The CMMC Hot Mic Thu, 03 Sep 2026 06:00:03 -0400 https://www.buzzsprout.com/2640812 en-us © 2026 The CMMC Hot Mic yes d79f36db-8118-54b7-abd8-0fcc6bdeac1a Regis episodic false The CMMC Hot Mic is where the Defense Industrial Base comes to hear the conversations shaping cybersecurity, compliance, and government contracting.


Hosted by Regis DeVeaux, The GovCon CMMC Nerd, the show brings together defense contractor owners, CMMC authorities, GovCon leaders, attorneys, assessors, cybersecurity professionals, and industry connectors for candid conversations about what it really takes to compete, grow, and protect sensitive information in the federal marketplace.


Some episodes go inside the businesses navigating the realities of government contracting. Others bring in the experts interpreting CMMC, NIST 800-171, DFARS, assessments, enforcement, and emerging cybersecurity requirements.


No generic webinars. No compliance theater. Just practical conversations about what contractors are facing, what the experts are seeing, and what business leaders should do next.


Operators. Authorities. Influencers. One mic.


Welcome to The CMMC Hot Mic.

]]> Buzzsprout (https://www.buzzsprout.com) Regis https://storage.buzzsprout.com/kg3qbgvx2fh0dv6epaqyidtm4jyf?.jpg The CMMC Hot Mic https://www.buzzsprout.com/2640812 CMMC Pause Explained: What Defense Contractors Should Really Do Now with Derek Phillips of Aspire Cyber CMMC Pause Explained: What Defense Contractors Should Really Do Now with Derek Phillips of Aspire Cyber CMMC phase 2 is paused, but the compliance burden isn’t. Derek Phillips, founder of Aspire Cyber and a CMMC Lead Certified Assessor, breaks down what the CMMC pause really means, what has not been suspended, and how defense contractors should respond. Drawing on 22+ years of cybersecurity experience from the U.S. Army, defense contractor roles with Lockheed Martin in Iraq and Afghanistan, and corporate stints at Hewlett Packard Enterprise and Bank of America, Derek explains how to stay compliant with NIST SP 800-171, protect against False Claims Act risk, and turn CMMC into a competitive advantage instead of a cost sink. 

 

CMMC Phase 2 is paused, but NIST SP 800‑171, DFARS 7012, and Phase 1 self‑assessments are still fully in force, so contractors cannot treat CMMC as “over.” Derek Phillips explains that third‑party C3PAO assessments are likely to remain a core part of the ecosystem and that Level 2 certification is already a competitive advantage with primes and the DoD. A defensible SPRS score requires a detailed System Security Plan, adequate and sufficient evidence, and tight alignment between written policies, staff behavior, and technical configurations. Small and midsize contractors often struggle with scoping (over‑including systems and users, creating a costly “CMMC tax”) and with treating CMMC as a checkbox rather than a culture shift built on training, incident response planning, and continuous improvement. Derek recommends that unprepared orgs urgently fix scope and cloud usage, “paper‑thin” orgs shore up POA&Ms and evidence with expert help, and nearly‑ready orgs move ahead with Level 2 certification to gain ground while others stall during the pause. 

 

Takeaways: 

  1. CMMC Pause: What Actually Changed (and What Didn’t) 
  2. Defensible SPRS Scores and the Real Compliance Burden 
  3. Smart Scoping, Culture Shift, and Using Level 2 as a Competitive Edge 

 

Quotes:

  1. “Checking your own homework self‑attestation is not a viable path forward to securing national security and sensitive information.” 
  2. “Your system security plan tells your compliance story; it can’t be a three‑page document if you’re trying to address 110 requirements and 320 assessment objectives.” 
  3. “Our adversaries aren’t pausing, so if you pause your CMMC efforts now, you’re going to pay a much higher price trying to regain that momentum later.” 

 

Conclusion: 

CMMC’s Phase 2 pause might have rattled the headlines, but Derek Phillips makes it clear that the real obligations, risks, and opportunities for defense contractors haven’t gone anywhere. The organizations that treat this period as extra runway, tightening scope, hardening their SPRS story, and building a true security culture will be the ones primes and the DoD trust most when the dust settles. Rather than waiting for perfect clarity from Washington, Derek’s guidance is to keep moving: get your environment compliant, your evidence defensible, and, if you’re close, push through to Level 2. The pause is temporary; the need to safeguard national security data is permanent.

]]> CMMC phase 2 is paused, but the compliance burden isn’t. Derek Phillips, founder of Aspire Cyber and a CMMC Lead Certified Assessor, breaks down what the CMMC pause really means, what has not been suspended, and how defense contractors should respond. Drawing on 22+ years of cybersecurity experience from the U.S. Army, defense contractor roles with Lockheed Martin in Iraq and Afghanistan, and corporate stints at Hewlett Packard Enterprise and Bank of America, Derek explains how to stay compliant with NIST SP 800-171, protect against False Claims Act risk, and turn CMMC into a competitive advantage instead of a cost sink. 

 

CMMC Phase 2 is paused, but NIST SP 800‑171, DFARS 7012, and Phase 1 self‑assessments are still fully in force, so contractors cannot treat CMMC as “over.” Derek Phillips explains that third‑party C3PAO assessments are likely to remain a core part of the ecosystem and that Level 2 certification is already a competitive advantage with primes and the DoD. A defensible SPRS score requires a detailed System Security Plan, adequate and sufficient evidence, and tight alignment between written policies, staff behavior, and technical configurations. Small and midsize contractors often struggle with scoping (over‑including systems and users, creating a costly “CMMC tax”) and with treating CMMC as a checkbox rather than a culture shift built on training, incident response planning, and continuous improvement. Derek recommends that unprepared orgs urgently fix scope and cloud usage, “paper‑thin” orgs shore up POA&Ms and evidence with expert help, and nearly‑ready orgs move ahead with Level 2 certification to gain ground while others stall during the pause. 

 

Takeaways: 

  1. CMMC Pause: What Actually Changed (and What Didn’t) 
  2. Defensible SPRS Scores and the Real Compliance Burden 
  3. Smart Scoping, Culture Shift, and Using Level 2 as a Competitive Edge 

 

Quotes:

  1. “Checking your own homework self‑attestation is not a viable path forward to securing national security and sensitive information.” 
  2. “Your system security plan tells your compliance story; it can’t be a three‑page document if you’re trying to address 110 requirements and 320 assessment objectives.” 
  3. “Our adversaries aren’t pausing, so if you pause your CMMC efforts now, you’re going to pay a much higher price trying to regain that momentum later.” 

 

Conclusion: 

CMMC’s Phase 2 pause might have rattled the headlines, but Derek Phillips makes it clear that the real obligations, risks, and opportunities for defense contractors haven’t gone anywhere. The organizations that treat this period as extra runway, tightening scope, hardening their SPRS story, and building a true security culture will be the ones primes and the DoD trust most when the dust settles. Rather than waiting for perfect clarity from Washington, Derek’s guidance is to keep moving: get your environment compliant, your evidence defensible, and, if you’re close, push through to Level 2. The pause is temporary; the need to safeguard national security data is permanent.

]]> Regis Buzzsprout-19738587 Thu, 03 Sep 2026 06:00:00 -0400 3268 full false