What 2,005 Votes Revealed About Why Organizations Struggle With CMMC

Over the last two months, we ran the CMMC Challenge Bracket.

Eight matchups, 907 participants, 2,005 votes.

The winner? Leadership Buy-In.

But the final standings were only part of the story.

In this episode, we break down the voting trends, coalition shifts, and comment analysis to understand what the community actually believes is holding organizations back from CMMC success.

---

Transcript

[00:00] — Jacob
All right, folks. It is June, and the votes are in.

Two months ago, we started with a simple question: What is really causing organizations to struggle with CMMC?

You’d think it would be a pretty easy answer, but we got a ton of responses. We turned those answers into a tournament bracket and let everybody vote over on LinkedIn.

After eight matchups, more than 2,000 votes, and hundreds of comments—which we read—we finally have a winner.

In first place, leadership buy-in, by a landslide, was voted as the number one issue causing organizations to struggle with CMMC.

In second place, bad guidance and snake oil—misleading organizations about the right solutions and implementation paths.

In third place, CUI confusion. What is CUI? Is it marked? Is it not marked? Should it be marked? That topic was always going to finish near the top.

After reviewing the comments, voter migration trends, and coalition analysis, I think the results tell us something important.

The community—not us, not our blog, but everyone on LinkedIn—repeatedly voted for upstream organizational issues over downstream technical issues.

That’s what we’re going to talk about today.

[01:47] — Jacob
Jason, hey buddy.

Is bad guidance and snake oil the core problem, or is bad guidance simply what happens when leadership wants shortcuts?

I think that’s really the million-dollar question.

[02:02] — Jason
To quote the great Julius Campbell, “Attitude reflects leadership, Captain.”

When it comes to CMMC, poor leadership produces poor implementation.

All of the downstream issues in this bracket are things that good leadership should address before they become problems.

[02:27] — Jacob
Couldn’t have said it better myself.

You followed this tournament pretty closely. Any high-level takeaways?

Were you surprised by how it played out?

My bracket was in shambles by the end.

[02:42] — Jason
I was hoping to use my wife’s March Madness strategy and just pick the prettiest uniforms.

Once uniforms were off the table, I started thinking about the conversations I have every day with people across the Defense Industrial Base.

I realized I had been taking those problems at face value.

People would call and say, “This is the problem.”

What I wasn’t doing was digging deeper to find the underlying cause.

It’s like someone saying they’re dizzy all the time, when the real issue is something much deeper.

That was my biggest takeaway from this tournament.

I wasn’t digging deeply enough into the root causes, and I think many people assume they already understand what their biggest problem is.

[03:31] — Jacob
I think that’s true for most people.

Leadership buy-in wasn’t even the number one seed when we built the initial bracket from everyone’s suggestions.

Yet it ended up winning.

Do you think we seeded the tournament incorrectly?

[03:52] — Jason
Maybe.

Post-tournament clarity is real.

[03:56] — Jacob
Let’s look at some tournament statistics for anyone who wasn’t following along over the last two months.

Across eight matchups:

• 2,005 total votes
• 997 unique voters
• The highest-turnout matchup was Leadership Buy-In versus Scoping with 302 votes.
• The closest matchup was CUI Confusion versus Scoping, decided by only two votes: 120 to 118.

One thing I found especially interesting is that only 11 people voted in every single poll.

That means the results weren’t driven by one small group constantly voting for leadership.

Different groups of people consistently reached the same conclusion over the course of two months.

[05:15] — Jacob
Was there any matchup where one option just completely steamrolled the other?

[05:22] — Jason
Snake oil versus cost in Round One.

That surprised me because I thought cost would dominate.

Cost is what everyone talks about.

Instead, snake oil won by a huge margin.

That was probably the biggest blowout in the tournament.

[05:43] — Jacob
One-versus-sixteen matchups get them every time.

Every year some unknown school knocks off a top seed.

[05:55] — Jason
Every time.

[06:03] — Jacob
For anyone who missed the beginning, here was the original field:

• Leadership buy-in
• Bad guidance / snake oil
• CUI confusion
• Scoping
• Cost
• Timeline and unrealistic expectations
• Knowledge and skill gaps
• Technical execution, applicability, and flowdown

These were pulled from nearly 400 comments on our original survey.

Some are organizational challenges.

Some are implementation challenges.

Some are technical.

Some are contractual.

In the end, people naturally sorted them into two categories:

Symptoms and causes.

That ended up being the story of the entire tournament.

[07:05] — Jason
It’s kind of like not getting enough sleep.

Your health declines, your appetite changes, and everything starts falling apart.

The lack of sleep is the root cause.

Leadership is the same thing.

When leadership isn’t engaged, suddenly scoping is out of control, people still think there are five levels of CMMC, and everything starts cascading from there.

That’s literally what’s happening.

[07:39] — Jacob
Obviously these choices are interconnected.

We’re forcing people to make binary decisions between things that all influence one another.

It’s summertime.

We’re just having some fun.

We know these issues are related.

[08:15] — Jacob
Leadership buy-in didn’t just win the tournament.

What I found most interesting is that it built the largest coalition of voters.

Leadership defeated snake oil in the championship 143 votes to 84.

Almost everyone agreed snake oil is a real problem.

The debate wasn’t whether snake oil exists.

The debate was whether bad guidance is the root problem—or whether bad guidance becomes a problem because leadership wants shortcuts.

Leadership waits.

Leadership hesitates.

Leadership delays until CMMC becomes urgent.

Now organizations are operating on arbitrary deadlines.

That’s exactly when they’re most vulnerable to miracle cures and six-week-abs solutions instead of taking six months to do things correctly.

The voter migration data supports that idea.

Leadership didn’t win because the same people kept voting for it.

Leadership won because people who initially supported other options gradually moved toward leadership.

For example, most of the people who originally voted for CUI confusion ultimately voted for leadership in the finals.

Even many of the original snake oil voters ended up voting for leadership.

If snake oil were truly the root cause, those voters would have stayed there.

Instead, they changed their minds during two months of discussion and debate.

I think that’s a great outcome.

[10:55] — Jason
I was one of those people.

At the beginning, I was convinced scoping was the biggest issue.

That was my number one seed.

But as the tournament progressed, and I listened to the discussions, I realized I had been looking at surface-level problems instead of systemic ones.

That realization happened for me, and judging by the voting, it happened for a lot of other people too.

As their original picks were eliminated, they started asking themselves where their vote should go next.

[11:54] — Jacob
My bracket was influenced by the conversations I have every week.

Cost.

Timelines.

Things like that.

But what I realized is that the people who never call us are the ones whose leadership hasn’t empowered them to ask for help in the first place.

There are probably far more organizations out there that would like guidance but haven’t been given permission to seek it.

That’s why leadership ultimately dominated every other option.

[12:22] — Jason
It’s like Homer disappearing into the bushes wearing a CUI scoping shirt and coming back out wearing a leadership shirt.

[laughter]

[12:31] — Jacob
Absolutely.

All the Ducks fans becoming Hurricanes fans.

All right.

The community consistently voted for root causes over symptoms.

Let’s look at who lost in Round One:

• Cost
• Timeline constraints
• Knowledge and skill gaps
• Technical execution
• Applicability and flowdown

These are all real problems.

People specifically asked for them to be included.

But every one of them lost immediately.

Our interpretation is that voters saw them as downstream effects instead of root causes.

Costs increase when scoping is wrong.

Timelines disappear when leadership waits too long.

Knowledge gaps persist when leadership doesn’t invest in training.

Flowdown confusion starts with confusion about CUI.

The community immediately favored causes over symptoms throughout the opening rounds.

[14:06] — Jason
It’s not that these aren’t real problems.

They’re just the mid-majors of the tournament.

They can make some noise, but eventually they’re running into the heavyweights.

That’s what happened here.

[14:26] — Jacob
The Padres were in first place in the NL West a month ago, and now we’re the worst team in baseball.

That collapse deserves its own episode.

Please like and subscribe to support my emotional recovery.

[laughter]

[14:50] — Jacob
As we reached the Final Four, every remaining option represented an upstream organizational issue:

• Leadership buy-in
• Bad guidance and snake oil
• CUI confusion
• Scoping

I was honestly surprised scoping didn’t make the finals.

These weren’t debates about individual controls, architecture, tooling, or assessment activities.

Everything that survived represented organizational challenges rather than technical ones.

The closest matchup of the tournament was CUI confusion versus scoping—120 votes to 118. More people voted for “banana” in the poll than the actual margin of victory.

One side argued that you can’t scope what you don’t understand.

The other argued that scoping is how you discover what needs protection.

The community never really separated those two ideas.

They viewed them as interconnected systems rather than isolated technical problems.

[16:35] — Jason
It was a true buzzer-beater.

Part of the challenge isn’t just CUI confusion—it’s confusion about what’s actually being asked of you.

You’re being asked to create a boundary capable of protecting CUI.

The root problem is building the yard your family can safely play in before you figure out who’s actually going into it.

I started this tournament convinced scoping was the biggest issue. I thought if you scoped things incorrectly, costs would skyrocket and organizations would become vulnerable to snake oil.

But I kept coming back to one thing.

What prevents all of that?

A good leader.

[17:21] — Jacob
Exactly.

All problems are leadership problems.

CMMC is no different.

So, what did this tournament actually measure?

Originally, I thought it measured the pain caused by individual issues.

By the end, I think it measured how the community views the causes of those issues.

The final results tell the story:

• Leadership buy-in — 1st
• Bad guidance and snake oil — 2nd
• CUI confusion — 3rd
• Scoping — 4th

The community consistently elevated upstream organizational challenges over downstream technical issues.

That doesn’t mean the controls don’t matter or that technical problems aren’t real.

It means those problems usually occur much farther downstream.

After more than 2,000 votes, hundreds of comments, and two months of discussion, I think most people would agree that organizations don’t usually fail because they picked the wrong technology, architecture, or control.

They fail because of decisions made long before implementation begins—and certainly long before assessment day.

[19:00] — Jason
What we do today echoes into the future.

The decisions leadership makes today affect the entire CMMC implementation.

That’s what this tournament demonstrated.

If leadership doesn’t have buy-in and a competent plan, eventually one of these downstream issues is going to become the problem.

Everybody has problems.

Talk to three different people today, and one will complain about gas prices, another about taxes, and another about groceries.

It doesn’t mean the other problems don’t affect them.

It just means one issue stands out as the biggest challenge in their mind at that moment.

[19:53] — Jacob
This was a lot of fun, and it became much bigger than I expected.

Should we do it again?

Should it be during October baseball?

March Madness?

The NHL playoffs?

Did we miss anything?

Let us know what you’d like to see next.

Leave your thoughts in the comments.

Like and subscribe, and we’ll see you next week.

[20:25] — Jason
See you next week, folks.