Lessons Learned from 25 CMMC Assessments

Transcript & Notes

The CMMC program has been in effect for six months, and hundreds of early adopters have already achieved CMMC Level 2 status. In this conversation, Fernando Machado — managing principal at Cybersec Investments, an authorized C3PAO — shares what he learned completing 25 CMMC Level 2 assessments: what separates the companies that pass from the ones that stumble.

Lessons from 25 CMMC assessments

In this conversation:

• Who are these 25 companies?
• How many had false starts?
• How many landed in conditional status?
• How many outright failed?
• The green flags that predict success
• How long assessments actually take
• The most common issues he sees
• Implementation pitfalls
• Issues unique to certain industries
• The NIST requirements that trip people up most
• Why companies are starting early
• The business benefits of certification
• What assessments cost