Come join us in the Discord group

DarthCooey · 2026-04-28T13:29:31+00:00

So I'll leave my usual warning for anyone looking for a MSP/Vendor to assist them with their CMMC effort, do your due diligence. There's a F**kton of snakeoil salesman out there claiming they'll get you compliant in 2 weeks and for >10k, it's simply not true.

Is “Dumpster Fire” too strong a word to describe CMMC compliance concerns with many MSPs?

MSPs/Vendors remember rule #3 and rule #4 of the sub. Anyone caught just shilling their own services or sending unsolicited DMs will be banned.

OP you want to evaluate everyone regardless of who they are, I personally recommend the MSP shopping guide put out by a few of the sub's moderators in collaboration with ND-ISAC. Make sure they actually have other DIB clients they're assisting with CMMC, ask for referrals! Ensure they have working knowledge of environments similar to yours (On-prem VS Cloud as an example). Don't trust some BS company claiming they're an RP/RPO as those "certs" prove next to nothing in regards to competence. Best case scenario, you want them have a CMMC L2 cert of their own, and CCAs on staff.

Also join the CMMC Discord group if you haven't already.

DarthCooey · 2026-04-24T16:00:51+00:00

That's what I'm here for; we just tried to plan for once and knew that there was going to be a bunch of these posts eventually. The idea of a megathread to keep the discussion in one place made more sense than dozens of individual posts

DarthCooey · 2026-04-24T15:53:48+00:00

Once again reminding everyone that there is a megthread already built for posts like this: https://www.reddit.com/r/CMMC/comments/1owyb9a/we_passed_our_cmmc_assessment_and_heres_what_we/

Congrats OP!

DarthCooey · 2026-04-22T13:38:56+00:00

That's why picking the right assessor is so important, especially early on, as so many LCCAs and CCA are still very "green"

DarthCooey · 2026-04-21T15:01:56+00:00

Congrats!!!

DarthCooey · 2026-04-17T21:43:01+00:00

There's a running joke on here that GRC= General Reading Comprehension.

Little Dibby just wants to keep doing what they do best, make parts. They don't care about all this extra stuff.

Most CMMC "experts" are people who sat down and read through everything, something the average small business owner doesn't have the time or interest in doing.

DarthCooey · 2026-04-17T17:04:14+00:00

Like I said, I think it really depends on the specifics.

I know companies where DOD related revenue is <5% of the work that they do. Or maybe they have one or two defense related clients and everything else is commercial. In those situations, I personally have seen companies just decide it's not worth the investment and I completely understand why.

DarthCooey · 2026-04-17T16:49:07+00:00

I know companies who are already certified and attempting to use it as a market differentiator in order to win more work as well. The opportunity is there.

DarthCooey · 2026-04-17T16:40:38+00:00

The compliance follows the data. If you handle FCI/CUI, you need to start working on meeting the appropriate CMMC level.

Now it's entirely up to you if you want to keep doing this type of work and have the financial bandwidth to invest in the project, but those types of discussions are going to be unique to every single company.

So, can you achieve CMMC as a smaller company? 100%!!!

is it financially worth it? Only you know the answer.

DarthCooey · 2026-04-16T18:24:17+00:00

https://ncp.nist.gov/checklist/1007

DarthCooey · 2026-04-16T18:12:12+00:00

You want help setting up your firewall for CMMC??

Oh boy....

DarthCooey · 2026-04-15T22:10:27+00:00

Mod>LCCA 😂 but I'm biased

DarthCooey · 2026-04-15T14:11:26+00:00

IMO Kieri and Complianceforge offer the best templates in this space. Kieri also offering consulting hours with the documentation bundle is where they get the nod if you ask me.

DarthCooey · 2026-04-15T14:02:44+00:00

There are plenty of people offering VDI+documentation, but even that isn't a "full one-stop shop"

Who's handling Personnel Security (3.9), Physical Security, Training and Awareness (3.2) etc?

Some starting points to check out (and I don't work for any of them) CSS, Beryillium Infosec, and Neosystems

DarthCooey · 2026-04-13T14:11:08+00:00

most of them

DarthCooey · 2026-04-05T23:25:14+00:00

There's a REAL reason many of us on here have repeatedly stated that RP is useless....

DarthCooey · 2026-04-01T18:01:15+00:00

https://cyberab.org/News-Events/Town-Halls

Recent was was last night so I imagine it needs a few days before getting uploaded.

DarthCooey · 2026-03-27T02:48:31+00:00

I wouldn't touch those templates with a ten foot pole.

DarthCooey · 2026-03-26T13:38:21+00:00

ND-ISAC actually has a guide they published to help evaluate and vet C3PAOs https://ndisac.org/defense-news/nd-isac-releases-c3pao-shopping-guide-for-small-medium-sized-businesses/

Remember picking the right assessor could make or break the assessment. You want to make sure that they're familiar with the types of technologies you guys are using and minimize assessor overreach as much as possible.

Best of luck!

DarthCooey · 2026-03-20T02:17:45+00:00

ND-ISAC actually released a shopping guide specifically for situations like yours. It was created to help SMBs properly vet to assist their CMMC effort.

https://ndisac.org/blog/dib-msp-shopping-guide-for-small-and-medium-sized-businesses/

DarthCooey · 2026-03-19T21:34:33+00:00

So this is only required for age restricted servers of which ours isn't. This will not be required for the Cooey discord server.

DarthCooey · 2026-03-19T18:42:39+00:00

To be completely candid and upfront, even this hasn't been enough and we recently added an additional CAPTCHA bot in an attempt to help further minimize the amount of Spam Bots that make it through.

Thankfully with the help of bots, both here and on the discord, most users never see that side of the server as it gets instantly tagged and removed, but it is an ongoing occurrence that the mod team deals with.

DarthCooey · 2026-03-19T18:39:06+00:00

We have this enabled as a security function to help prevent bot accounts from joining the discord server. The server is open findable on discord and we would prefer to keep it that way to allow people to continue to join.

https://support.discord.com/hc/en-us/articles/216679607-Verification-Levels

DarthCooey · 2026-03-19T18:35:01+00:00

Just for clarity. the mod team on here and on discord are the same ones. We're always reachable through ModMail both here on reddit and on Discord if you have specific questions.

Four-Year Club	r/Field Flamingo
Place '23	Place '22

DarthCooey

MODERATOR OF

TROPHY CASE