Episode Details

Submit any questions you would like answered on the podcast!

Is the "six-figure CMMC scoping mistake" a real number, or just something people throw around to sound scary? Stacey and Brooke break down where these numbers actually come from, what over-scoping really costs versus under-scoping, and what a defensible scope actually looks like.

In this episode:

• Where the "six figures" scoping numbers actually come from (and why the DoW CIO and SBA's recent numbers conflated compliance cost with certification cost)
• What over-scoping actually costs: pulling in unnecessary cloud systems, remote users, and locations
• What under-scoping actually costs: a $30k-$40k assessment redo at best, a False Claims Act investigation at worst
• The most commonly missed scoping items: downloaded CUI, cached files, backups, CNC-connected computers, and cloud file-sync tools like Prevail Drive
• Why vendors and IT providers (MSPs, MSSPs) are an underscoping trap if their CRM/SRM documentation isn't in place
• Why most over-scoping actually traces back to primes and the government not clearly marking what is and isn't CUI
• 2026 scoping clarifications: encryption doesn't create a CUI boundary, paper-only CUI can limit flowdown, and why FedRAMP 20X won't satisfy DoW requirements
• Real False Claims Act cases where scoping was the legal basis (including a Georgia Tech case)
• What a defensible scope actually looks like in your SSP
• NIST 800-171 Revision 3 on the horizon, and why you need to start planning for it now regardless of what happens with the CMMC pause