C3 assessment consultant and Army veteran David Buchel on what door-to-door work in Iraq taught him about CMMC assessments, leadership buy-in, and the Phase 2 suspension.
David Buchel represents defense contractors during CMMC Level 2 assessments for C3, an MSP that works exclusively with the Defense Industrial Base. Before that, he sold real estate in Scottsdale and Chicago, built franchise businesses, ran his own vending company, and spent 2005 and 2006 in Tal Afar, Iraq, on an Army psychological operations team. He says every one of those jobs feeds into how he prepares clients for assessment today.
From Tal Afar to the Defense Industrial Base
David enlisted after 9/11 and pushed his way from a PSYOP printing unit onto a task force with the 7th Psychological Operations Group. His team knocked on doors, asked permission before entering, and kept their weapons slung on their backs. He describes the work as reading the room: figuring out what people needed and earning enough trust that they would talk.
After the military, he moved into franchise sales, then bought and grew a vending business before selling it to be closer to family. He used his GI Bill to earn a bachelor’s and a master’s in cybersecurity policy, worked his way up from help desk at an MSP, and landed in GRC just as CMMC hit the radar. He joined C3 because every client is a DIB client. As a veteran, he sees the work as a way to protect the people still wearing the uniform.
Why the “why” matters more than the switches
David’s view of GRC is simple. Anyone can flip the configuration switches. The hard part is making sure the organization understands why each control exists and what risk it addresses. Without that, a company will struggle to answer assessor questions, and leadership will treat compliance as a one-time purchase instead of an ongoing program.
He and the host compare notes on hard conversations with leadership, especially around vulnerability management. Requirements like 3.11.3 and 3.14.1 give organizations room to remediate according to their own risk assessment, but the timelines they set still have to be met. If a company is behind, the options are to remediate, revisit scope, or document the gap with a POA&M or a formal risk acceptance. Ignoring it is not one of the options. That documentation is also what makes a program defensible if it is ever questioned under the False Claims Act. Say what you do, do what you say, and write it down.
The assessment playbook assessors keep asking about
C3 moves clients through a structured path: MSP, then MSSP, then a compliance consulting team that handles policies, the GRC platform, risk assessments, tabletop exercises, and incident response planning. David comes in at the end to QC the entire body of work.
His main deliverable is a OneNote playbook that lists every assessment objective with C3’s reasoning and a screenshot of the evidence. Instead of 320 folders, the assessor gets one document that is two clicks from anything they want to see. Multiple assessors have told C3 they wish every OSC prepared this way. It also keeps David from the long pauses that make an assessor dig deeper.
He also shares the story of one assessor who spent three days on 3.3.3 because she wanted to see the client’s name on evidence from an MSP-wide logging process. Every assessor since has cleared that objective in under two minutes. He has been timing them.
The conversation also covers keeping policies, procedures, and the SSP aligned, a common source of follow-up requests during assessment. IntelliGRC’s Document Hub uses organization-defined parameters so a single value change updates every document that references it, which matters more as NIST SP 800-171 Rev 3 brings ODPs into the requirements themselves.
What comes after the Phase 2 suspension
Recorded on September 15, the episode closes on the Phase 2 suspension. David expects the Department to extend the timeline to make room for rulemaking, and hopes the outcome finds middle ground that also accounts for the assessors and C3PAOs who invested in the program. C3’s assessment calendar has held steady, with all but one client keeping their scheduled dates.
The suspension does not remove CMMC or the underlying DFARS obligations. Certification still reduces risk, and for many contractors, the cost of an assessment is small next to the cost of a False Claims Act case.