Podcast Summary: "Sum IT Up: CMMC News Roundup"

Episode: DoD CIO: Stop complaining about CMMC
Date: May 15, 2025
Host: Summit 7

Overview

This episode centers on the recent no-nonsense keynote delivered by Katie Arrington, the Department of Defense's acting Chief Information Officer (DoD CIO), at Tech Net Baltimore. Arrington, known for her blunt communication style and as a driving force behind the Cybersecurity Maturity Model Certification (CMMC) program since its inception, addressed industry skepticism and complaints surrounding CMMC. The hosts dissect her statements, clarify misconceptions, and stress the urgency for defense contractors to comply with existing cybersecurity regulations.

Key Discussion Points & Insights

1. Katie Arrington’s Keynote: Setting the Record Straight

• “CMMC is happening, so knock it off” ([01:43])

  • Katie Arrington opened her keynote with a definitive proclamation aimed at dispelling rumors or hopes that CMMC requirements might be delayed or canceled.
  • The directness of her message is described as a necessary wake-up call for industry stakeholders still in denial.

  "Anybody hear about that thing called the CMMC? ... it's happening, so knock it off. All right?"
  — Katie Arrington ([01:43])

• Presidential Endorsement and Bipartisan Longevity ([01:54])

  • Arrington highlighted that her position as CIO is a clear indicator of the administration’s commitment to CMMC.
  • She noted that CMMC’s development spans both the Trump and current administrations, underscoring its durability beyond politics.

  "CMMC started in Trump 1. It will finish and start and be implemented in Trump 2, the end. Story's over. Let's move on."
  — Katie Arrington ([01:54])

• The hosts note that such bluntness is both refreshing and necessary, recalling how impactful Arrington’s statements were in the early days of CMMC discourse ([00:37-01:16]).

2. CMMC as Verification, Not New Requirements

• Not a New Set of Requirements ([04:23])

  • Recalling the wisdom of Arrington’s mother, the keynote reframes CMMC not as an added burden but as verification of requirements (NIST SP 800-171) that have existed since 2014.
  • The narrative that requirements are 'constantly changing' is labeled as misinformed.

  "It's only an audit measure for you to do what you were contractually required by law to do since 2014, which is implement the NIST 7171."
  — Katie Arrington (channeling her mom) ([04:23])

  • The hosts reinforce this:
    • CMMC ensures these pre-existing requirements are actually being implemented.
    • Many complaints are rooted in fear—a fear of the unknown or of being unprepared ([06:28]).

3. Accountability: The Real Source of Pushback

• Industry Hesitance Linked to Fear and Non-Compliance ([07:33])

  • Arrington confronts contractors who failed to integrate compliance costs into their pricing:

    "If you didn't build it into your rate because you weren't doing it, shame on you... you should have built your rates based on the requirements the government gave to you."
    — Katie Arrington ([07:33])

  • She connects this shortcoming directly to the increase in False Claims Act investigations, emphasizing that compliance has been a legal requirement for over a decade.

  • Key statistic: The defense industrial base continues to lose an average of $250 million daily due to cyber shortfalls ([08:53]).

4. The Communication Gap and Bluntness Factor

• Frustration Over Unheeded Warnings ([09:00-12:25])

  • Hosts lament how, after years of free and repeated warnings, the message is still not being heeded.
  • They empathize with the blunt approach, arguing it’s proportionate to the industry’s ongoing noncompliance and apathy.

  "For 11 years, you've been telling people that you need to do this. And for 11 years, they're signing a paper saying, yeah, we're doing that. Give us more money..."
  — Host B ([11:09])

  • Metaphor used: "Nobody wants to pay the light bill for an entire decade, but everybody wants to turn on the power switch." ([12:25])

5. Arrington’s Consistent Public Engagement

• Visibility and Messaging Consistency ([13:40])
  • Arrington’s return to the program leadership in March 2025 and her consistent, forceful messaging is credited with accelerating the pace of implementation.
  • The hosts predict more direct updates as CMMC’s final rules are imminent (summer or fall 2025).

Notable Quotes & Memorable Moments

• The “Knock It Off” Moment

  "That CMMC thing, it's happening case point, instant. It's right. Like within the first minute."
  — Host B ([03:26])

• Mother’s Wisdom on Resistance

  "You only put down your fear if you're putting it down. Ask yourself, why. If you're putting down the cmmc, why are you putting it down?"
  — Katie Arrington (quoting her mom) ([04:23])

• On False Claims and Accountability

  "You wrote a poem and you said, I’d get to it. I can’t tell you how to build your rates. ...the NIST 171 was law since 2014 and we are still complaining it’s too hard in 2025..."
  — Katie Arrington ([07:33])

• On Industry Fatigue with the Message

  "People don’t like Katie’s attitude. They don’t like the way that she communicates. But the only time anybody pays attention ... is when she gets in their faces."
  — Host A ([12:25])

Timestamps for Important Segments

• [01:43] — Katie Arrington's uncompromising keynote start: “CMMC is happening, so knock it off.”
• [04:23] — CMMC is just audit/verification of old requirements, not a moving target.
• [07:33] — Addressing business accountability, rate modeling, and False Claims Act.
• [09:00] — Hosts reflect on industry’s tendency to ignore repeated compliance messaging.
• [12:25] — The necessity of Arrington’s blunt communication style.
• [13:40] — Context on Arrington’s renewed DOD role and accelerated rulemaking.

Conclusion & Takeaways

• CMMC’s implementation is inevitable and non-negotiable. Both regulatory and leadership continuity reinforce this.
• Contractors must accept that CMMC only verifies existing legal requirements. Complaints are often rooted in past non-compliance, not in any sudden increase in demands.
• Arrington’s blunt style is purposeful—the time for denial or delay is over, and the DoD expects full adherence.

For those still skeptical or behind on compliance, Arrington’s message couldn’t be clearer: it’s time to stop complaining and start validating.

Links to referenced statements and interviews by Katie Arrington are available in the podcast episode notes.