Episode Details

Submit any questions you would like answered on the podcast!

Small aerospace suppliers are getting hit with the same CMMC questions over and over: what do I actually need to do if my contract requirements aren't clear yet, does redacting a drawing get it out of CUI territory, will a tool like ThreatLocker or Prevail make me compliant, and what is this actually going to cost. In this episode, Stacey and Brooke from Justice IT Consulting go through the real answers small manufacturers, machine shops, and engineering firms need before the November 10, 2026 DFARS CMMC requirement hits new DOD contracts.

Topics covered:

• Why you can't fully plan compliance without knowing FCI vs. CUI exposure, and what that means for your Microsoft 365 environment (GCC vs. GCC High)
• Why redacting a customer name or contract number from a drawing does NOT remove CUI status
• Why compliance tools alone (ThreatLocker, Prevail, etc.) can't get you certified
• Realistic cost ranges for CMMC Level 2 certification, and why "$5,000" and "$20,000" quotes are misleading
• How far a small company can actually get doing CMMC in-house, including where AI-generated policies fall short
• Whether to start at Level 1 and move up later, or go straight to Level 2
• What changes for new DOD contracts after November 10, 2026
• How to get an honest readiness check with a gaps assessment before spending money

We're also co-hosting a free live webinar with FutureFeed and Preveil on shared responsibility in CMMC assessments, covering how to read a customer responsibility matrix and close gaps before they become assessment findings. Tuesday, July 21st at 12 PM Central. 

Register (free, recording sent to all registrants): cmmccomplianceguide.com/podcast