Session #1 Overview: This session establishes the purpose of CMMC why it must be treated as a business-critical requirement, not an IT exercise. Learn how failed self-attestation leads to inconsistent protection of CUI and drives the shift from trust-based compliance to verified, enterprise-wide accountability. Hear directly from C3PAO and consulting perspectives on what assessors truly evaluate, common causes of assessment failure, and the real consequences of poor readiness. CMMC is about sustained eligibility to do business in the defense ecosystem, and early, informed readiness decisions dramatically reduce risk, cost, and disruption.

Session #1 Learning Objectives: n/a

Session #1 Time: 1 hour

Session #1 Total CPE Hours: n/a

Session #1 Speakers: Kevin Hutchinson, Ed Jameson & Steve Ursillo

Session #2 Overview: This session focuses on how practical steps to begin the CMMC journey. We outline realistic readiness roadmaps, common control interpretation mistakes, and the difference between meaningful capability-building and unnecessary tooling. From both consulting and C3PAO perspectives, the session emphasizes how to prepare assessor‑ready evidence and why policies alone do not demonstrate compliance.

Session #2 Learning Objectives: n/a

Session #2 Time: 1 hour

Session #2 Total CPE Hours: n/a

Session #2 Speakers: Wayne Proctor & Steve Ursillo

Session #3 Overview: During this session learn how to define and defend CMMC scope in a way that stands up to assessor scrutiny. We clarify what scope truly means under CMMC, including CUI flows, system boundaries, and the use of inherited controls. The session highlights effective scoping strategies, common red flags that trigger scope expansion, and why poorly designed enclaves often fail from both consulting and C3PAO perspective.

Session #3 Learning Objectives: n/a

Session #3 Time: 1 hour

Session #3 Total CPE Hours: n/a

Session #3 Speakers: Wayne Proctor & Brian Kirk