When Restrictive Policies Backfire: Avoiding CMMC Template Traps

Eric Marquette

Welcome to CMMC Unlocked. Here's a number to start with. In a 2025 global study by KPMG and the University of Melbourne, 57% of workers said they had hidden their use of AI, and 48% said they had uploaded company data into public AI tools. That figure sits inside a Harvard Business Review article from October 21, 2026, called "When Restrictive Cybersecurity Policies Backfire," by Aaron Kay, Russell Spitler, and Peter Jin. Full credit to the authors and to HBR. Paul, why does this belong on a CMMC show?

Paul Netopski

Because it explains something I see in assessments. Let me give the authors' credentials first, since they matter. Aaron Kay is a professor at Duke's Fuqua School of Business with a joint appointment in psychology and neuroscience. Peter Jin is a PhD candidate at Fuqua. Russell Spitler is cofounder and CEO of Nudge Security, and his company discovers which SaaS and AI tools employees actually use. He reports that in nearly every deployment, the number of AI tools in use is several times what the security team believed. Verizon's 2026 Data Breach Investigations Report also found shadow AI detections quadrupled in one year. So the ban did not stop the behavior. It pushed the behavior out of sight.

Eric Marquette

And the usual reaction is to say the employees are careless and we need harder enforcement.

Paul Netopski

Right, and the authors say that instinct is understandable. Threats are real and some data should never go into an external AI platform. But their research across six experiments, with more than 2,800 participants, points to two mechanisms. My interpretation of this is that both of them describe what happens when you drop a generic template on a small contractor.

Roz the Rulemaker

Let me separate fact from interpretation, because I'd rather we not overstate this. The facts are that these were experiments, and many had participants read or imagine a workplace scenario. They are not audits of defense contractors. The authors' findings are about beliefs. When people feel a policy takes away a valued freedom, they feel what the authors call psychological reactance, and then they downplay how serious the threat is. The second mechanism is solution aversion. If people dislike the fix, they become more likely to deny the problem.

Eric Marquette

Give me the experiment that shows that.

Roz the Rulemaker

Participants read that everyday apps and websites had become leading entry points for attacks. The threat was explained identically for everyone. Then half read about a firewall that automatically blocks unapproved apps, and half read about education that teaches employees to judge whether apps are safe. The firewall group reported more reactance. They felt more bothered, threatened, and scared. They also showed greater denial that cyber threats were a serious problem. Same threat, different remedy, different belief about the threat.

Paul Netopski

And the training result is the one compliance people should notice. Some participants read that their boss demanded everyone attend cybersecurity training. Others read that they chose it themselves from a menu. Same content: phishing, passwords, common threats. The mandated group reported more reactance and more denial. But in the third study, the requirement stayed mandatory. The only change was choice in how to complete it. In person, live video, or written materials. One session or several. Their pick of day and time. Reactance dropped, and so did the denial of the threat. So the requirement stays and the delivery gets flexible.

Eric Marquette

Now connect this to the episode where we talked about contractors buying 500 page template binders.

Paul Netopski

That's the template trap. A small machine shop buys a package that says no external cloud tools, no personal devices, all USB ports disabled across the whole shop floor, termination for unapproved software. Nobody weighed any of that against how the shop runs. So the estimator uses personal Gmail to send a large CAD file. Someone uses a consumer AI tool to draft a proposal. Someone carries a flash drive to move a CNC program to an offline machine. The policy says never, the work says every day. And this is firsthand testimony, not commentary: an assessment verifies practice through interviews, observations, and artifacts. If the written policy bans what the team does daily, the gap shows up.

Roz the Rulemaker

And the legal exposure follows. When a company affirms compliance, or posts a score in SPRS, for controls its own staff routinely circumvent, that is the False Claims Act risk we discussed before. The HBR authors weren't writing about that. But their research explains why the circumvention happens, and why it's predictable rather than a surprise.

Eric Marquette

There's another finding about lifting a ban, isn't there? That one seems odd for a compliance audience.

Roz the Rulemaker

It does, but it matters. Samsung banned employee use of generative AI tools such as ChatGPT in 2023 after employees uploaded sensitive code. In 2026, according to the article, Samsung reportedly shifted toward allowing outside AI models for some employees, with security training and controlled access. That is a reasonable evolution. But the authors found that when people recalled or imagined a lifted policy, they were more likely to say the original risk was exaggerated, even compared with a company that never had a ban. When the company lifted the ban but said plainly that serious data risks remain, that effect shrank. The authors called that intervention largely effective.

Paul Netopski

So when you replace a blunt rule with a proper enclave or an authorized tool, say the risk didn't go away. This is an area with issues for sure, because a template written in panic is the kind of rule you end up reversing.

Eric Marquette

So what do we do instead of the template?

Paul Netopski

Three steps. First, identify the threat. Follow the data and find where CUI actually lives, across people, technology, and physical locations. Second, calculate the risk. A commercial administrative function is not the same as an environment processing CUI. Third, apply the control that fits that place. That means the brilliant basics: multifactor authentication, centralized logging, automated patching. It also means a secure, functional enclave or an authorized cloud tool for CUI work, so the secure path is the easy path. That lines up with the authors' second principle, make the secure path less aversive. Their point is that if approved tools are slower or poorly matched to the work, you risk pushing shadow IT further from view.

Roz the Rulemaker

The other HBR principles translate too. Give employees choice inside the guardrails, such as an approved menu of tools. Explain the threat before imposing the control. Plan the exit before imposing a temporary ban. And measure beliefs in addition to compliance, meaning whether employees see the policy as legitimate, not just whether the training completion box is checked. I'd add one caution. The authors say plainly they are not arguing against restrictions. Some systems should be locked down.

Paul Netopski

Agreed, and that's the point. Lock down where the risk calculation says to. Don't paralyze the whole business with a rule written for a different company. A policy people quietly work around is worse than a narrower policy people actually follow.

Eric Marquette

So the lesson is risk first, policy second. Thanks to Aaron Kay, Russell Spitler, and Peter Jin, and to Harvard Business Review, for the research. I'm Eric Marquette, and this has been CMMC Unlocked.