This issue is covered in-depth in a recent “insider edition” of The Virtual CISO Podcast. Our special guest was Ben Tchoubineh, Chair of the CMMC-AB’s Training Committee. Ben knows as much as anyone about what’s coming with the CMMC assessments (“Don’t call them audits!”). “The provisional program is the one where we’re going to use a limited number of assessors, going to train them and work with them directly to learn from them based on what we’ve already developed,” clarifies Ben. “We have processes and methodologies that we've developed in draft form that are not publicized yet, a lot of amazing documents … about the support to assessors in terms of all kinds of criteria and methodologies, and so forth.” “We then need to take these documents and actually put them to use and use them in the real world using these pilot programs. That's really what this provisional program is about,” adds Ben. Another provisional effort currently underway within the DoD is the CMMC’s integration into DoD processes and the creation of rules (including DFARS [Defense Federal Acquisition Regulation Supplement] rules) associated with the CMMC. This activity needs to conclude before full-scale assessments for Organizations Seeking Certification (OSCs) can begin.