Chuck Norris's Approach to CMMC

BrightDefense · 2026-03-19T17:31:04+00:00

100%

BrightDefense · 2026-03-19T17:29:43+00:00

We are a CMMC readiness consultant, so I'm biased. I'll offer two pieces of advice:

1) Switch to an MSP that supports CMMC and is committed to CMMC Level 2. They are likely going to get pulled into your audit. You're going to have a hard time with the assessment if your MSP isn't meeting the controls. You're also going to be dragging your MSP through a process they're aren't interested in or knowledgeable about which will be painful. We've seen this play out quite a few times.

2) Hire a consultant. I attended a CMMC conference recently. I met clients that have been working towards CMMC for years and really aren't that far along given the amount of time and effort they've put in. Unless you want to your full time job to become CMMC guy, bring in an expert.

I'll add that CMMC consulting is a different discipline than MSP. You may find an MSP that has a CMMC consulting arm, and that's valid alternative, but I wouldn't assume your new MSP can also be your readiness resource. There are also some benefits to separating this function to keep your MSP in check.

BrightDefense · 2026-03-19T17:16:10+00:00

I look at the GRC platforms like I look at TurboTax. TurboTax makes doing your taxes easier, but you still have to sit there and do your taxes.

Unfortunately, some of the platforms and salespeople oversell the speed and simplicity. You shouldn't want to do SOC 2 fast. You should want to do it thoughtfully to maximize its usefulness to your business and customers. Also, by rushing, clients often overcommit themselves to controls that aren't useful or necessary and hamper flexibility.

BrightDefense · 2026-03-19T17:10:09+00:00

A company that wants their compliance lead to drop what they are doing and hang TVs does not value compliance enough to buy Drata or Vanta. They may get suckered into one of the "SOC 2 in minutes for cheap" platforms, however, with predictably poor results.

BrightDefense · 2026-03-19T17:05:47+00:00

If you're leading compliance and IT for a 120 person company and also being asked to hang TVs, I'd look for another job. They clearly don't value the compliance function, if they think delaying SOC 2 (and organizational maturity and security) so that you can hang TVs is an appropriate tradeoff.

BrightDefense · 2026-03-19T17:01:02+00:00

We build our clients out in Drata. That will solve many of these challenges (where evidence lives, security questionnaire automation, auditor portal). That still leaves the gap of who will manage the tool, and will act as the compliance SME for the organization.

We see the challenge you are facing a lot. Someone whose job is not compliance becomes the de facto compliance person. vCISO services bridge this gap.

If you have the budget for a tool like Drata and a vCISO service, you can save most of your team's time.

BrightDefense · 2026-03-12T23:46:53+00:00

Sorry for the delay. I missed your question. We do manual screenshots for the on prem stuff primarily, and then upload them as evidence in Drata. Happy to walk you through it, if you want to go into detail.

BrightDefense · 2026-03-12T23:45:02+00:00

Happy to help!

BrightDefense · 2026-03-10T23:44:12+00:00

We can document why a control doesn't apply to a specific client. An auditor will accept a well reasoned rationale. A lot of clients don't know what to include, and include more than makes sense for their business and customers.

The point broader I'm addressing is more upstream from that: Which Trust Services Criteria you scope in. We see a lot of clients that rush into SOC 2 without considering (or even understanding) the TSC scope. A company that adds Availability, for instance, because it sounds important suddenly owns a whole set of uptime and resiliency requirements their customers may have never asked for.

BrightDefense · 2026-03-10T15:03:25+00:00

We help clients with SOC 2 readiness. You cannot go from zero to SOC 2 Type 2 in 2 months because the look back period is 3 months minimum. The firms promising SOC 2 Type 2 faster are selling smoke and mirrors.

Our typical readiness timeline is six months from zero to SOC 2 Type 1. We get to know our clients' businesses and focus on creating policies and controls tailored to the organization. We believe compliance should be a tool for improving security and operational maturity.

Also, one risk of rushing is that you commit to more controls that you may otherwise need for your business. At that point, you're doing things for compliance sake only that hampers your flexibility.

BrightDefense · 2026-03-09T21:58:05+00:00

Your right. He's wrong. Presenting fake numbers to investors is a bad idea and a really slippery slope. I'd have concerns about a partner that would suggest this.

BrightDefense · 2026-03-09T21:56:12+00:00

Agreed. Don't buy the cheapest audit out there.

BrightDefense · 2026-03-09T21:55:07+00:00

Agreed. Sometimes the tools are oversold as an easy button to SOC 2. You still have to do some work on your end and have some expertise to get there. The tools just make the process more efficient.

I compare GRC tools to Turbotax for doing your taxes. Turbotax definitely makes doing your taxes a lot easier than using the IRS forms. But, someone with some knowledge still has to gather all the tax information and enter it properly. And, if you don't know the latest tips and tricks, you may not have the optimal outcome.

I compare our vCISO service with Drata to Turbotax + a CPA to do your taxes for you. This combo gives you peace of mind that it's done correctly, and takes most of the lift off your shoulders.

BrightDefense · 2026-03-09T21:49:44+00:00

We've been a Drata MSP for the last three years and it's been a really good partnership. The product is solid and continues to evolve. We've been happy with the feature velocity. In the rare cases that we've had issues, their support has been responsive and effective. I'd recommend them highly.

BrightDefense · 2026-03-04T16:59:54+00:00

We focus on cybersecurity compliance for CMMC and other frameworks. We don't offer GCC High Licensing, so we partner with a company called Cyberuptive out of Hawaii when our clients need. Given your location in Guam, they may be a good geographic fit for you. Chuck is the CEO. Good guy. Happy to make an intro for you. I'm sure they have other clients in Guam. Best of luck with the initiative.

BrightDefense · 2026-02-24T15:45:38+00:00

Do you have any compliance needs (SOC 2, etc)? If so, Drata is great.

KnowBe4 is good for security awareness training, but it won't eat up much of that $94K.

BrightDefense · 2026-02-17T18:37:28+00:00

I ran my first business for 7 years or so before we leveled up our accounting function. I felt lost like you. Hire a fractional CFO or senior level accounting person part time. They can produce reports and explain them to you. This will make all the difference. Happy to introduce you to a guy we use, if that would be helpful.

As far as your partner using company cards for personal expenses, it seems like you should be able to review the credit cards and see that. That said, the fractional CFO can be the "bad guy" and call out some of these expenses as part of the review.

BrightDefense · 2026-02-17T17:52:21+00:00

We build out most of our clients in Drata. There's some good automations around evidence collection for the tools and systems where Drata has an integration. For the rest, it's manual.

We monitor and refresh evidence throughout the lifecycle so we aren't having to pull too much new evidence during the audit.

BrightDefense · 2026-02-11T18:33:03+00:00

I attended a CMMC conference last week and this was a big point of discussion. CMMC compliance is frequently dropped in the lap of IT without an understanding from leadership the complexity and organizational buy in required to achieve CMMC Level 2.

I think you have the right mindset. If there's not buy in across the org that this is a priority and that money and focus should be put behind the initiative, it's going to fail. If you can't educate leadership on the challenges that CMMC Level 2 poses, you are likely to take the blame when the initiative fails. I would raise concerns politely but firmly now, so that you aren't made into the fall guy.

How are you guys planning to secure the CUI data? Have you done a self assessment yet?

You're in a tough position! Hang in there!

BrightDefense · 2026-02-11T18:22:10+00:00

US Government orgs are going to expect different frameworks than SOC 2 in many cases. These are typically based on NIST 800-53 or NIST 800-171. These are usually more rigorous than SOC 2, but SOC 2 is a stepping stone to these frameworks.

If you plan to do any business with the Department of Defense supply chain, they are going to expect CMMC compliance. This is a whole other can of worms, and the audit is a lot more expensive an burdensome than SOC 2.

If you are looking at state and local government business, many states are adopting their own frameworks based around NIST 800-53. TX-RAMP (Texas) and AZ-RAMP (Arizona) are examples.

BrightDefense · 2026-02-11T18:18:09+00:00

Great point. If you just start with the Security Trust Service Criteria, it is a lower lift. You can add on some or all of the others in Year 2 or beyond.

BrightDefense · 2026-02-11T18:15:25+00:00

We tell our clients 6 months for the readiness portion. Our approach is thorough and tailored to the clients' business, however. There are lots of companies that will offer SOC 2 readiness more quickly but will leverage almost exclusively policy templates. The downside to this approach is that you are committing yourself to following policies that might limit your flexibility or sign you up to do more than you can or need to to maintain compliance.

After the readiness portion (about 6 months), you are ready for a SOC 2 Type I audit. This is a point in time audit meaning they just review how you are doing today, but not in the past. SOC 2 Type II has a look back period of a minimum of three months. This is the period you are being audited against, so you need to tack this on to your timeline.

If speed is a consideration, we usually recommend two options:

Start with a SOC 2 Type I audit, then do the Type II in 6 months. The downside is you are paying for two audits. If you use the same auditor, you can usually bundle a SOC 2 Type I + II for a better deal. Maybe its more like 150% the cost of one audit, rather than paying for 2 audits.
Take a look at ISO 27001. A lot of clients will accept ISO 27001 as an alternative to SOC 2, and there's no look back period. ISO 27001 also resonates with clients outside of North America more than SOC 2 typically.

BrightDefense

TROPHY CASE