessments. <br>We've read the relevant policies roughly 3,185 times and that's not what they say.<br>The real question is how to strategize and operate your business under uncertainty.<br>We sit down every week to try and help with that problem - even if there isn't a black and white answer.

The most confusing part about CMMC is where people get their wacky ideas from.It is incredibly unlikely that CMMC will be required on October 1st.It is incredibly likely it will start being required in Q4.Not every contract will require certification in the first 12 months.But it's more likely than not that you'll be asked for certification during that same time period.Want straight answers with citations? We host a Q&A livestream every Friday at 10am PST.Check it out.

The latest edition of CMMC whataboutism: L2 certified service providers.There are nearly 300 Level 2 certified companies out there.A common reaction I'm seeing: "Yeah, well, I'll bet a lot of those are just MSPs, not contractors"This is bizarre because not that long ago everyone was complaining that MSPs wouldn't get certified ahead of their clients, creating a huge bottleneck.We should want as many of the early adopters to be MSPs as possible.The MSP Collective Directory lists 24 certified MSPs. That's ~10% of the current L2 certs.In addition to our own L2 cert(s) we are coming up on 50 certified clients.We've seen quite a bit and we answer questions live every Friday.

People have been asking about the CMMC "small biz roll-out".There is no such thing.CMMC will be rolled out by contract and the level required will be determined by the type of data handled pursuant to that contract.The size of the company involved (or the amount of controlled information) is irrelevant.Every Friday we spend an hour taking live questions on CMMC, DFARS, NIST, etc.If you can't make it feel free to leave a question in the comments and we'll be sure to include it.Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

This has been the busiest 45 day stretch in CMMC-land I can remember.- The 48 CFR CMMC final rule is in final regulatory review- Supplier memos from Lockheed and Boeing re: CMMC- Official CMMC notices from the Army Corps of Engineers- SECDEF memo emphasizing CMMC as a strategic priorityThat's a lot to keep up with.Luckily we sit down every Friday to answer questions live.Don't have time to stop by?Call the hotline today: 1-866-CUI-7021 (it's a real number)

The longest pole in the CMMC tent isn't the total number of assessors.It's the collective capacity to implement requirements.Most companies affected by DoD cyber requirements don't have the ability to implement those requirements.Only now that CMMC (which verifies implementation) is around the corner are people realizing how far behind they are.Every Friday we sit down and answer any and every kind of question that we hear from that week and any live questions from the audience.Don't have time to stop by? Call the hotline today: 1-866-CUI-7021 (it's a real number)

We've been taking live questions about CMMC every week for almost a year.What's the most common question, by far?"How fast can we go?"Meanwhile, Reddit threads are popping up from folks who have been duped by companies claiming compliance can attained in a matter of days.Or that 100% of compliance can be outsourced to an external service provider.Do you have a sinking feeling that you've been sold something that's too good to be true?Call the hotline today: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!If you can't make it feel free to leave a question in the comments and we'll be sure to include it.Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!If you can't make it feel free to leave a question in the comments and we'll be sure to include it.Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!If you can't make it feel free to leave a question in the comments and we'll be sure to include it.Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!If you can't make it feel free to leave a question in the comments and we'll be sure to include it.Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!If you can't make it feel free to leave a question in the comments and we'll be sure to include it.Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)