CMMCJul 22, 202627:10
The Woman Who Wrote CMMC: The $250K "Compliance Cost" Is a Lie | EP: 334
Featured guest
Katie Arrington
Architect of CMMC, former DoD CIO/CISO · U.S. Department of Defense
CMMC compliance is one of the most misunderstood requirements in government contracting, and the rumor that it costs small businesses $250,000 is simply not true. In this episode, Eric Coffie sits down with Katie
About this episode
CMMC compliance is one of the most misunderstood requirements in government contracting, and the rumor that it costs small businesses $250,000 is simply not true. In this episode, Eric Coffie sits down with Katie Arrington, the architect behind CMMC, to break down what the real audit actually costs, why the rule was just paused for 60 days, and what small businesses need to know before making any decisions. If you have ever felt confused or priced out by CMMC headlines, this conversation sets the record straight.
Key discussion points from this episode:
In this episode, you'll learn
- Why the real CMMC audit costs around $20,000, not the $250,000 number circulating online How 75 percent of small businesses have already completed their compliance work without government funding
- Why the False Claims Act creates serious risk for companies that claim compliance they have not actually achieved
- How the level two maturity model was designed to give small businesses a roadmap from unclassified work to handling CUI
- Why the 60 day pause is meant for public comment and not a rollback of the CMMC rule itself
Show notes & timestamps
- 0:00Introducing Mindy your federal contract research assistant
- 0:55Debunking the 250K CMMC cost myth
- 1:45Understanding the difference between audit and compliance costs
- 4:08Why CMMC has always been a net positive
- 5:34How the False Claims Act protects taxpayers
- 6:29Two changes Katie Arrington would make to CMMC
- 9:46Why small businesses fund their own compliance already
- 12:07The driver's license analogy for cybersecurity standards
- 15:27Comparing CMMC to banking and healthcare security systems
- 19:20Please stop confusing compliance with an audit
- 21:40Why this is not the time to lower cyber standards
- 25:49Closing thoughts and where to find Mindy
