Your CMMC Compliance Is Only as Strong as Your Team
October 21, 2026
Compliance exists to make a company safer - that’s the upside. The downside is that the processes it takes to be compliant can burn out the people doing the work if the program is built badly.
In this episode of Trust Issues, co-hosts Bruno Lecoq and Jeremy Patterson break down overloaded IT teams, suspiciously perfect CMMC scores, audit readiness, AI and why losing one key employee should never take your compliance program with them.
When compliance becomes another job for the one person already running IT, nothing good is coming out of that.
In this episode of Trust Issues, Bruno Lecoq and Jeremy Patterson dig into the people problem hiding inside CMMC, ISO, SOC 2, and other compliance programs. They talk about why one IT person should never carry the whole program, how BEMO automated away the monthly screenshot grind, and why a “110 out of 110” CMMC score deserves questions, not applause.
Plus, a deep dive into what happens when critical security knowledge lives in one employee’s head, why an SSP should help the next person understand the environment and where AI actually helps without replacing human judgment.
What You’ll Learn:
- Why compliance should never be dumped on one IT person
- How to tell when security work has become administrative overload
- Why BEMO automates screenshot and evidence collection
- Why a claimed 110/110 CMMC score can fall apart under basic questions
- Why good documentation protects you when key employees leave
- What perpetual audit readiness actually feels like
- Why AI should support expertise, not replace it
- Why leaders need to watch overtime, weekend work, and team capacity
- Why IT and compliance should not be the same function
Episode chapters:
00:00 Why Bruno doesn’t trust AI
00:45 Welcome to Trust Issues
01:38 Why compliance needs the right team
03:29 The “Can you get CMMC done by Monday?” problem
04:09 How much security is actually enough?
05:50 Automating the compliance evidence grind
07:27 Why 110 out of 110 deserves questions
09:18 Why cybersecurity burnout is so common
10:47 Documentation that survives employee turnover
12:15 What perpetual audit readiness feels like
14:39 When one IT person leaving breaks everything
16:35 Why standardized IT reduces key-person risk
18:45 AI should be the co-pilot, not the pilot
23:53 Leaders need to catch burnout early
24:44 When the team has 12 projects and capacity for 10
26:41 Why compliance and IT need separation
27:27 Final takeaway
28:03 Closing thoughts from Trust Issues
Quotes:
Jeremy Patterson:
“Compliance is supposed to make a company safer, but if the people doing the work are worn out, you could end up losing the very thing you were trying to protect: knowledgeable people.”
“A healthy compliance program could cross the line into administrative burden.”
“Reading policies and procedures isn’t like reading a novel; it’s tedious, and there are many details you really have to pay attention to. It takes a lot of brainpower and a heavy cognitive load.”
Bruno Lecoq:
“If you don’t need to do compliance, don’t go there. Once you start, compliance is expensive, and you have to keep doing it.”
“I don’t trust AI, even though I use it all the time. You couldn’t take it away from me, but I don’t trust it; I challenge it and use it to challenge me.”
“If you have capacity for 10 projects but have 12, figure out which two to drop.”
Connect with the team:
Trust Issues is handcrafted by our friends over at: fame.so