Your SSP Will Expose You
October 7, 2026
A polished SSP means very little if your own team cannot explain what is inside it.
In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson speak with CMMC assessor Erin O’Donnell about what real assessment readiness looks like, why knowing your own environment matters more than rehearsed answers, and how the right consultant should make your team more independent, not more dependent.
What does a CMMC assessor notice before the scoring even starts? Quite a lot, it turns out.
In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson sit down with Erin O’Donnell, CMMC assessor at Wise Technical Innovations, to talk about what separates organizations that genuinely understand their environment from those that look prepared on paper.
Erin gets into why every company should read its System Security Plan line by line, how assessors think about data flows, security boundaries, and evidence, and why a pause or imperfect answer is not necessarily the problem. The bigger concern is when nobody inside the company can explain how its own environment actually works.
What You’ll Learn:
- Why your SSP can become either your strongest asset or a major liability
- What assessors notice when a company does not fully understand its own environment
- Why data flows, security boundaries, and asset inventories matter so much
- Where AI-generated compliance documentation can create problems
- Why CMMC has to continue long after certification day
- Why missing one objective can leave an entire control “not met”
- How honesty about missing evidence can work better than bluffing
- Why a good consultant should teach you to defend the environment yourself
- Why mock assessments can expose problems while you still have time to fix them
Episode chapters:
00:00 Welcome to Trust Issues by BEMO
01:00 Meeting Erin O’Donnell
02:01 What assessors are seeing as CMMC changes
03:09 Erin’s assessor and small business perspectives
05:03 Why you need to read every line of your SSP
05:52 The AI documentation trap
07:03 What assessors notice in the room
09:21 Data flows, boundaries and knowing your environment
10:43 The art of the pause during an assessment
13:19 What a good CMMC consultant actually looks like
15:35 Why CMMC has to become part of the culture
17:23 Certification is not the finish line
19:58 Rev 2, Rev 3 and what comes next
22:07 Why every control objective needs evidence
23:47 Why honesty beats pretending
25:32 Cloud vs. on-prem assessment realities
27:29 What to do 90 days before assessment
29:00 The “hit by a bus” test for your SSP
30:21 Building compliance you can actually maintain
30:45 Avoiding consultant dependency
31:16 Mock assessments, training and where to find Erin
33:25 Final thoughts
33:48 Closing thoughts from Trust Issues
Quotes:
- “Read every line of your SSP. You don’t want to be in an assessment and get surprised by the wording in your documentation.”
- “Companies that embrace it as a cultural mindset: all of the data that enters that company is better protected.”
- “This is supposed to be going on and on and on for the life of CUI in your organization. It’s not a one-time compliance exercise.”
- “The mark of a really good consultant is when the consultant doesn’t have to describe the environment to me, but the client can.”
- “If you’re going to use a consultant, find someone who is going to make it so that you can defend your own environment.”
Connect with the team:
Trust Issues is handcrafted by our friends over at: fame.so