“Compliance isn’t security. But for people who have nothing, it’s a start.” 

Who They Brought In 

Bobby Barts is the CIO of VTG, a defense contractor he has been with since 2018. VTG runs the full spectrum of government work: defense programs, Intelligence Community contracts, a fabrication shop in Virginia Beach that builds physical targets, and high-end software development for systems including submarines. With around 1,700 employees nationwide and an office in Guam, VTG is the kind of prime contractor that sits in the middle of the CMMC ecosystem, taking requirements from the government and pushing them down through a supply chain that ranges from sophisticated software houses to one-person shops doing specialized fabrication work. Bobby’s perspective in this episode is rare: he is not a consultant working up from the sub level. He is the prime, managing both directions at once, and he has the institutional weight and operational scale to say what the rest of the industry is thinking but might not be willing to put on record. 

What Got Loud 

• The certification pause does not change your obligations under the False Claims Act. If you self-certify that you are compliant and you are not, the teeth are still there. People have gone to jail for this 
• There are roughly 100,000 vendors in the defense industrial base that need CMMC certification. Fewer than 300 have achieved it. That math does not work on any timeline the DoD has proposed 
• Bobby’s audit story: four of five auditors were collaborative and reasonable. The fifth auditor rejected the business continuity plan because it didn’t list a specific scenario by name, even though a catchall clause covered all unlisted scenarios.
• FedRAMP equivalent versus GCC High is a risk conversation the government needs to have honestly. The actual delta in security between the two is minimal and the cost difference is enormous 
• Government agencies and contractors often apply CUI labels inconsistently. Even the government is marking publicly available newsletters as CUI. The category is too broad to be actionable 

The Rundown 

Bobby’s most important point comes early and he returns to it throughout the episode. The CMMC certification pause that hit in mid-2025 changed the timeline for third-party assessments. It did not change anything else. DFARS 7012 still applies. NIST SP 800-171 still applies. And the False Claims Act, which carries criminal liability for self-certifying compliance you do not actually have, still applies in full. Bobby believes the industry is dangerously misreading the pause as permission to slow down. The obligation to be a good steward of controlled unclassified information has not moved. Only the audit schedule has. 

The supply chain problem is where the episode gets most practically instructive for anyone doing CMMC consultant work from the sub side. Bobby describes the math problem clearly: you cannot certify 100,000 vendors when fewer than 300 have been through the process and the assessor ecosystem is still immature. Bobby expects the industry to spend another year on self-certification before the DoD begins a phased rollout. But prime contractors must still flow those requirements down to their subcontractors.

What VTG asks its suppliers is straightforward: how are you being a good steward of the data? The documentation and questionnaire process continues regardless of where the certification requirement lands. 

The CUI labeling conversation is one of the most honest moments in the episode. Bobby pointed to a newsletter labeled as CUI even though anyone could access it on the government’s website. Melissa recalled seeing Army training materials that carried incorrect CUI labels. Bobby’s framework for handling this within VTG distinguishes between CUI basic, which covers FCI and lower-sensitivity information, and CUI specified, which covers more sensitive categories like nuclear drawings or other legacy designations. Getting his own workforce to understand that distinction, across a company that spans both blue-collar fabrication work and classified software development, is an ongoing training challenge. 

The audit story is the most practically useful section for anyone preparing for a C3PAO assessment. Bobby had five auditors over the course of one engagement. Four were collaborative, curious, and willing to work through how VTG was solving problems. The fifth auditor rejected the policy because the business continuity plan didn’t name a specific scenario, even though a catchall clause explicitly covered any unlisted situations. Bobby’s point is not that assessors are the enemy. One auditor’s personality and interpretation of a requirement can significantly influence an assessment outcome. Bobby argues the industry should place more weight on whether organizations meet the intent of a control, not just its exact wording.  

Real Talk 

If you are treating the certification pause as a reason to slow down, you are accepting risk that has not actually been reduced. The False Claims Act does not pause. Keep moving. 

If your Microsoft 365 environment hasn’t been reviewed lately, let’s fix that before someone else does it for you. Visit www.SOCSoter.com