When is NIST SP 800-171 Rev 3 actually going to land? Chris Haigh has a timeline, and it’s backed by more than a gut feeling.
In Episode 15 of the IntelliGRC Podcast, Steven Molter sits down with Chris Haigh, founder of Meerkat Cyber, CMMC Provisional Instructor and Assessor, and one of the people who wrote the earliest DoD-approved CMMC training materials (twice, thanks to CMMC 2.0). Chris took an unusual road to compliance: Purdue aerospace engineering, patent law at Indiana’s largest firm, policy analysis for the Indiana Senate, and in-house counsel for a medtech company. It all converges on CMMC.
Steven and Chris get into:
Why both of them expect Rev 3 clarity by the end of the year, including signals from GSA, the DoD, and ISACA
The security protection data debate, and why “commensurate with CUI” never made it into the final rule
What Meerkat Cyber does differently as a C3PAO that also preps clients (perfect scores so far, no POA&Ms)
NERC CIP, the water sector’s missing framework, and why critical infrastructure is America’s Achilles heel
The utility breach where China sat undetected for 380 days
Why a 20-person lawn care company at Wright-Patterson is going through Level 2
If you’re an MSP, MSSP, or DIB contractor trying to plan for what’s next, this one is worth your time.
Watch the Full Video Here