What the CMMC Pause Exposed

The CMMC pause exposed two groups of people: those who had already been doing the work and those who were only waiting for a deadline. In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson talk about the “good student vs. bad student” divide, why so many contractors fail Phase One, and why IT reporting structure says more than most people think. The biggest lesson to be learned: Treating CMMC like a test to pass is the wrong way to look at security.

The CMMC pause gave contractors more time, but it also revealed a hard truth: some companies were building security because they believed in it, while others were only reacting to the threat of being graded.

In this episode of Trust Issues, Bruno Lecoq is joined by Jeremy Patterson to unpack what the pause has shown them after weeks of conversations with contractors: the “good student vs. bad student” problem, the 88-point loophole, and why CMMC is the test, not the assignment.

What You’ll Learn:

Why the CMMC pause exposed contractor behavior instead of changing it
Why Phase One failures are often a readiness problem, not an auditor capacity problem
Why IT reporting to the CFO can signal that security is being treated as a cost
Why MSPs have to be treated as in-scope partners for CMMC
Why the self-attestation mindset creates the wrong incentives
Why CMMC should be treated as how the business operates, not a test to cram for

Episode chapters:

00:00 Welcome to Trust Issues

01:00 What the CMMC pause revealed about contractor readiness

03:44 Good students, bad students, and the CMMC test

06:16 Why 80% fail Phase One

13:20 Why some contractors keep delaying compliance

15:52 Where IT reports say a lot about security culture

17:04 What prepared organizations do differently

20:47 Why your MSP is part of your CMMC scope

27:15 What the next CMMC timeline could look like

28:12 CMMC is the test, not the assignment

29:17 Why self-attestation is not enough

31:26 The 88-point loophole

34:24 Why a longer timeline can help

35:39 Why CMMC standards will keep rising

36:28 The real price of non-compliance

39:43 Final takeaway: keep studying

Quotes:

“Some companies have been doing the reading, doing the work, the whole time, whether there’s a test on the calendar or not.”
“Now that it got pushed back, it seems like the people who never started still aren’t starting.”
“If I say that I’m an 88, they won’t check me, but if I say that I’m a 110, there’s a chance an auditor is going to check me.”

Connect with the team:

👉 Jeremy Patterson LinkedIn: https://www.linkedin.com/in/jeremypatterson2026/
👉 Bruno Lecoq on LinkedIn: https://www.linkedin.com/in/brunolecoq/
👉 BEMO Website: https://www.bemopro.com/