PODCAST: Cracking the CMMC 2.0 Code
Episode #18 of Manufacturing Mavericks
NIST. CMMC. FedRAMP. ITAR. DFARS. FCI. CUI. CDI. If you’re a precision manufacturer in the DoD supply chain, you’ve heard all of these, and you’re probably not 100% sure which ones apply to you.
In Episode 18 of Manufacturing Mavericks, Greg McHale sits down with Darren Gallop — CISSP, CMMC Registered Practitioner, and CEO of Carbide Secure — to cut through the noise. They walk through what each standard actually requires, who’s on the hook for what, and how to think about your software vendors’ compliance posture (and why an off-the-shelf product follows different rules than a SaaS service).
Some of the highlights:
- Why ITAR experience puts you 60–70% of the way to NIST 800-171 — and what gaps it doesn’t cover
- The “ERP/ERP login” problem and other shop-floor remediations most manufacturers will need
- Whether your software vendors need to be CMMC compliant — and what to ask them
- Realistic budget guidance for self-assessment, gap analysis, remediation, and the third-party audit
- Why your CMMC posture belongs in your capability statement — and how to phrase it so you don’t lose bids before you start
- The “hard way” vs. the “easy way” to compliance, and which one actually saves money
Whether you’re deep in the compliance process or just figuring out whether it applies to you, this episode gives you the framework — and the specific next moves — to keep your DoD contracts intact.
Editor’s note: This episode was recorded before CMMC Phase 1 took effect on November 10, 2025. Phase 2 — when third-party C3PAO Level 2 certification becomes the default for CUI contracts. The framework Darren walks through is more relevant now than when we recorded.
CONNECT WITH THE POD
Follow the show on Twitter @MFGmavericks
Follow the podcast on LinkedIn
SUBSCRIBE
Manufacturing Mavericks can be found on iTunes, Spotify, Google, or your favorite podcast app.
