In this episode of Robots and Red Tape, Nick Schutt talks with Sandeep Kathuria — partner at Ice Miller, 15+ year government contracts attorney, and one of the few people who’s been in the room since the very first DoD cyber rules in 2009 — about the brand-new CMMC program that became contractually enforceable in November 2025.

We break down: The 6½-year journey from DFARS 7012 to the final CMMC rule Exactly what Level 1, Level 2, and (eventually) Level 3 require Why self-attestation is gone and third-party certification is mandatory The assessor bottleneck (100+ accredited worldwide) and how to get in line Real workarounds small companies are already using (store CUI on your prime’s compliant system) False Claims Act landmines around inflated SPRS scores Whether all this new red tape will actually scare innovators away from DoD work If yo ...