New CMMC FAQ Clarifications: Joint Ventures, Paper-Only CUI, Reassessment Triggers & Where MSPs Actually Fit in Scope

Submit any questions you would like answered on the podcast!The Department of Defense just updated its CMMC FAQ document — and the clarifications inside answer some of the most common (and costly) assumptions contractors make. In this episode, Brooke and Stacey break down what changed for joint ventures, paper-only CUI, significant change triggers, and how MSPs and MSSPs actually fit into assessment scope.If you're navigating a merger, working with subcontractors, or relying on an MSP to manage your environment, this episode clears up exactly where you stand — and where you don't.📌 What You'll Learn:Why joint ventures do NOT automatically inherit a company's CMMC certification statusThe new guidance on paper-only CUI — and when it does NOT require Level 2 assessmentWhat actually counts as a "significant change" that triggers reassessment (mergers, system consolidation, and more)Why MSPs don't need their own CMMC certification — but still carry major assessment responsibilitiesThe difference between CUI scope and Security Protection Data (SPD) scope for MSPs/MSSPsThe five-part test for whether an MSP counts as a Cloud Service Provider (CSP)Listener Q&A: Do subcontractors need cybersecurity training and screening too?