Episode Details

Submit any questions you would like answered on the podcast!

Every CMMC vendor says the same thing: "we cover 80 out of 110 controls" or "90 out of 110." Austin and Brooke break down what that claim actually means, why "maps to," "satisfies," and "supports" are not interchangeable words, and why you almost always still have work to do even after buying the solution.

In this episode:

• What vendors actually mean when they claim to cover a specific number of the 110 controls
• Why "maps to," "satisfies," and "supports" are different claims with different implications for your compliance program
• Why you can't stack vendors (40 controls from Vendor A plus 50 from Vendor B does not equal 90 covered)
• The moment your computer enters scope even when you're using a fully FedRAMP-compliant vendor: downloading, caching, or transmitting CUI through it
• Why "I never saved it to my computer, I just passed it through" doesn't get you out of scope (process, store, or transmit is the bar)
• How to use a CRM (customer responsibility matrix) or SRM (shared responsibility matrix) to know exactly where a vendor's responsibility ends and yours begins
• Why your MSP or IT provider needs a CRM too, not just your cloud vendors
• The exact questions to ask any vendor before you buy: which control numbers, full satisfaction vs. contribution, which systems and assets it applies to, and what's still on you
• Why vendors can only speak to their own product, not your specific environment, and why you need someone (in-house or outsourced) who understands your full compliance picture