Today we're doing something different. No tradecraft, compliance or threat intel. Today is about the other thing that keeps MSP owners up at night: where the next client comes from.

Here's the uncomfortable truth. Your buyers are on LinkedIn every single day and most MSPs are invisible there. Or worse than invisible: a profile that reads like a resume from 2014, three posts a year about patch Tuesday, and a network full of other MSPs and vendors. Everyone selling, nobody buying.

Our guest today built his entire company on fixing exactly that. Dean Seddon is the founder and CEO of Maverrik, the number one social selling training company. He's trained over 150,000 professionals across 11 countries, speaks at more than a hundred events a year, and his mission is to equip one million businesses to get clients through social selling. They don't call him the Dean of LinkedIn for nothing.

It's Thursday, July 16th, and three days ago the Department of War suspended CMMC Phase II, effective immediately. The third-party certification requirement that was set to hit on November 10th is gone for now, a reform task force has 60 days to review the entire program, and officials would not rule out scrapping it altogether.

Here's the thing: if you were paying attention, you saw this coming. Back in March, CIO Kirsten Davies sat in front of the House Armed Services cyber subcommittee and told lawmakers she was looking at CMMC through the lens of Secretary Hegseth's push to reduce regulatory burden. Congressmen were quoting GAO findings that compliance costs could bankrupt small contractors, and Davies confirmed a dedicated review of the CMMC ecosystem was already underway. Monday was that review going public.

But here's what did NOT change, and it's the reason this call exists. The Department's own release says this action "does not eliminate the requirement for companies to protect federal data." Self-assessments are still in force. DFARS 7012 didn't move. NIST 800-171 is still the standard. What got suspended is the referee, not the rules. And with self-attestation now the primary enforcement mechanism, the False Claims Act exposure for your clients arguably went up on Monday, not down.

Your DIB clients are calling this week asking to pause projects and redirect budgets. Today we're giving you the answers for those calls.

Joining me is the Mount Rushmore of CMMC: Jacob Horne, Scott Singer, Ryan Bonner, Andy Sauer and co-host Scott Edwards.

Important: Legal considerations for MSPs working with the DIB is laid out in this blog by Eric Tilds.

Here's a scenario that's playing out right now, for several MSPs across the country, and based on our research, most do not have it covered in writing.

A client decides to switch providers. The new MSP starts rolling out EDR and standing up monitoring. The old MSP begins winding down. Somewhere in that overlap, credentials are still active, agents are only half deployed, and it isn't clear who's actually watching. Then the breach hits.

Now two MSPs are pointing at each other, the client's data is exposed, and everyone reaches for the contract, only to find the transition period was not CLEARLY defined. Who was responsible? When did one watch end and the other begin? The MSA doesn't say. The SOW doesn't say.

This is one of the biggest gray areas in managed services, and it's the one that ends up in court.

To help us walk through it, we are joined by Melissa Ventrone, attorney at Clark Hill, who has lived this from the incident response side, where she sees what happens after the handoff goes wrong. We're going to dig into the controls and monitoring gap, who owns the risk during a transition, and what every MSP should put in writing before they ever take on, or hand off, a client.