Reaction to Katie Arrington on CMMC, the Pause & the DIB's Future

Katie Arrington went on CMMC Uncovered and made a few claims that were basically begging for a reaction video. So we pulled together Linda Morales, EVP, Chief Security Officer, and CMMC Practice Lead; Andrew Hennigan, Technical Project Lead and CMMC SME; and Spence Witten, Principal of Cybersecurity Consulting at 38North Security, and had them respond. We got into some of the biggest arguments around CMMC right now: whether self-assessments actually work, whether assessor capacity really justified the pause, what CMMC is costing small businesses, how much of that cost is actually buying better security, and whether the way we define and protect CUI is creating more burden than value. What's covered: • Why self-assessments can fail even when contractors are acting in good faith • Whether the CMMC ecosystem actually had an assessor-capacity problem • Why the cost debate goes far beyond the assessment fee • The opportunity cost of spending this much money and talent on CMMC • Katie Arrington’s proposed SBA cybersecurity loan idea • Why CUI scoping gets messy when aggregation enters the argument • Whether CMMC is focusing too much security effort on the wrong data • What the team would actually change about the program • Why contractors still need to maintain 800-171 and a defensible SPRS score during the pause There's a lot of disagreement in this one, but that's kind of the point. Watch the original interview here:    • Katie Arrington on CMMC, the Pause & the D...   Explore more CMMC insights from 38North Security: https://38northsecurity.com/ Explore 38North Security’s CMMC services: https://38northsecurity.com/security-... #CMMC #NIST800171 #CUI #Cybersecurity #DefenseIndustrialBase #DIB #DoD #GovernmentContracting #38NorthSecurity #Compliance