Episodes (41)

Eric Marquette and Paul Netopski, a CMMC expert, break down how to identify CUI, where to look in contract artifacts like CDRLs and DIDs, and why export control, OPSEC, and CPI don’t always mean the same thing. They also cover how to handle unclear or inconsistent contract language, confirm obligations, and avoid costly marking and protection mistakes.

This episode breaks down why CMMC success depends on lifecycle planning, from scoping contracts and data flows to building evidence, remediation, and formal assessment readiness. The hosts also dig into real-world scope traps, crosswalking existing controls, and why steady-state monitoring matters after certification.

This episode breaks down what assessors actually need from your System Security Plan control implementation summary: precise control status, exact evidence references, and the real mechanisms behind each claim. It also explains how to handle scoping, inheritance, and external services without leaving gaps or ambiguity.

Paul and Roz break down the System and Information Integrity controls in CMMC 3.14.1 through 3.14.7, focusing on flaw remediation, malicious code protection, alert monitoring, scanning, and detecting unauthorized use with assessor-ready evidence.

They also connect the requirements to NIST guidance and Appendix D, showing how SI-2, SI-3, and SI-4 map to real-world policies, tools, tickets, and logs.

This episode breaks down CMMC System and Communications Protection controls, from defining boundaries and separating public-facing systems to enforcing deny-by-default network rules and stopping split tunneling.

It also covers secure design, role separation, shared resource protections, and how to safeguard CUI while it moves across networks.

In this episode, we break down the three core compliance documents that make the CA domain real in practice: the System Security Plan, the Plan of Action and Milestones, and Continuous Monitoring. We’ll explain what each document is, what it should contain, and how assessors and compliance teams use them together to support CMMC and NIST SP 800-171 implementation.

This episode explores the FCC’s U.S. Cyber Trust Mark for consumer IoT devices and asks a bigger question: what can defense contractors learn from a public-facing cybersecurity label?

We break down how the voluntary labeling program works, where it mirrors Energy Star, and why familiar cybersecurity signals matter to buyers, regulators, and the broader market. We also examine the practical limits of labels, including consumer misunderstanding, uneven adoption, and the gap between baseline assurances and real-world security outcomes.

Finally, we connect the Cyber Trust Mark back to CMMC by showing how both efforts rely on trust signals, documented controls, and evidence-based confidence rather than marketing claims alone.

In this episode of CMMC Unlocked, host Paul Netopski breaks down one of the most misunderstood phrases in the new CMMC rule set and CyberAB guidance: “significant changes.” Many small defense contractors and their advisors worry that any major IT or organizational change will automatically invalidate a hard‑won Level 2 certification. Paul walks through what the 32 CFR Part 170 preamble, the Level 2 Scoping Guide, and the Level 2 Assessment Guide actually say—and what they don’t.

We unpack the distinction between:

• When “significant architectural or boundary changes” require a new certification assessment, and
• When “significant changes” simply require you to update your CMMC Level 2 self‑assessment and affirmation, in line with your ongoing risk management and change‑management processes.

Drawing on earlier episodes about risk assessments and continuous monitoring, Paul offers practical guidance for small DIB organizations and consultants on how to:

• Define what “significant change” means for your environment using NIST SP 800‑37, 800‑53, and 800‑53A concepts.
• Build change‑management checkpoints that flag potential CMMC impact early.
• Decide when a change triggers a new self‑assessment and SPRS update versus when it’s covered by your annual affirmation.
• Keep your System Security Plan, asset inventory, and CMMC Assessment Scope aligned as your environment evolves.

If you’re worried that a tech refresh, cloud migration, or acquisition will blow up your CMMC status, this episode will help you separate rumor from requirement and integrate “significant change” into a mature, risk‑based compliance program.

Explore the critical personnel security requirements within NIST SP800-171 and CMMC 2.0 Level 2 standards. Learn practical processes for screening, onboarding, and access approvals, and uncover the nuances between standard employment screening and federal background investigations to safeguard Controlled Unclassified Information.

Dive into essential physical security controls within CMMC 2.0, from access management to safeguarding support infrastructure. Learn real-world lessons from defense contractors who strengthened facility security and avoided common pitfalls.

Explore key strategies for protecting Controlled Unclassified Information across physical and digital media. Learn practical approaches to handling, marking, encryption, and auditing that ensure compliance and safeguard your organization.

This episode guides listeners through key aspects of Covered Defense Information (CDI), from core definitions and marking requirements to contract data rights and procurement compliance. Hosts Eric, Paul, and Roz break down regulations, risks, and real-world examples to help users, product owners, and procurement staff safeguard sensitive information effectively.