The state of NIST/CMMC compliance today

The talk explains why the Cybersecurity Maturity Model Certification (CMMC) and the NIST 800-171 standard matter to businesses that work with the federal government, particularly in Virginia, where that work is a major industry. The speaker outlines how contract clauses protect federal contract information and controlled unclassified information, and how those requirements flow down to subcontractors several tiers removed. Breach reporting within 72 hours is highlighted as a duty that can apply well beyond the direct contract holder.

The middle section traces how the false claims case involving Aerojet Rocketdyne pushed the Defense Department toward third-party audits. The speaker covers the SPRS scoring system, which already affects whether firms win deals, and the 110 controls behind NIST 800-171. Scoping is explained as a way to limit audit burden by separating systems that handle controlled information from those that do not. A recent draft revision is described as turning previously assumed practices into explicit requirements. The speaker argues that management buy-in and engagement with customers and suppliers should come before technical work, and notes that the standard addresses confidentiality rather than business continuity.

The closing portion covers audit and remediation costs, the risk of trading compliance work against other security projects, and the expense of duplicating cloud environments for export-controlled data. The speaker recommends GRC tooling, free government training and threat information, and legal review. The main takeaway is that compliance is a business program built on policies, governance and clear ownership across the organisation, not only an IT project.