In this last episode, Michael Greenman from Deltek shares the journey to FedRAMP Moderate Equivalency for Deltek Costpoint GovCon Cloud Moderate (GCC-M).

And let me tell you, it's quite a story: changes in the control baseline, new policy from the DoW, and lessons learned.

Here are some of the biggest takeaways:

• The real-world implications of DoW's equivalency definition
• How the absence of continuous monitoring shapes the trust model
• How Deltek developed a customer responsibility matrix that reduces friction for their customers
• Should the DoW blow up FedRAMP moderate equivalency?

We also discussed improvements that can be made by the DoW, the Cyber AB, and more!

We recorded this months ago, but this conversation is still very relevant.

On another note, it is kind of surreal to think this is the last episode of the GRC Academy podcast. I hope you've enjoyed listening!!

What were your biggest takeaways? Let me know in the comments.

Follow Michael on LinkedIn: https://www.linkedin.com/in/michael-greenman-94952a3/

Deltek Costpoint GCC-M: https://www.deltek.com/en/government-contracting/costpoint/cloud

-----------

Online GRC Training: https://tekfused.com/marketplace/?utm_source=podcast&utm_medium=s2-12&utm_campaign=marketplace

#cmmc

Before that though, let me share some of my history with you.

Back in 2016, I started a side-business called TEKFused LLC focused on web design/hosting.

Fast forward to 2022, I launched GRC Academy, and since then I’ve released 3 CMMC courses, released 50+ podcast episodes, and partnered with some amazing companies.

Earlier this year, life threw me a curveball when I was laid off from my full-time role.

Thanks to the incredible support of my AMAZING LinkedIn network, I had new opportunities on the table immediately!

Within a week, I accepted a role with Summit 7 as Director of Cybersecurity - a company I’ve admired since 2019.

And here’s the part I NEVER expected:

👉 Summit 7 has officially acquired GRC Academy!! 🎉🥳🎉

And guess what?!? I've already completely updated and rerecorded my CMMC training!! And it's even better than it was before!!

GRC Academy students with active enrollments to my CMMC training will receive access to the new training on Summit 7's platform. It will take some time to get this all together, so keep your eyes open for that announcement.

I'll be contributing to Summit 7's YouTube channel in the future as well, so subscribe if you haven't already: https://youtube.com/@summit7

I will still be reselling PECB training at my TEKFused LLC website! If you need to get certified in ISO 27001/42001 (and more), be sure to keep me on your list: https://tekfused.com/courses/?utm_source=podcast&utm_medium=s2-11&utm_campaign=s7-acquisition-announcement

On a personal note, I’m very thankful that this transition allows me to spend way more time with my family - while continuing my mission of educating the Defense Industrial Base!

I learned so much during this chapter of my life. I want to thank all of you for your support - it truly made this possible.

#cmmc #nist #cybersecurity

In this episode, I’m joined by Derek Kernus of Aethon Security to discuss the business case for CMMC!

This episode was really refreshing to me. Yes, our discussions about deep CMMC topics are important, but learning how to convince your company leadership to make the CMMC investment is even more critical.

Here are some takeaways:

• How CMMC early adopters can shape contracts and limit competition
• How to frame the CMMC investment to internal leadership
• The impending CMMC bottleneck of doom 👻
• What mock assessments are and how they can help you prepare
• Why choosing the wrong MSP could actually kill your chances at certification

After being impacted by DOGE myself, I've put a lot of thought into how small businesses will be impacted by DOGE + CMMC.

Most of my concern is for SMBs that haven't started preparing for CMMC. That costs a lot of money, and if SMBs lose revenue due to DOGE cuts before they prepare for CMMC, I'm not sure they'll be able to survive in the defense contracting space.

But there is great opportunity for CMMC early adopters to be part a small cadre of CMMC certified companies and operate in a much smaller competitive space.

It turns out CMMC actually could be your business's savior. Who knew!?!

I really enjoyed this conversation! What were your biggest takeaways? Let me know in the comments.

Follow Derek on LinkedIn: https://www.linkedin.com/in/derekkernus/

Aethon Security Website: https://www.aethonsecurity.com/

-----------

Thanks to our sponsor Vanta!

Get back time to focus on strengthening security and scaling your business.

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-10&utm_campaign=courses

#cmmc

In this episode, I’m joined by Tim Golden, Founder of Compliance Scorecard, to unpack the misunderstood, and mission-critical world of cyber GRC.

Tim shares what he’s learned from decades of hands-on work - from implementing NIST frameworks before “GRC” was even a term, to helping teams understand why writing policies is just as important as patching vulnerabilities.

Here are some highlights from the episode:

• What GRC actually means - and why governance is the most misunderstood part
• Why people who say "compliance isn't security" are missing the point
• How explaining the "why" of cybersecurity controls aids in acceptance
• Why data retention policies can protect you from major legal headaches
• And yes… a story about how Tim accidentally ransomwared himself 🙃

This is a must-listen for anyone navigating compliance, cybersecurity, or just trying to understand how it all fits together!

I really enjoyed this conversation! What were your biggest takeaways? Let me know in the comments.

Follow Tim on LinkedIn: https://www.linkedin.com/in/timothygolden/

Compliance Scorecard Website: https://compliancescorecard.com/

-----------

Thanks to our sponsor Vanta!

Get back time to focus on strengthening security and scaling your business.

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e9&utm_campaign=courses

#cybersecurity

In this episode, Ryan Patrick of HITRUST explains how HITRUST approaches the assurance problem, from centralizing the certification process to frequent updates to the control sets based on threat data.

I barely knew anything about HITRUST going in, but it’s clear they’re tackling the cybersecurity assurance problem in a radically different way.

Here’s what stood out to me:

• HITRUST reviews its security controls quarterly based on threat intel and control effectiveness
• There are three distinct assessment levels (like CMMC)
• HITRUST itself issues a certification after the 3rd party assessment and running the assessment results through two stages of QA
• Every 3rd assessment gets reviewed. Every. Single. One.

The centralized approach of HITRUST allows them to provide feedback to its assessment community after each and every assessment which results in assessments that are more consistent and higher quality.

HITRUST certified organizations are contractually required to report incidents which then allows them to evaluate the effectiveness of their controls.

I personally think that commercial cybersecurity frameworks should take a look at HITRUST.

What were your biggest takeaways? Let me know in the comments.

Follow Ryan on LinkedIn: https://www.linkedin.com/in/ryan-patrick-3699117a/

HITRUST Website: https://hitrustalliance.net/

-----------

Thanks to our sponsor Vanta!

Get back time to focus on strengthening security and scaling your business.

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e8&utm_campaign=courses

#hitrust

If you're confused about Controlled Unclassified Information (CUI) - you're not alone. Many defense contractors (not to mention DoD themselves) misunderstand what is CUI, where it comes from, and how to handle it.

In this episode, Ryan Bonner, CEO of DEFCERT, gives a masterclass in understanding CUI from the actual laws and regulations - not just hearsay.

👉 Here are the highlights:

• What CUI really is - and what it’s not
• How to use the NARA and DoD CUI registries
• The proprietary paradox
• How to decontrol CUI
• The difference between FCI and CUI
• DoD memo on determining CMMC levels

This is essential listening for anyone working with the defense industrial base - primes, subs, and especially DoD program managers who want to avoid missteps.

What were your biggest takeaways? Let me know in the comments.

Follow Ryan on LinkedIn: https://www.linkedin.com/in/rybonner/

DEFCERT Website: https://defcert.com/

-----------

Thanks to our sponsor Vanta!

Get back time to focus on strengthening security and scaling your business.

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e7&utm_campaign=courses

#cui #cmmc

In this episode I’m joined by Eric Fields of Reynolds Construction to learn how he led his business to CMMC level 2 certification!

I call him "Eric the Great" - you'll see why in a moment.

Eric's background was in HR and business operations. He had no background in IT or cybersecurity.

They did it in-house - with just two people and smart choices.

👉 Here’s how they did it:

• CMMC training from GRC Academy
• Resources and advisory services from Kieri Solutions
• CCP & CCA training
• Meticulous documentation

This episode is very special to me - Eric's intro to CMMC was through GRC Academy more than 2 years ago, and he was actually the second person to leave a 5-star review on my CMMC training for defense contractors: https://grcacademy.io/course-reviews/cmmc-overview-training-eric-f-20230127/

This episode is a great reminder that small businesses can achieve CMMC certification without breaking the bank.

That said, time is no longer a luxury. With CMMC phasing in this summer, small businesses need to move fast - and partnering with a CMMC-focused MSP can help accelerate the process.

What were your biggest takeaways? Feel free to celebrate with "Eric the Great" in the comments!

Follow Eric on LinkedIn: https://www.linkedin.com/in/ericfields6/

Reynolds Construction Website: https://www.reynoldscon.com/

-----------

Thanks to our sponsor Vanta!

Get back time to focus on strengthening security and scaling your business.

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e6&utm_campaign=courses

#cmmc #nist #cybersecurity

In this episode I’m joined by Daniel Akridge of Summit 7 to talk about the real challenges facing the Defense Industrial Base - and the FASTEST path to CMMC certification.

To CUI Enclave, or not to CUI enclave - that is the question!

👉 Here are some of the highlights:

• What the big primes are saying about their subs and CMMC
• The biggest CMMC hurdles for defense contractors
• Why MOST DoD contracts could require CMMC Level 2 certification - not just self-attestation
• Deep dive into CUI enclaves and their pros and cons

I personally like CUI enclaves because it keeps government cybersecurity regulations and incident reporting requirements out of my corporate IT environment...

However if you are a small business that primarily supports the DoD, CUI enclaves begin to make less sense - even as I try to reason otherwise!

What were your biggest takeaways? Do you LUV CUI enclaves?? Let me know in the comments!

Follow Daniel on LinkedIn: https://www.linkedin.com/in/danielakridge/

Summit 7 Website: https://www.summit7.us/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e5&utm_campaign=courses

#cmmc #nist #cybersecurity

Is that what it takes for MSPs to get CMMC'd!?! 👀

In this episode I’m joined by Bobby Guerra and Kaleigh Floyd from Axiom, an IT Managed Service Provider (MSP). They explain exactly what it took to achieve CMMC level 2 certification - after 4 years of effort.

Most MSPs aren’t ready for CMMC. Many believe it's just another checkbox, but it’s a complete operational shift that requires rethinking your tools, processes, and client relationships!

Here are some of the highlights:

• How much money they allocated for CMMC (it’s more than you think)
• How to build scalable and repeatable processes to support compliance
• The tools, contracts, and agreements you MUST have in place
• How to prepare for the assessment (and avoid sleepless nights!)

Bobby Guerra is the CEO of Axiom and has led the MSP for over 22 years. Under his leadership, Axiom became one of the first MSPs in the U.S. to achieve CMMC Level 2 Certification. Bobby now helps guide clients through their own CMMC journeys, focusing on sustainable security and compliance.

Kaleigh Floyd is the Marketing Director at Axiom and Co-Host of the Climbing Mount CMMC podcast. Raised in the MSP world, she now educates others through Microsoft 365 training and cybersecurity content. Her passion lies in simplifying tech and making a lasting impact in the industry.

This is a true CMMC for MSPs masterclass! So much great advice packed into this episode!

What were your biggest takeaways? Let me know in the comments!

Follow Bobby on LinkedIn: https://www.linkedin.com/in/bobbyguerra/

Follow Kaleigh on LinkedIn: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

Axiom's Website: https://www.axiom.tech/

Climbing Mount CMMC Podcast: https://www.axiom.tech/climbing-mount-cmmc-the-podcast/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e4&utm_campaign=courses

#cmmc #nist #cybersecurity

Get ready to learn from CMMC Lead Assessor Fernando Machado as he explains EXACTLY what happens in each phase of the CMMC assessment process!

Fernando is the Managing Principal of Cybersec Investments which is an authorized C3PAO. Fernando has been involved with CMMC starting in 2020 as a member of the Cyber AB's Standards Management Industry Working Group.

Cybersec Investments has already issued 12 CMMC certifications since CMMC assessments began in January of 2025 and previously participated in nearly 20 Joint Surveillance Voluntary Assessments (JSVAs).

👉 Here are some highlights:

• What to expect during a CMMC assessment
• The 4-phases of the CMMC Assessment Process (v2.0)
• No self-assessment? No independent assessment
• Common issues that could cause assessment failures
• How to make the assessment easier for your assessor (and you)

It is overwhelming preparing for a CMMC assessment, but don't go into it without knowing what to expect!

What were your biggest takeaways? Let me know in the comments!

Follow Fernando on LinkedIn: https://www.linkedin.com/in/fernando-machado-cissp-cism-cca-ccp-5b5581124/

Cybersec Investments Website: https://cybersecinvestments.com/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e3&utm_campaign=courses

#cmmc #nist #cybersecurity

Miguel is the founder of Villa-Tech, a small but powerful tech company that is breaking into the defense contracting space.

Miguel shares a raw and honest look at the costly missteps, lessons learned, and strategies that could save small businesses hundreds of thousands of dollars preparing for CMMC certification!

👉 Here are some highlights:

• How he could have saved $300k
• Bad advice is expensive - how to hire the right consultants
• Rebuilding their SSP 4 times
• The importance of CMMC education before diving in

Villa-Tech has built a CUI enclave environment that other defense contractors can leverage! They also have an amazing set of capabilities and just achieved CMMC level 2 certification, so be sure to check out their capabilities statement below.

Small businesses CAN succeed in CMMC, but the path is filled with pitfalls that can drain your budget.

Don’t make the same mistakes - learn from someone who’s been through it!

What were your biggest takeaways? Let me know in the comments!

Follow Miguel on LinkedIn: https://www.linkedin.com/in/miguel-villarreal-0231286/

Villa-Tech Website: https://www.villa-tech.com

Villa-Tech Capabilities: https://villa-tech.com/government/capabilities-statement/

Structura.io Website: https://structura.io/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e2&utm_campaign=courses

#cmmc #nist #cybersecurity

Got AWS? They've given you tools that make compliance much easier!

In this episode, I sit down with Travis Goldbach from Amazon Web Services (AWS) to break down the solutions AWS has created to simplify CMMC and DFARS compliance.

👉 Here are some highlights:

• AWS compliance automation - reducing manual effort and risk
• Shared Responsibility Model - what AWS secures vs. what you manage
• AWS GovCloud vs. Commercial Cloud - choosing the right environment
• Landing Zone Accelerator - your shortcut to a secure, compliant AWS setup
• How AWS is pursuing its own CMMC certification & what that means for you

I didn't know that AWS was so mature when it came to CMMC and DFARS compliance!

It was really awesome to learn how they are making compliance easier!

What were your biggest takeaways? Let me know in the comments!

Follow Travis on LinkedIn: https://www.linkedin.com/in/travis-goldbach-b446a223/

AWS CMMC website: https://aws.amazon.com/compliance/cmmc/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e1&utm_campaign=courses

#cmmc #nist #cybersecurity #aws

In this episode, I speak with Stacy Bostjanick who is the Director of the CMMC program at DoD CIO!

Here are some highlights from the episode:

• Expectations for the initial phase in of CMMC
• Who determines CMMC levels for contracts?
• How will CMMC waivers work?
• Criteria for CMMC level 2 self-assessments and CMMC level 3
• Early use of NIST 800-171 r3
• And so much more!

First mentioned in 2019, CMMC 1.0 was released in 2020 under the Trump administration.

CMMC 1.0 was reviewed during the Biden administration, they released CMMC 2.0 in late 2021, and then… There was a great silence.

If you threw a small rock, you’d hit ten people who thought CMMC was going away.

All this time though, the DoD was quietly marching on.

They released the proposed CMMC program rule in December 2023 and released the final CMMC program rule in October 2024 - which is now EFFECTIVE.

After all of that, CMMC will FINALLY begin to phase into DoD solicitations and contracts by this summer.

CMMC has been a LONG time coming, and it was an honor to hear the back story and why certain decisions were made!

What were your biggest takeaways? Let me know in the comments!

Follow Stacy on LinkedIn: https://www.linkedin.com/in/stacy-bostjanick-a3b67173/

DoD CIO CMMC website: https://dodcio.defense.gov/CMMC/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e43&utm_campaign=courses

#cmmc #nist #cybersecurity

I wish I was joking.

In this episode I speak with Joy Beland about the critical role IT Managed Service Providers (MSPs) play in the CMMC space and why so many of them will cause their clients to fail their CMMC assessments.

Here are some of the highlights:

• The NEW critical CMMC requirement for MSPs
• Why so many MSPs will cause their clients to fail CMMC assessments
• Why MSPs SHOULD still get CMMC certified
• Questions to ask your MSP to gauge their CMMC readiness

Joy is the Vice President of Cybersecurity Compliance at Summit 7 and brings over 20 years of experience as a former MSP owner. Summit 7 is a specialized MSP exclusively supporting defense contractors.

If you use an MSP, don't just assume that everything is OK and your MSP has it all covered.

It's highly likely that they do NOT and you'll FAIL your CMMC assessment because of them.

There are some great CMMC-focused MSPs out there, but the majority of MSPs have NO BUSINESS supporting defense contractors.

Choose wisely!

What stood out most to you? Whatever your thoughts are, feel free to let me know in the comments!

Follow Joy on LinkedIn: https://www.linkedin.com/in/joy-belinda-beland/

Summit 7 website: https://www.summit7.us/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e42&utm_campaign=courses

In this episode I speak with Frank Riccardi about cybersecurity in healthcare and the event that triggered much more cyber accountability for the C-suite.

Here are some of the highlights:

• Why healthcare workers are prone to social engineering attacks
• Reasons you SHOULD and should NOT pay after ransomware attacks
• Managing shadow IT after acquisitions/mergers
• Why every member of the C-suite must understand cyber
• The importance of a culture of reporting

Frank is a former C-level executive with 25 years of experience developing compliance and privacy programs for large healthcare systems comprised of hospitals, physician practice groups, urgent care centers, and other healthcare organizations.

I really enjoyed Frank's description of shadow IT! I always thought of an employee who is using an unauthorized application, but I never thought of it from the standpoint of an acquisition/merger.

What stood out most to you? Whatever your thoughts are, feel free to let me know in the comments!

Follow Frank on LinkedIn: https://www.linkedin.com/in/frank-riccardi-261831b1/

Frank's Book (Mobilizing the C-Suite: Waging War Against Cyberattacks): https://www.amazon.com/Mobilizing-C-Suite-Waging-Against-Cyberattacks/dp/1637424248/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e41&utm_campaign=courses

#cybersecurity #healthcare #hospital #informationtechnology

In this episode, I speak with cybersecurity attorney Sarah Anderson about how to evaluate IT Managed Service Providers and how businesses can protect themselves when relying on them.

Here are some of the highlights:

• How you should evaluate MSPs
• What to do after your MSP is hacked
• Managing the cyber incident
• Cyber insurance pitfalls
• Should you fire your hacked MSP?

Sarah is the owner of SWA Law LLC and also serves in U.S. Army Reserves as a Lieutenant Colonel.

She has been involved in more than 100 cyber incident responses throughout her career and also represents public and private entities in regulatory compliance, cybersecurity practices, and technology contract negotiations.

If you are relying on an MSP to manage your IT and security, you won’t want to miss this!

As Sarah said, not all MSPs are created equally. Many MSPs have such poor security practices they WILL get you hacked.

Encourage your MSP to join MSPCyberX! It's a nonprofit focused on elevating the security of MSPs: https://www.mspcyberx.com/

Follow Sarah on LinkedIn: https://www.linkedin.com/in/sarah-anderson-lacyberlawblog123/

Legally Cyber website: https://www.legallycyber.com/

Sarah's cybersecurity course for lawyers: https://courses.sprouteducation.com/item/cybersecurity-basics-lawyers-653403

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e40&utm_campaign=courses

#msp #informationtechnology #cybersecurity #cmmc

In this episode Cera Adams breaks down these SOC reports and what to expect in a SOC audit!

Here are a few highlights from this episode:

• Why CPAs are involved
• What SOC 1 / SOC 2 / SOC 3 reports mean to providers and consumers
• Difference between SOC 2 Type 1 and Type 2 reports
• How SOC scoping and audits work
• SOC consulting/audit independence requirements

Cera is the Director of IT Assurance Services and leads OCD Tech's SOC 2 and IT Audit Practices. She has more than 20 years of experience in information security!

I've spent most of my career working in the NIST cybersecurity space, so this was very interesting to me!

I thought that the SOC 3 report was interesting, especially since many other frameworks don't have an equivalent.

What were your takeaways? What is your best SOC pun? Let me know in the comments!

Follow Cera on LinkedIn: https://www.linkedin.com/in/ceraadams/

OCD Tech Website: https://ocd-tech.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e39&utm_campaign=courses

#soc2 #cybersecurity #informationsecurity

In this episode Hahna Kane Latonick teaches an Android cybersecurity masterclass for cyber GRC teams:

Here are a few highlights from this episode:

• How the Android project is managed
• How Android devices are compromised
• The many steps to update Android devices
• Most important steps to secure Android devices
• Is Apple more secure than Android?

Hahna is the Director of Security Research at Dark Wolf Solutions. Some of her focuses include Android reverse engineering and exploit development. She has been featured on national media outlets including Fox Business News, ABC News, and many others!

Too often companies integrate mobile devices at work without truly understanding how they work and the risks involved.

Hahna explained these concepts so well! And of course, we had some back and forth on what is more secure, Android or Apple.

I really enjoyed this episode and learned more about Android myself! What were your takeaways?

Follow Hahna on LinkedIn: https://www.linkedin.com/in/hahnakane/

Dark Wolf Solutions Website: https://darkwolfsolutions.com/

Android Security Research Playbook: https://asrp.darkwolf.io/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e38&utm_campaign=courses

#android #cybersecurity #informationsecurity

In this episode, the whistleblower explains how he tried to stop Penn State from misrepresenting their NIST 800-171 compliance to the DoD and what he has faced since he blew the whistle!

Whistleblower attorney Julie Bracker also shares what the media got wrong in this case and the latest on the Georgia Tech FCA case!

Here are a few highlights from this episode:

- Hear directly from the whistleblower in this False Claims Act case

- What the media got wrong

- Recommendations to universities

- Advice for other whistleblowers

Matthew Decker was the Chief Information Officer at the Applied Research Laboratory at Penn State from 2015 until 2023 and the interim Vice Provost and CIO responsible for all of Penn State from January 2016 until September 2016. Matthew currently serves as the Chief Data and Information Officer at NASA’s Jet Propulsion Laboratory since 2023.

It was fascinating to learn that the university assumed compliance with their own AD95 security policy meant they were automatically compliant (at least to some measure) with NIST 800-171. This is a great reminder that the details always matter!

Special thanks to Matt for sharing his story with us, and to Julie Bracker for coordinating this interview!

Follow Julie on LinkedIn: https://www.linkedin.com/in/juliekeetonbracker/

Bracker & Marcus LLC Website: https://www.fcacounsel.com/

Connect with Matt on LinkedIn: https://www.linkedin.com/in/matt-decker-cio/

Whistleblower's Handbook: https://www.amazon.com/New-Whistleblowers-Handbook-Step-Step/dp/1493028812/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e37&utm_campaign=courses

#whistleblower #cmmc #cybersecurity

In this episode, I speak with Richard Wakeman, Chief Architect for cybersecurity of Aerospace & Defense @ Microsoft!

We discuss the history of the government clouds, the need behind GCC and GCC High, and much more!

Here are some highlights:

• The origins of the Microsoft clouds
• Which clouds support DFARS 7012 compliance
• When will GCC High be FedRAMP authorized?
• CUI enclave considerations

Richard is a wealth of knowledge, and I have personally benefited from his compliance blog articles since at least 2020!

If you are currently operating in the Microsoft cloud or are trying to decide which Microsoft cloud to buy, you won't want to miss this!

Were you aware that GCC High isn't FedRAMP authorized yet? What about Microsoft 365 commercial not being compliant with DFARS 7012?

Whatever your thoughts are, let me know!

Follow Richard on LinkedIn: https://www.linkedin.com/in/wakeman/

Microsoft Cloud compliance article: https://aka.ms/MSGovCompliance

Microsoft 365 Roadmap: https://www.microsoft.com/en-us/microsoft-365/roadmap

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e36&utm_campaign=courses

In this episode, I speak with Brian Hubbard, President of Evolved Cyber Solutions and the MSP Cybersecurity Exchange!

We discuss the state of MSP cybersecurity and how MSPCyberX is elevating the security posture of MSPs everywhere!

Here are some highlights:

• Why MSPs are so critical to our nation's security
• The inevitable regulations that will target MSPs
• MSPs involvement during CMMC assessments
• How MSPCyberX can help

GRC Academy partnered with MSPCyberX early on to provide CMMC training to its members at a discount! It was great to hear about MSPCyberX's origin story!

If your MSP is not a member of MSPCyberX, it is in your best interest that they join!

Follow Brian on LinkedIn: https://www.linkedin.com/in/brian-scott-hubbard/

Follow MSPCyberX on LinkedIn: https://www.linkedin.com/company/mspcyberx/

MSPCyberX Website: https://www.mspcyberx.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e35&utm_campaign=courses

This is a hidden CMMC treasure that no one's talking about!

In this episode, I speak with Darren Mott about the FREE cybersecurity services offered to the DIB by the National Cybersecurity Operations Center!

Here are some of the FREE services they offer:

• CMMC gap assessments
• Penetration testing
• SOC & Incident response
• Forensic analysis
• Threat intelligence

I had no idea the National CSOC existed! This is an AMAZING opportunity that small defense contractors should take advantage of quickly before they reach capacity!

On another note, I actually listened to Darren's podcast when it first came out. I never thought I'd actually host a podcast let alone speak with him!

Follow Darren on LinkedIn: https://www.linkedin.com/in/darrenmott/

The CyBUr Guy Podcast: https://podcasts.apple.com/us/podcast/the-cybur-guy-podcast/id1526491250

National CSOC Website: https://nationalcsoc.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e34&utm_campaign=courses

In this episode, I spoke with Kenneth Moras, Security GRC Lead at Plaid.

Kenneth has worked in critical GRC roles in big tech companies like Adobe and Meta! He was heavily involved in the cyber response to international regulators after severe breaches.

Here are some highlights:

• What you need to do and know to get a job in GRC
• How to master GRC
• 3 critical skillsets you need in your cyber GRC team
• How regulatory incident response differs from traditional cyber incident response

Kenneth is a true GRC master! His advice for folks wanting to get into GRC is the best I've heard! His tips on building successful GRC teams were excellent as well!

What were your biggest takeaway? Do you agree that GRC teams need technical knowledge? Looking forward to your thoughts!

Follow Kenneth on LinkedIn: https://www.linkedin.com/in/kennethmoras/

Plaid Website: https://plaid.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Register for Vanta's webinar on Questionnaire Automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e33&utm_campaign=courses

In this episode, I spoke with Dr. Paul Ashley, the CTO of Anonyome Labs.

Paul explains how widespread online surveillance is, the evolution of digital identity from centralized to decentralized models, how digital wallets work, and what big tech doesn't want you to know!

Here are a few highlights from this episode:

• Big tech's surveillance economy
• Evolution of digital identity
• Decentralized Identity
• Global adoption of digital ID wallets - including in the USA!

I had no idea this was happening. More than 20 states in the USA are adopting digital driver's licenses!

It's fascinating to think of how digital IDs could be used personally and at work!

It's also scary to think of how some governments could abuse this technology.

Whatever you think, I'm looking forward to hearing your thoughts!

Follow Paul on LinkedIn: https://www.linkedin.com/in/drpaulashley/

Anonyome Labs Website: https://anonyome.com/

My Sudo App: https://mysudo.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Register for Vanta's webinar on Questionnaire Automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e32&utm_campaign=courses

In this episode, the whistleblowers explain how they tried to stop Georgia Tech from allegedly LYING to the government about their NIST 800-171 compliance and what they have faced since they blew the whistle!

Whistleblower attorney Julie Bracker also shares what could come next and how much Georgia Tech may have to pay out!

Here are a few highlights from this episode:

• Hear directly from the whistleblowers in this False Claims Act case
• Details on the "Fictitious" NIST 800-171 SPRS Score
• How much money Georgia Tech might have to pay
• Recommendations to universities
• Advice for other whistleblowers

Both of the whistleblowers have a long history with Georgia Tech and truly care for the institution.

Christopher Craig has worked at Georgia Tech for more than 20 years. He was the Associate Director of Cybersecurity where he managed all central cyber security personnel and built the GRC team until Georgia Tech demoted him to an Enterprise Security Architect.

Kyle Koza worked at Georgia Tech for more than 15 years until he left his role as a Principal Information Security Engineer in 2022. He got his bachelor’s and master's degrees from Georgia Tech and also co-wrote and still teaches a security incident response master's degree course at the university.

I thought Christopher's recommendation (24:37) for universities to centralize their labs was excellent!

How can a university expect to maintain its NIST / CMMC compliance if multiple labs are built and managed by different teams who may not even be familiar with the NIST 800-171 security controls?

I also loved hearing Chris tell us about the support he has received from the cyber community (38:00)! Who in cyber doesn't want to do the right thing? I would like to think those with bad intent are an extremely small percentage.

Special thanks to Christopher and Kyle for sharing their stories with us, and to Julie Bracker for coordinating this interview!

Follow Julie on LinkedIn: https://www.linkedin.com/in/juliekeetonbracker/

Bracker & Marcus LLC Website: https://www.fcacounsel.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Register for Vanta's upcoming webinar on Questionnaire Automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e31&utm_campaign=courses

Don't believe me? Let me introduce you to its creator!

In this episode, Jacob speaks with John Kindervag, the creator of Zero Trust.

John is the Chief Evangelist at Illumio where he accelerates awareness and adoption of Zero Trust Segmentation.

In the episode he shares the origin story of Zero Trust starting with his time at Forrester Research. He explains the fundamental principles of Zero Trust, debunks common misconceptions, and how you can implement Zero Trust using a 5-step model.

Here are a few highlights from this episode:

• The broken trust model that has allowed the largest data breaches
• Defining Zero Trust and misconceptions about it
• How to implement zero trust in 5 steps
• "Things Run Amok" poem - if Dr. Seuss wrote about the Internet of Things

John's elevator pitch for Zero Trust is a masterclass in itself.

If you want to convince business leaders to invest in cybersecurity, you have to focus on how that investment will benefit the business. John does exactly that here and we should all take note.

Illumio is a Zero Trust Segmentation company that prevents breaches and ransomware from spreading across hybrid environments. Their platform visualizes traffic flows, automatically sets granular segmentation policies, and isolates critical assets and compromised systems. Founded in 2013, Illumio protects organizations of all sizes, from Fortune 100 to small businesses.

Follow John on LinkedIn: https://www.linkedin.com/in/john-kindervag-40572b1/

Illumio Website: https://www.illumio.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Register for Vanta's upcoming webinar on Questionnaire Automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e30&utm_campaign=courses

In this episode, Jacob speaks with lawyer Hamsa Mahendranathan about the FIRST cybersecurity False Claims Act (FCA) lawsuit that reached a settlement!

This goes all the way back to 2008 believe it or not… The lawsuit was FINALLY settled in 2019!

As we all know, the DoJ has intervened in the Georgia Tech NIST 800-171 FCA whistleblower complaint.

Wonder what the whistleblowers may be dealing with? Maybe you want to blow the whistle yourself and don't know what to expect?

Here are a few highlights from this episode:

• How Hamsa's client unwittingly became a whistleblower
• The fallout he experienced for doing the right thing
• Mitigations for career consequences of blowing the whistle
• The complexity of working with federal, state, and local False Claim Act laws

And so much more!

If you are interested in the False Claims Act and cyber compliance, you won't want to miss this one! This episode is truly one for the history books!

Read the whistleblower complaint: https://cdn.grcacademy.io/web/20240824091900/us-ex-rel-glenn-vs-cisco-fca-complaint.pdf

Follow Hamsa on LinkedIn: https://www.linkedin.com/in/hamsa-mahendranathan/

Whistleblower Partners Website: https://www.whistleblower.law/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Register for Vanta's upcoming webinar on Questionnaire Automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e29&utm_campaign=courses

In this episode, Jacob speaks with Daniel Stark of Meerkat Cyber about the unique CMMC compliance challenges in a manufacturing environment.

Here are some highlights:

• Daniel's experience running IT in a family-owned manufacturing shop
• How Controlled Unclassified Information (CUI) flows on the shop floor
• Physical and environmental security constraints unique to manufacturing
• How ISO 9001 / AS9100 can help get the buy in for CMMC
• Advice for manufacturing IT staff dealing with CMMC compliance
• Tips on hiring the right CMMC consultant and assessor

I really enjoyed learning more about how machine shops operate and the unique challenges they have when it comes to CMMC compliance!

It's awesome that there are folks in the CMMC ecosystem that are familiar with manufacturers!

Manufacturing is an extremely different type of environment and in my opinion "normal" office IT assessment experience won't cut it. Hire wisely, folks!

Follow Daniel on LinkedIn: https://www.linkedin.com/in/daniel-stark-a85694222/

Meerkcat Cyber Website: https://meerkatcyber.com/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Register for Vanta's upcoming webinar on Questionnaire Automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e28&utm_campaign=courses

In this episode, Jacob speaks with Steven Molter of IntelliGRC about his experiences helping IntelliGRC clients complete NIST 800-171 Joint Surveillance Voluntary Assessments (JSVAs).

Here are some highlights:

• The JSVA process & how to request one
• The different teams within DIBCAC
• The challenge of subjectivity during assessments
• Advice for companies preparing for JSVAs
• How a company convinced DIBCAC to "upgrade" from a traditional DIBCAC high assessment to a JSVA

According to the proposed CMMC program rule, JSVAs are eligible to convert to CMMC level 2 certifications once the CMMC program goes live assuming certain conditions are met:

• Perfect assessment score
• No open assessment POA&Ms

Steve shared some great lessons for those preparing for JSVAs and CMMC assessments. If you're prepping for either, you won’t want to miss this episode!

Also, just in case you didn’t know, IntelliGRC customers receive my DIB-focused CMMC Overview Training! No other GRC platform that I'm aware of today provides comprehensive foundational CMMC training to their customers!

If you are looking for a GRC platform to manage your CMMC compliance program, check out IntelliGRC!

Follow Steve on LinkedIn: https://www.linkedin.com/in/steven-molter-apologeticz/

Follow IntelliGRC on LinkedIn: https://www.linkedin.com/company/intelligrc/

IntelliGRC Website: https://www.intelligrc.com/

IntelliGRC YouTube Channel: https://www.youtube.com/@intelligrc

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e27&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

In the episode they discuss Hypori's origin story and its innovations in the mobile security space.

Here are some highlights from the episode:

• Hypori's origin story and its roots starting as an NSA Commercial Solutions for Classified Program (CSfC) product
• How it is different from traditional Mobile Device Management (MDM)
• How it works, its certifications, and its deployment options
• How Hypori can help achieve CMMC compliance

We don't think about it much, but mobile devices really are a huge risk - just think of how much information is on your phone!

If you work in cybersecurity, you should know about this unique option to provide secure mobile access!

Follow Brian on LinkedIn: https://www.linkedin.com/in/brian-kovalski-057b8a7/

Hypori Website: https://www.hypori.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e26&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Mark is the CEO of Information Professionals Group and has over 30 years of experience!

In the episode they discuss the business case for information security, and how cybersecurity professionals can effectively communicate with the C-suite and other business leaders!

Here are some highlights from the episode:

• The Importance of information security in business
• The Importance of securing data
• How cyber professionals should engage with business leaders
• Roleplaying exercise - bad/good examples of a cyber pro trying to convince a CEO
• How active listening can help you make a difference

Follow Mark on LinkedIn: https://www.linkedin.com/in/markdnicholls/

Information Professionals Group Website: https://www.informpros.com.au/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e25&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Chris Silvers is the founder of CG Silvers Consulting! Chris has a vast amount of experience ranging from CMMC assessments to penetration testing. He even won the prestigious DEF CON black badge during the DEF CON 24 Social Engineering Capture the Flag (SECTF)!

In this episode they focus on how organizations can defend against social engineering attacks!

Here are some highlights from the episode:

• Winning the DEF CON SECTF black badge
• Social engineering tactics and tools
• CEO impersonation / fraud attacks
• How can GRC help defend against social engineering?
• Why businesses shouldn't start with a penetration test

Follow Chris on LinkedIn: https://www.linkedin.com/in/cgsilvers/

Chris's Website: https://www.cgsilvers.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e24&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Aron is the founder of the GRC Lab, and a Udemy instructor with more than 11,000 students! He is an experienced auditor for management systems based on ISO 27001, ISO 9001, ISO 27018 and ISO 22301.

In this episode they discuss the essentials of ISO 27001 including the history of the standard and the changes in the latest revision, but also the significance of the organizations involved and the danger of ISO “certification paper mills.”

Here are some highlights from the episode:

• The history of ISO 27001
• Changes in ISO 27001:2022
• Who are the IAF, accreditation bodies, and certification bodies?
• The importance of hiring an IAF affiliated certification body
• ISO scoping
• Maintaining an ISO certification
• Best practices for internal audits

Follow Aron on LinkedIn: https://www.linkedin.com/in/aronlange/

Aron’s Udemy courses: https://www.udemy.com/user/aron-lange/

Aron’s Website: https://www.aronlange.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e23&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Patrick Garrity is a seasoned security researcher at VulnCheck where he focuses on vulnerabilities, vulnerability exploitation and threat actors.

In this episode they discuss the importance of integrating threat intelligence into vulnerability management using the Exploit Prediction Scoring System (EPSS), CISA Known Exploited Vulnerabilities Catalog, and the changes in CVSS 4.0!

Here are some highlights from the episode:

• How Exploit Prediction Scoring System (EPSS) can predict exploitation
• How vulnerability scanners integrate EPSS
• CISA's Known Exploited Vulnerabilities (KEV) Catalog
• The national security implications of vulnerability management

Follow Patrick on LinkedIn: https://www.linkedin.com/in/patrickmgarrity/

VulnCheck Website: https://vulncheck.com/

Thanks to our sponsor Keeper Security!

Need a FedRAMP authorized Password Manager? See how Keeper can help you comply with CMMC: https://www.keepersecurity.com/cmmc/?utm_source=grcacademy&utm_medium=display&utm_campaign=cmmc_video

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e22&utm_campaign=courses

Julie is the whistleblower attorney for both the Penn State University and Georgia Tech University FCA complaints. These complaints essentially allege the defendants misrepresented their compliance with NIST 800-171!

They discuss the False Claims Act and the DOJ's Civil Cyber Fraud Initiative, and what federal contractors can do to avoid being the subject of a whistleblower complaint!

Here are some highlights from the episode:

• What is the False Claims Act?
• What is the DoJ's Civil Cyber Fraud Initiative?
• What are the risks and rewards for whistleblowers?
• Who are the targets of the initiative?
• Can companies blindly rely on their MSP and be safe?
• How to quantify damages of cyber noncompliance fraud
• DoJ Civil Cyber Fraud settled lawsuits so far
• Georgia Tech and Penn State FCA cases

Follow Julie on LinkedIn: https://www.linkedin.com/in/juliekeetonbracker/

Bracker & Marcus LLP Website: https://www.fcacounsel.com/

Penn State FCA Complaint: https://cdn.grcacademy.io/web/20240325204912/penn-state-university-false-claims-act-complaint.pdf

Georgia Tech FCA Complaint: https://cdn.grcacademy.io/web/20240325204909/georgia-tech-university-false-claims-act-complaint.pdf

2023 DoJ Report of FCA settlements (more than $2.68 billion): https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-268-billion-fiscal-year-2023

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e21&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

They discuss security and compliance challenges at universities, the Penn State NIST 800-171 False Claims Act lawsuit, and much more!

Here are some highlights from the episode:

• How universities are different from other types of organizations
• Different compliance requirements for universities
• Who is involved in the execution of a government contract?
• The drivers of cybersecurity compliance at universities
• Thoughts on the Penn State False Claims Act lawsuit
• How to drive positive cybersecurity change at a university
• CUI enclaves at universities
• Areas of CMMC that need clarification

Here are the panelists:

• Jay Gallman - Duke University (https://www.linkedin.com/in/jay-gallman/)
• Kolin Hodgson - Notre Dame (https://www.linkedin.com/in/kolin-hodgson-cisa-cissp-4bbb9a/)
• Melissa Kimble - University of Maine (https://www.linkedin.com/in/melissa-kimble/)
• Wendy Epley - University of Arizona (https://www.linkedin.com/in/wendyepley/)

Thanks to our sponsor Keeper Security!

Need a secure file sharing solution? Register for a webinar showing how Defense Contractors can share sensitive information using Keeper: https://grcacademy.io/ref/keeper/webinar-cmmc-file-sharing-april-2024/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e20&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

They discuss the beginnings of AI, how it has evolved over time, and the risks and opportunities it presents to companies around the world!

Raghuram is the Senior Vice President of Product Management at MetricStream. He is an AI expert and has worked in AI-focused roles at JPM Chase, KPMG, as well as the Watson Group at IBM.

Here are some highlights from the episode:

• The history of AI
• How do large language models (LLMs) work?
• AI for GRC & GRC for AI
• Using AI in cyber operations
• The future of cyber risk

Follow Ragu on LinkedIn: https://www.linkedin.com/in/raghuramsrinivas/

MetricStream website: https://www.metricstream.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online cyber GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e19&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Pat is a cybersecurity expert with over 20 years of experience. He currently works at Zscaler as Field CTO and is responsible for the alignment of Zscaler capabilities to the DoD and IC mission sets in order to provide dynamic, mission-focused, innovative approaches to enable transformation and zero trust to warfighter organizations.

Zscaler U.S. Government Solutions enables the U.S government and their strategic partners to securely transform their networks and applications for a mobile and cloud-first world. Zscaler's FedRAMP Moderate/High/DoD IL5-authorized solutions ensure fast, secure connections between users and applications, regardless of device, location, or network.

Here are some highlights from the episode:

• Zscaler's Approach to FedRAMP, DoD Impact Levels, and CMMC
• Shared Responsibility Between Cloud Service Providers and Users
• What Zero Trust is and how it relates to CMMC
• Zero Trust Pillars
• Thoughts on Federal Approach to Zero Trust

Follow Patrick on LinkedIn: https://www.linkedin.com/in/perrypn2019/

Zscaler website: https://www.zscaler.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e18&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Derrich Phillips is a cybersecurity expert with over 20 years of experience in the field. He started his career in the Army's security operations center, defending networks against cyber attacks. As the founder of Aspire Cyber, he focuses on helping small companies prove their cybersecurity readiness to handle information for enterprise customers.

Here are some highlights from the episode:

• How Derrich get into cybersecurity
• The what and why of security questionnaires
• How to save time and money while filling out a security questionnaires
• When to push back on overly burdensome requirements

Check out this video where Derrich and I discuss how ChatGPT can be used in information security compliance: https://youtu.be/IAAJPJLBeaY

Follow Derrich on LinkedIn: https://www.linkedin.com/in/derrichphillips/

Aspire Cyber website: https://www.aspirecyber.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e17&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Shauna recently retired from the federal government after serving more than 35 years in the federal acquisition / contracting space! During her career she served as chief of contracting, contracting officer representative, and as an advisor to the Civilian Agency Acquisition Council (CAAC).

She even has direct experience in the federal rulemaking process, and contributed to FAR case 2017-016, also known as the FAR CUI rule, which will contractually require the implementation of NIST SP 800-171 on federal contracts.

Join us as we pull back the curtain on the federal rulemaking process and more!

Here are some highlights from the episode:

• Shauna’s background
• Steps and roles involved in the federal rulemaking process
• What is a FAR case?
• What is OIRA’s role?
• The relationship between the FAR and DFARS
• How to provide effective public comments on regulations
• Impacts of FAR case 2017-16 - CUI rule
• Impacts of FAR case 2021-17 - Cyber Threat and Incident Reporting and Information Sharing regulation
• Impacts of FAR case 2021-019 - Standardizing Cybersecurity Requirements for Unclassified Information Systems

Follow Shauna on LinkedIn: https://www.linkedin.com/in/shauna-weatherly/

FedSubK website: https://www.fedsubk.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e16&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Michael has worked in government and cloud-based technology for over 20 years, and currently works at Deltek in the Product Strategy group and is the evangelist for cybersecurity compliance and cloud services!

Michael shares Deltek's perspective on security and compliance as a cloud service provider.

Here are some highlights from the episode:

• How Michael got into cybersecurity
• Deltek's government clouds
• DFARS 252.204-7012's C - G incident reporting requirements
• How cloud providers can demonstrate FedRAMP moderate equivalency
• What is a shared responsibility matrix
• The need for a defense focused CSP / ESP / MSP marketplace

Follow Michael on LinkedIn: https://www.linkedin.com/in/michael-greenman-94952a3/

Deltek website: https://www.deltek.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e15&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Thomas is the Vice President and CISO at Redspin, and Redspin is the first CMMC Third Party Assessor Organization (C3PAO)!

This episode has a lot of great information for the defense industrial base!Here are some highlights from the episode:

• Redspins' experience becoming the first C3PAO
• Notable changes in NIST 800-171 r3
• CMMC challenges and misconceptions
• Tips for selecting the right CMMC consultant and assessor
• Other countries interested in CMMC
• Each phase of the CMMC assessment process
• What CMMC practices can be POA&M'd according to current guidance
• And more!

Follow Thomas on LinkedIn: https://www.linkedin.com/in/tgrahamphd/

Redspin website: https://www.redspin.com

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e14&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Jacob Horne is Summit 7's Chief Security Evangelist, and has a unique genetic superpower that allows him to delve into NIST publications & government regulations without experiencing even a hint of boredom!

In the episode Jacob Horne explains the history leading up to the CMMC program, when CMMC may be required, and the significance of the FAR CUI rule!

Here are some key topics we discussed:

• How he started in cybersecurity
• The history leading up to CMMC
• What is rulemaking
• The two CMMC rules we are waiting on
• When CMMC may appear in contracts
• The FAR CUI rule and its importance
• Why DHS and VA regulations were silent on NIST 800-171
• When will the FAR CUI rule drop?

Follow Jacob on LinkedIn: https://www.linkedin.com/in/jacob-evan-horne/

Summit 7 website: https://www.summit7.us/

Jacob Horne's Deep dive on CMMC rulemaking timeline: https://www.youtube.com/watch?v=qyLDQxo-YPg

Federal Rulemaking book: https://www.amazon.com/Rulemaking-Government-Agencies-Write-Policy/dp/1483352811/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e13&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

In the episode Dr. Ross shares his thoughts on topics like ChatGPT, zero trust, his top 5 security controls, advice to folks new to cybersecurity, and much more!

Here are some key topics we discussed:

• Top challenges in federal cybersecurity compliance
• How to enable positive cybersecurity culture
• The missing strategic view in cybersecurity
• Zero Trust
• LLMs like ChatGPT
• The importance of managing complexity
• Dr. Ross's top 5 critical security controls
• Career advice to folks new to cybersecurity

Dr. Ross is the author of multiple publications including Risk Management Framework (RMF), NIST 800-53, NIST 800-171, and many more!

Dr. Ross leads the FISMA Implementation Project which includes the development of security standards and guidelines for the federal government, contractors, and the United States critical infrastructure.

He also leads the Joint Task Force, an interagency group that includes the DoD, U.S. Intelligence Community, and the Committee on National Security Systems, with responsibility for developing a unified information security framework for the federal government and its contractors.

Follow Ron on LinkedIn: https://www.linkedin.com/in/ronrossecure/

NIST CSRC Website: https://csrc.nist.gov/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e12&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

In the episode Dr. Ross shares a status update on NIST 800-171 revision 3. At the time of this recording, NIST has released the 1st initial draft, and the 1st public comment period has closed.

Here are some key topics we discussed:

• Notable changes in NIST 800-171 r3
• Thoughts on public comments
• Strategy on the ODPs
• Encryption (FIPS 140) control ODP
• Independent Assessment control
• Security Protection Assets
• Implementation examples

Dr. Ross is the author of multiple publications including Risk Management Framework (RMF), NIST 800-53, NIST 800-171, and many more!

Dr. Ross leads the FISMA Implementation Project which includes the development of security standards and guidelines for the federal government, contractors, and the United States critical infrastructure.

He also leads the Joint Task Force, an interagency group that includes the DoD, U.S. Intelligence Community, and the Committee on National Security Systems, with responsibility for developing a unified information security framework for the federal government and its contractors.

Follow Ron on LinkedIn: https://www.linkedin.com/in/ronrossecure/

NIST CSRC Website: https://csrc.nist.gov/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e11&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

In the episode Dr. Ross shares the fascinating history of NISTs involvement in cyber security!

Here are some key topics we discussed:

• How he started at NIST and the projects he has worked on
• NIST's and the Joint Task Force's Mission
• How he convinced the DoD to transition from DIACAP to RMF
• The history of continuous monitoring program
• The origins of NIST 800-171
• Why NIST did not adopt ISO 27001
• The goal of NIST 800-160

Dr. Ross is the author of multiple publications including Risk Management Framework (RMF), NIST 800-53, NIST 800-171, and many more!

Dr. Ross leads the FISMA Implementation Project which includes the development of security standards and guidelines for the federal government, contractors, and the United States critical infrastructure.

He also leads the Joint Task Force, an interagency group that includes the DoD, U.S. Intelligence Community, and the Committee on National Security Systems, with responsibility for developing a unified information security framework for the federal government and its contractors.

Follow Ron on LinkedIn: https://www.linkedin.com/in/ronrossecure/

NIST CSRC Website: https://csrc.nist.gov/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e10&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Joseph is the President of Secrabus Inc where he performs cybersecurity assessments on Oil & Gas companies to help elevate their security posture and protect their critical assets.

Joseph shares his experiences after more than 15 years in the Oil & Gas industrial control system (ICS) and OT cybersecurity space.

Here are some key topics we discussed:

• How he started in cybersecurity
• The just in time deliverability aspect of Oil & Gas
• IT and OT convergence
• Defense in depth architecture
• GRC Standards that apply to the Oil & Gas industry
• Purdue Model for ICS Security
• His risk assessment methodology
• Interesting stories
• And more!

Follow Joseph on LinkedIn: https://www.linkedin.com/in/josephloomis/

Secrabus Inc's Website: https://secrabus.com/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e9&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Jonathan shifted into the GRC field after 20 years in the military supporting aircraft maintenance, and explains how others can do the same!

Here are some key topics we discussed:

• What GRC is
• How he transitioned into GRC and cybersecurity
• How nontechnical folks can transition into cybersecurity by starting in a GRC role
• How most folks already have transferrable experience
• What GRC frameworks to focus on
• How to use LinkedIn to boost your career

Follow Jonathan on LinkedIn: https://www.linkedin.com/in/jonfisher11/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e8&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

She shares the impact of US and EU privacy laws on businesses, how they can plan to comply, and much more!

Here are some key topics we discussed:

• The importance of privacy laws
• Differences between EU and US approaches to privacy
• The impact of GDPR and why many consider it to be the gold standard in privacy laws
• Current and emerging state-level privacy laws in the US
• Implications of privacy laws for small businesses
• The importance of only collecting the information you need
• The status of the US's federal privacy law and how it compares to the GDPR
• How GRC compliance frameworks like NIST’s Privacy Framework and ISO 27001 can help comply

Donata's website: https://termageddon.com

Follow Donata on LinkedIn: https://www.linkedin.com/in/donata-stroink-skillrud/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e7&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Here are some of the topics we discussed:

• How she got to where she is today
• Common misconceptions businesses have about CMMC
• Who should take the CMMC Certified Professional (CCP) course
• Real world problems and solutions
• What is a CUI enclave?
• Addressing CUI data sprawl in a business
• Joint Surveillance Assessments
• Managing CMMC compliance like a project
• Hiring the right CMMC consultant
• Hiring the right CMMC assessor

Follow Koren on LinkedIn: https://www.linkedin.com/in/koren-wise/

Koren's website: https://www.wtinetworks.com

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e6&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Rick is an insurance broker and a CMMC Registered Practitioner, and he explains that not all cyber insurance policies are equal and the importance of working with an insurance broker that understands cybersecurity and your regulatory environment.

Here are a few of the topics we discussed:

• Overview of cyber insurance fundamentals
• Key roles in the cyber insurance process
• How underwriters assess a business's cyber risk
• Critical security controls underwriters want in place
• Benefits of compliance frameworks like NIST 800-171 and ISO 27001
• False Claims Act cyber insurance claim scenarios
• Getting the right coverage to support DFARS 252-204-7012 incident reporting

Follow Rick on LinkedIn: https://www.linkedin.com/in/rick-rosenberry/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e5&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Laura has established an excellent training program that guides North Carolina businesses in the creation of cybersecurity programs. The effort is in collaboration with the North Carolina Military Business Center, North Carolina State University, and other strategic partners.

Here are a few of the topics we discussed:

• Unique challenges faced by small businesses
• Concerns the government is not properly marking or is overmarking documents as CUI
• Importance of collaboration between technical and compliance teams
• Challenges that incident response presents to small businesses.

Follow Laura on LinkedIn: https://www.linkedin.com/in/lauradrodgers/

Cyber NC website: https://www.cybernc.us/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e4&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

RECAP enables peer cybersecurity assessments among electric utility cooperatives. Jon has conducted multiple RECAP assessments for co-ops throughout the US.

Jon tells us about how he started in cybersecurity, the history of electric cooperatives, how power grid cybersecurity is different, how OT and SCADA are used to enhance the reliability of the grid, notable power grid cyber incidents, and RECAP.

Follow Jon on LinkedIn: https://www.linkedin.com/in/jonrwatkins/

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e3&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

Eric's website: https://ericreedlive.com/

Follow Eric on LinkedIn: https://www.linkedin.com/in/ericreedlive/

Eric Reed is a master cybersecurity instructor with more than 30 years of IT experience! He has been teaching since 2005 and is a master at his craft.

Eric specializes in instructor led cybersecurity training for the following certifications:

• Certified Ethical Hacker (CEH)
• Computer Hacking Forensic Investigator (CHFI)
• Certified Security Analyst Certification
• Certified Network Defender
• CompTIA’s Security+
• Certified Information Systems Security Professional (CISSP)

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e2&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/

The NIST Cybersecurity Professional Program is designed to help organizations create a culture-driven, adaptive, cyber-resilient enterprise capable of creating, protecting, delivering digital business value, and how the NIST CSF can be used to help manage digital business risks and ensure improved governance.

Accredited through APMG International, assured through the UK’s National Cyber Security Centre (NCSC), and listed as qualified cyber training by Cybersecurity and Infrastructure Security Agency (CISA) in the USA, the NIST Cybersecurity Professional training program teaches individuals and organizations how to engineer, operationalize and continually improve a NIST CSF Program.

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e1&utm_campaign=courses

Need a FedRAMP authorized Password Manager?

Start a free 14-day trial of Keeper: https://grcacademy.io/ref/keeper/b2b-trial/

See the CMMC controls that Keeper meets: https://grcacademy.io/ref/keeper/cmmc-controls-sheet/