The CMMC Mistake That Could Cost You Twice.
July 7, 2026
Mock audits are not just a nice-to-have before CMMC certification. They can be the difference between catching a fixable issue early and paying full price to start over. In this episode of Trust Issues, Brandon and Bruno Lecoq welcome Cindy Oliveto, Senior Director, Operations at BEMO, back to the show to talk through why mock audits matter, what they reveal, and why CMMC success depends on the whole company, not just IT.
Mock audits can be the difference between catching a fixable issue early and paying full price to start over. And yet, people still don’t take them seriously. In this episode of Trust Issues, Brandon and Bruno Lecoq welcome Cindy Oliveto, Senior Director, Operations at BEMO back to the show to talk through what actually happens during a mock audit, why it gives companies a safer way to spot gaps, and how it can help avoid expensive delays during the real certification process.
From non-POAMable controls and C3PAO scheduling problems to clear-text password spreadsheets and the very real danger of treating CMMC like an IT-only project, this conversation is a practical look at what readiness really means.
What You’ll Learn:
- Why a mock audit can save you from paying twice for the same certification attempt
- What happens when you fail anon-POAMable control during the real audit
- Why C3PAOs cannot simply pause everything when a company is not ready
- How small documentation and process gaps can turn into major audit problems
- Why your IT director cannot “sit out” the audit
- Why CMMC only works when leadership and the wider company are involved
Episode chapters:
01:05 What a mock audit actually is
03:25 Why mock audits are cheaper than failing the real thing
04:11 Why failing phase one disrupts the auditor’s schedule
05:17 Are people doing mock audits these days?
08:15 How process gaps show up during audit prep
09:24 How BEMO scored in the mock vs. the real thing
10:38 Why your SSP, policies, procedures and evidence all have to line up
13:50 Why automation helps, but does not replace human review
15:26 CMMC is not something you stumble into
17:17 What to ask before choosing a C3PAO
20:21 Why auditors cannot coach you during certification
23:15 What mature CMMC management looks like
25:25 The clear-text password spreadsheet problem
26:16 Key takeaways and final thoughts
Quotes:
- “The benefit of the mock audit is you pay less for insurance that you are more ready, and you don’t have to pay twice for your full audit if something were to come up.”
- “CMMC is not an IT project. It’s a company project.”
- “If it’s the IT person only, you’re going to fail. If it’s the IT person and someone from the executive team, now we can talk.”
- “When you do a mock with an audit team, they know your system. They know your process. They’ve already read every single policy and procedure.”
Trust Issues is handcrafted by our friends over at: fame.so