In this episode of Climbing Mount CMMC, hosts Kaleigh Floyd and Bobby Guerra delve into the intricacies of Customer Responsibility Matrices (CRMs) and their significance in CMMC compliance. They discuss the definition of CRMs, their importance in defining responsibilities between customers and service providers, and the essential components needed to create an effective CRM. The conversation emphasizes the need for clarity in responsibilities, the connection to NIST 800-171 controls, and the importance of understanding vendor relationships in the context of cybersecurity compliance.

Optic Cyber Solutions CRM Template: MSP-customer-responsibility-matrix-template 1.xlsx

Kelly Hood: (9) Kelly Hood | LinkedIn

Tom Conkle: (9) Tom Conkle | LinkedIn

Brian Hubbard: (9) Brian Hubbard | LinkedIn

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode of Climbing Mount CMMC, hosts Kaleigh Floyd and Bobby Guerra engage with Chris and Hannah Silvers, a father-daughter duo from CG Silver's Consulting. They discuss their journey in the cybersecurity field, the challenges and dynamics of CMMC, and the importance of community and collaboration in navigating this complex landscape. The conversation highlights the unique challenges faced by MSPs in adapting to CMMC requirements and the evolving nature of their business dynamics. The episode also touches on the intricacies of the sales process in CMMC consulting, emphasizing the need for education and understanding in client relationships. In this engaging conversation, Chris and Hannah Silvers, along with Kaleigh Floyd and Bobby Guerra, explore the intricacies of navigating the C3PAO landscape, the journey to certification, and the dynamics of working in a family business. They discuss the importance of confidence and growth in professional roles, generational perspectives in the workplace, and the empowerment that comes from experience. The conversation highlights the unique challenges and rewards of working in cybersecurity, particularly in the context of family relationships and mentorship.

CG Silvers Consulting website: https://www.cgsilvers.com/

Chris' LinkedIn: https://www.linkedin.com/in/cgsilvers/

Hannah's Linkedln: (15) Hannah Silvers | LinkedIn

CyberAB listing with contact information: https://cyberab.org/Member/C3PAO-198-Cg-Silvers-Consulting-Llc

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode, Kaleigh Floyd and Bobby Guerra discuss the critical issue of false starts in CMMC assessments, emphasizing the importance of proper documentation and preparation. They explore the phases of CMMC assessments, the consequences of failing to meet requirements, and the necessity of seeking help from consultants. The conversation highlights the significance of mock assessments and understanding the roles of external service providers in the assessment process. The hosts provide practical advice for avoiding false starts and ensuring a successful assessment journey.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode, Kaleigh and Bobby welcome back Kyle Lai to discuss the challenges and insights surrounding C3PAOs and the CMMC framework. They explore Kyle's journey into the C3PAO space, the current state of audits, and the importance of software development in compliance. The conversation highlights the need for collaboration between IT and software development teams, the significance of understanding controlled unclassified information (CUI), and the challenges faced during assessments. Kyle shares valuable insights on vulnerability management, the impact of open-source software, and strategies for leveraging existing platforms to ease compliance efforts. The episode concludes with a call for better communication and collaboration within organizations to ensure successful assessments and compliance.

Kyle's LinkedIn: https://linkedin.com/in/kylelai/
KLC Consulting: https://klcconsulting.net

Web Application Reference Architecture: https://acrobat.adobe.com/id/urn:aaid:sc:US:8bb4ebc1-8287-40af-8761-31bc035fa64c
KLC's Playbook for CMMC Assessors: https://acrobat.adobe.com/id/urn:aaid:sc:US:abd836d0-7eea-43e5-ae72-86d06197fc54
KLC's Software Security Principles Template and Related Resources:
https://klcconsulting.net/cmmc-resource-tools/

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode of CybHer, Kaleigh Floyd interviews Jil Wright, president of Wrightbrained Security, discussing her extensive experience in IT and the CMMC space. They explore the challenges of cybersecurity assessments, the importance of documentation, and the evolving role of women in the tech industry. Jil shares insights on the necessity of evidence in assessments, the significance of mentorship, and the need for companies to prepare adequately for CMMC compliance. The conversation highlights the importance of collaboration and the unique challenges faced by women in cybersecurity.

Jil's Linkedln: https://www.linkedin.com/in/itjil/ 

Wrightbrained Security: wrightbrainedsecurity.com 

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode of Climbing Mount CMMC, Kaleigh and Bobby discuss the 32 CFR final rule and its implications for contractors and subcontractors in the defense industry. They delve into the history and importance of Controlled Unclassified Information (CUI), the requirements for achieving CMMC compliance, and the significance of DFARS clauses. The conversation also covers the challenges of creating a System Security Plan (SSP), the importance of scoping, and the flow-down requirements for subcontractors. The episode emphasizes the urgency for contractors to prepare for CMMC assessments and the potential consequences of non-compliance.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode, Kaleigh Floyd interviews Kelly Hood from Optic Cyber Solutions, discussing her journey into the CMMC space, the challenges faced in consulting, and the importance of effective documentation. They explore the significance of the Customer Responsibility Matrix (CRM) and System Security Plan (SSP), as well as the NIST Cybersecurity Framework (CSF) and its connection to CMMC compliance. Kelly shares insights on navigating compliance requirements and the need for clarity in communication, emphasizing that while the journey may be complex, it is achievable with the right approach and mindset.

Optic Cyber Solutions: www.OpticCyber.com  

Kelly Hood LinkedIn: https://www.linkedin.com/in/kellyhoodoc/

Optic Cyber Solutions Customer Responsibility Matrix (CRM) Template: https://43828014.hs-sites.com/shared-responsibilities-matrix-srm-download

Optic Cyber Solutions CMMC L2 Progress Tracker: https://43828014.hs-sites.com/cmmc-l2-progress-tracker

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode, Bobby Guerra and Kaleigh Floyd discuss the evolving landscape of vendors in the CMMC space, focusing on the challenges and considerations for Managed Service Providers (MSPs) when integrating cloud solutions. They explore the implications of using tools like Huntress and Ninja One, the importance of compliance with regulations, and the role of auditors in ensuring data protection. The conversation emphasizes the need for thorough documentation, understanding the capabilities of tools, and the necessity of maintaining high standards to protect clients' interests.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this episode, Kaleigh Floyd and Bobby Guerra discuss the challenges and considerations for internal IT staff tasked with achieving CMMC compliance. They explore the importance of knowledge, leadership buy-in, and organizational maturity in successfully navigating the CMMC process. The conversation emphasizes the need for collaboration between internal teams and managed service providers (MSPs) to effectively implement necessary controls and policies. Additionally, they highlight the risks associated with non-compliance and the importance of legal counsel in ensuring proper adherence to regulations.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn

In this conversation, Bobby Guerra and Ryan Bonner discuss the evolving landscape of the CMMC ecosystem, focusing on the implications of a recent memo from the DOD. They explore the roles of program managers, the importance of understanding CUI, and the challenges faced by contractors and MSPs in achieving compliance. The discussion emphasizes the need for proactive strategies and the potential impact of these changes on the defense industrial base.

Ryan's CS2 Session: https://www.youtube.com/watch?v=IEy-TkmKMt8
Ryan's LinkedIn: https://www.linkedin.com/in/rybonner/

Key Takeaways:
-The recent DOD memo clarifies requirements for CMMC compliance.
-Program managers play a crucial role in determining CMMC levels for contracts.
-Understanding CUI is essential for contractors to navigate compliance.
-Subcontractors need to be proactive in understanding their CUI obligations.
-MSPs must prepare for increased demand for CMMC compliance services.
-The defense industrial base will see consolidation as a result of CMMC requirements.
-Organizations that adapt to CMMC will have a competitive advantage.

LinkedIn: https://www.linkedin.com/in/bobbyguerra/
Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ
Kaleigh's: (1) Kaleigh Floyd | LinkedIn