Defense contractors assume they understand CMMC assessments, but Matt Bruggeman, Director of GTM Federal at A-LIGN, has a harsh reality check for them: organizations consistently arrive for certification without basic documentation like authorization boundaries or data flow diagrams. The gap between CMMC perception and assessment reality is creating a compliance crisis, he tells Dave.
A-LIGN operates as a top-3 FedRAMP assessor and C3PAO, giving Matt unique visibility into federal compliance across multiple frameworks. His unconventional background combining electrical engineering from Wright-Patterson Air Force Base with professional improv comedy shaped his approach to explaining complex technical requirements through clear communication.
Topics discussed:
- The assessment methodology uses NIST 800-171A that evaluates 320 assessment objectives rather than just 110 controls, requiring organizations to prove compliance across significantly more granular requirements.
- External service provider scope issues that consistently trip up organizations during assessments, particularly around MSP, MSSP, and cloud service relationships that require FedRAMP authorization or equivalent.
- C3PAO backlog management and timing strategies, with smaller assessors facing 3-9 month delays while larger firms like A-LIGN maintain shorter timelines through strategic CCA and CCP resource investments.
- The three-bucket cost structure of CMMC compliance covering infrastructure changes, readiness process management, and assessment fees ranging from $40,000-$80,000 depending on scope complexity.
- Phase 1 documentation review failures where organizations arrive without basic elements like system security plans, authorization boundaries, or data flow diagrams for CUI handling.
- Readiness partner selection criteria and the risks of attempting internal-only compliance approaches that result in failed assessments and doubled costs for remediation.
- The relationship between compliance frameworks and actual security posture, including how feedback during public comment periods can influence framework development and practical implementation.
- FedRAMP equivalency requirements for cloud service providers handling CUI, including the December 2023 DoD memo defining the single pathway through 3PAO assessment against FedRAMP moderate baseline.
- Early C3PAO engagement advantages including assessment planning coordination, partner network efficiencies, and pricing benefits for organizations working with vetted readiness partners.
Listen to more episodes:
Apple
Spotify
YouTube
Website