CUI Hotline: Live CMMC Q&A

We're one month into Phase 1 of the CMMC roll out and reality is setting in for a of companies.
Some opted to wait until the last minute as a strategy.
Some waited with no intention of ever getting started.
We get very different questions from both groups.
Luckily we sit down every Friday and answer as many as we can - live!

For the first time in five years there are no major rulemaking updates looming over the holiday season.
CMMC is in-effect, the phased roll-out is underway, and requirements are being signaled by the government and primes alike.
Instead of one or two big questions, it's the season of a million little questions.
That's why we do the Q&A livestream every Friday!

We're quickly approaching 67 CMMC Level 2 clients.
We sit down every Friday to share what we've learned.
Find us live on YouTube, LinkedIn, or reach out at cuihotline[.]org

First hotline of CMMC Phase 1!
Join us live every Friday at 1pm EST on LinkedIn and YouTube.
We answer questions about everything from DoD cyber regulations to individual controls to technology and service strategies real companies have used to achieve CMMC Level 2.

Alrighty folks, the last CUI Hotline before the start of CMMC Phase 1!
This is a great time to check out the stream and bring your questions on all things NIST, CMMC, and DFARS cyber.

CMMC Phase 1 begins just after Halloween - spooky!
To celebrate we're telling CMMC ghost stories on the hotline.
Boo!

The government shutdown continues, but CMMC phase 1 is still 11/10/2025.
A trickle of notices are still going out on SAM[.]gov and they clearly include CMMC requirements.
Have questions? We have answers live every Friday!

We're less than 30 days away from the start of CMMC phase 1.
That means lots of people with lots of questions.
We sit down for an hour every Friday to answer questions live.
CMMC, DFARS, NIST, you name it.
Come hang out!

We're just 35 days away from the start of CMMC phase 1.
Have questions?
We've been streaming live every Friday for over a year.
Come hang out!

Every week we sit down to answer as many questions as possible in an hour.
And we do it live!
I used to think an hour was too long, but with nearly 100 live viewers every week we can barely get through everything.
See you there!

Some of the most interesting questions are the ones that don't get asked.
Lots of people assume they will be allowed to self-assess CMMC level 2 during phase 1 of the roll-out.
First, DoD policy has a caveat to phase 1 so big you could drive a truck through it - level 2 certifications will absolutely be required.
Second, according to the final rule estimate, only 2% of defense contractors would qualify for a level 2 self-assessment.
With such a large policy gap and such a small % chance, where is the confidence in self-assessments coming from?
Tune in Fridays at 10...

Here we are nearly a year later at live episode no. 50!
And the Summit 7 YouTube channel recently crossed 60,000 subscribers!
Our audience has collectively spent over 15,000 hours watching our CUI Hotline livestreams alone.
We absolutely love interacting with everyone each week.
Here's to 50 more!

We're coming up on our 50th CMMC Q&A livestream.
First, we never get tired of answering questions.
Second, it's amazing how often the same questions come up.
It's also amazing how often new questions come up about old information.
For example, the most recent DFARS class deviation simply reinforces CMMC policy guidance that went into effect in December 2024:
The CMMC phased roll-out begins on the effective date of the 48 CFR CMMC final rule - NOT on October 1st.
We won't know the effective date until the 48 CFR CMMC final rule is published...

CUI HOTLINE - EMERGENCY EDITION
ICYMI: The 48 CFR CMMC final rule is out.
CMMC Phase 1 begins November 10th, 2025.
Today, 9/9/25, the 48 CFR CMMC final rule is out for public inspection.
Tomorrow, 9/10/25, the rule will be officially published in the Federal Register.
60 days later, 11/10/25, the rule officially goes into effect.
From that day forward, all new DoD solicitations and contracts will include some level of CMMC requirement as a condition of contract award.
Join us today for our instant reaction episode!

Not every question has an answer.
For example: Will CMMC Phase 1 include Level 2 certification assessments?
A lot of people have convinced themselves that Phase 1 will only include self-assessments.
We've read the relevant policies roughly 3,185 times and that's not what they say.
The real question is how to strategize and operate your business under uncertainty.
We sit down every week to try and help with that problem - even if there isn't a black and white answer.

The most confusing part about CMMC is where people get their wacky ideas from.
It is incredibly unlikely that CMMC will be required on October 1st.
It is incredibly likely it will start being required in Q4.
Not every contract will require certification in the first 12 months.
But it's more likely than not that you'll be asked for certification during that same time period.
Want straight answers with citations?
We host a Q&A livestream every Friday at 10am PST.
Check it out.

The latest edition of CMMC whataboutism: L2 certified service providers.
There are nearly 300 Level 2 certified companies out there.
A common reaction I'm seeing:
"Yeah, well, I'll bet a lot of those are just MSPs, not contractors"
This is bizarre because not that long ago everyone was complaining that MSPs wouldn't get certified ahead of their clients, creating a huge bottleneck.
We should want as many of the early adopters to be MSPs as possible.
The MSP Collective Directory lists 24 certified MSPs.
That's ~10% of the current L2 certs.
In addition to our...

People have been asking about the CMMC "small biz roll-out".
There is no such thing.
CMMC will be rolled out by contract and the level required will be determined by the type of data handled pursuant to that contract.
The size of the company involved (or the amount of controlled information) is irrelevant.
Every Friday we spend an hour taking live questions on CMMC, DFARS, NIST, etc.
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
...

This has been the busiest 45 day stretch in CMMC-land I can remember.
- The 48 CFR CMMC final rule is in final regulatory review
- Supplier memos from Lockheed and Boeing re: CMMC
- Official CMMC notices from the Army Corps of Engineers
- SECDEF memo emphasizing CMMC as a strategic priority
That's a lot to keep up with.
Luckily we sit down every Friday to answer questions live.
Don't have time to stop by?
Call the hotline today: 1-866-CUI-7021 (it's a real number)

The longest pole in the CMMC tent isn't the total number of assessors.
It's the collective capacity to implement requirements.
Most companies affected by DoD cyber requirements don't have the ability to implement those requirements.
Only now that CMMC (which verifies implementation) is around the corner are people realizing how far behind they are.
Every Friday we sit down and answer any and every kind of question that we hear from that week and any live questions from the audience.
Don't have time to stop by?
Call the hotline today: 1-866-CUI-7021 (it's...

We've been taking live questions about CMMC every week for almost a year.
What's the most common question, by far?
"How fast can we go?"
Meanwhile, Reddit threads are popping up from folks who have been duped by companies claiming compliance can attained in a matter of days.
Or that 100% of compliance can be outsourced to an external service provider.
Do you have a sinking feeling that you've been sold something that's too good to be true?
Call the hotline today: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.

And we do it live!

If you can't make it feel free to leave a question in the comments and we'll be sure to include it.

Can't stay to chat?

Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we sit down and provide the analysis other people use to train their lame "AI" models.
We answer all the questions about CMMC, DFARS, NIST, CUI, and more.
We stream live on LinkedIn and YouTube but if you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021

Every Friday we answer questions about all the acronyms people love to hate:
- CMMC- DFARS- NIST- CUI
We stream live on LinkedIn and YouTube but if you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021

CS2 might be gone, but the CUI Hotline is forever.
Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
We stream LinkedIn and YouTube but if you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021

Join us for our weekly CMMC Q&A livestream at a special time and place.

We've had a ton of awesome questions submitted at CUIhotline[.]org and we've saved our favorites for our biggest event of the year: CS2 Reston.

We have engineered CS2 to have nearly 4 hours of Q&A time over two days but there is just never enough.

So this year we're bringing the CUI Hotline on stage for the full hour everyone knows and loves (with special guests!)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.

And we do it live!

We've done over 30 hours of live Q&A in the last 8 months and we're not stopping any time soon.

We stream LinkedIn and YouTube but if you can't make it feel free to leave a question in the comments and we'll be sure to include it.

Can't stay to chat?
Call the hotline: 1-866-CUI-7021

There are no stupid questions during the weekly live CUI hotline.

There are stupid LinkedIn posts based on an obvious lack of understanding.

Do or someone you know have an intense urge to:

- Post completely incorrect information about CMMC on social media?
- Conflate CMMC with the other clauses in the DFARS cyber series?
- Blame CMMC for the DoD's CUI program?

Try stopping by our weekly live Q&A first and save yourself the time.

Can't stay to chat?

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!

If you can't make it feel free to leave a question in the comments and we'll be sure to include it.

Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!

If you can't make it feel free to leave a question in the comments and we'll be sure to include it.

Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.And we do it live!

If you can't make it feel free to leave a question in the comments and we'll be sure to include it.

Can't stay to chat?Call the hotline: 1-866-CUI-7021 (it's a real number)

Every Friday we spend an hour taking questions on CMMC, DFARS, NIST, etc.
And we do it live!
If you can't make it feel free to leave a question in the comments and we'll be sure to include it.
Can't stay to chat?
Call the hotline: 1-866-CUI-7021 (it's a real number)

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Got CMMC questions? Call now or visit the site to leave your questions today, we'll answer them LIVE every Friday at 1 PM EST right here on YouTube and on LinkedIn: https://www.cuihotline.org
Got CMMC questions that keep popping up? We're here to set things straight with answers you didn’t even know you needed! Every Friday, join our laid-back, no-fluff hotline for real talk about compliance.
Yep, it’s as easy as dialing! Drop us a message—any question, any topic, big or small. Just call 886-CUI-7021 (yup, that’s 886-284-7021). Operators (aka our voicemai...

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at cuihotline.org

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?
If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠cuihotline.org⁠

Questions about CMMC rulemaking? DFARS cyber compliance? Technical solutions for meeting NIST controls? Anything in between?

If so, this event is for you. Jacob and Daniel sit down every week to go over, well, everything.

Call us at 1-866-CUI-7021 or visit us at ⁠cuihotline.org⁠