Climbing Mount CMMC

In this podcast episode, Bobby Guerra and Kaleigh Floyd discuss the challenges and implications of the CMMC (Cybersecurity Maturity Model Certification) ruling. They highlight the impact of the 32 CFR (Code of Federal Regulations) on organizations and vendors who need to meet the level two requirements. They emphasize that many companies were not intentionally misleading or non-compliant, but rather were caught off guard by the new ruling. The conversation explores the emotional and financial toll this has taken on businesses and offers recommendations for those navigating the CMMC process.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Fresh off the press! Bobby and Adam just completed a gap assessment done by a C3PAO and they want to share what they've learned with all of you. Here are the top 5 things that made their assessment so difficult. We hope you enjoy.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Emergency Podcast Episode 🚨 

The 32 CFR Final Rule COMPLETED THE REVIEW PROCESS and things are heating up. We couldn't help but hop on the podcast and share this news and what it means for organizations and MSPs in the community.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Let's get personal. Axiom has been on this CMMC journey for about 3 years now and we'd love to share our experience as an MSP and small business in the industry. In this episode, Bobby and Adam share how they got into this space and their fears and challenges going in. Bobby started Axiom over 20 years ago and the transition to a Level 2 Certified MSP has been challenging to say the least. They also share where they're at now and how they are supporting clients.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Let's talk about the CMMC Menu items. There are multiple ways that a business can tackle CMMC and we wanted to share with you 4 popular ways. In no way are we claiming these to be the only ways, but we do feel like these are the top four ways we've seen companies climb the mountain.

Comment below if you have any questions or ideas on another way to climb. We'd love to hear!

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

(Season Two Episode 15) Bobby Guerra is joined by Jacob Hill, VP of cybersecurity at Alamo City Engineering Services and founder of GRC Academy. Jacob discusses the importance of education and training in the defense contractor industry. He shares his experience in implementing CMMC compliance and the challenges he faced in finding comprehensive education resources. Jacob explains the focus of his GRC Academy courses, including an overview course for practitioners and an awareness course for executives. He emphasizes the need for defense contractors to understand the requirements and implications of CMMC and advises against blindly following consultants without educating oneself.

Axiom: https://www.axiom.tech/
GRC Academy: https://grcacademy.io/
Alamo Technologies: https://aces.biz/

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

In this conversation, Bobby is joined by Kyle Lai, President and Chief Information Security Officer at KL3. They discuss the challenges and considerations of CMMC compliance for organizations involved in software development. Kyle emphasizes the importance of selecting a C3PAO (CMMC Third-Party Assessor Organization) that understands the unique requirements of software development and can assess the organization effectively. Bobby and Kyle also highlight the need for scoping the software development process, identifying security protection assets, and defining the division of duties between IT and development teams. Kyle advises organizations to have a solid plan in place for managing software components, including vulnerability management and patching.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

(Season Two Episode 13) In this episode, Bobby and Kaleigh discuss the Cost in their Let's Get Real Miniseries. They breakdown the cost into three categories: Scoping & Design, Implementation, and Maintenance. They are honest about their personal journey and costs of their CMMC track. Bobby explores Option A, which involves hiring and training internal staff, and Option B, which involves outsourcing to an external organization. They emphasize the importance of having a point of contact within the organization to work with the consultant and ensure the desired outcomes are achieved. 

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

In this conversation, Bobby and Adam discuss the importance of being ready for an assessment and share their experiences with self-assessment. They highlight the need to have solid evidence and be able to demonstrate compliance with the controls and assessment objectives. They also emphasize the interconnectedness of controls and the importance of having evidence that covers multiple controls. They introduce a template they use for self-assessment and explain how it helps them track their progress and identify areas that need more focus. Overall, the conversation provides valuable insights and tips for organizations preparing for assessments.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

If you're planning to get certified in the next two years and work with an MSP, you should ask them these questions. If you're an MSP/ESP providing services to companies aiming for certification, you should be prepared to answer these questions. It takes a company eight months to a year to become CMMC ready.

Through this pointed and hard-hitting podcast episode, we aim to educate and challenge us all. Being an MSP helping clients on their CMMC path is serious business and a huge responsibility. This can't be solved with products or white labeling; it requires real people rolling up their sleeves and spending countless hours preparing not only to be certified themselves but also to embrace the duty of helping their clients do the same.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ