38North Security Answers CMMC Questions (08 October 2026)

CMMC is in one of those delightful phases where the program is paused, the requirements still exist, your prime may still want an assessment, Rev. 3 is lurking in the distance, and everyone would very much like a straight answer about what they are supposed to do next. So we went to Reddit. In this episode of the, Ingrid Woodley talks with Linda Morales, Executive Vice President, Chief Security Officer; and CMMC Practice Lead, and Andrew Hennigan, Technical Project Lead and CMMC SME at 38North Security, about the questions contractors are actually asking right now. They cover: • What you are supposed to do after you pass a CMMC assessment • Whether it makes sense to start preparing for NIST SP 800-171 Rev. 3 • Whether the CMMC pause actually changes your assessment plans • Why primes may still require subcontractors to keep moving • Why a mock assessment that finds more problems than expected is doing its job • How Box, Kiteworks, PreVeil, and similar tools affect your CMMC boundary • Why “the data is secure once it gets there” is only half the problem • What happens when CUI touches endpoints, physical media, printers, and people • Why buying a compliant tool does not magically make the rest of your environment compliant The recurring theme is pretty simple: CMMC gets much easier to reason about once you stop treating it like a pile of controls and start tracing what actually happens to CUI inside your business. If your current CMMC strategy is “we passed,” “there’s a pause,” or “we bought the tool,” this episode is probably for you. Explore more CMMC insights from 38North Security: https://38northsecurity.com/ Explore 38North Security’s CMMC services: https://38northsecurity.com/security-... #CMMC #NIST800171 #CUI #Cybersecurity #DefenseIndustrialBase #DIB #DoD #GovernmentContracting #38NorthSecurity #Compliance