You can't have NIST SP 800-171 without the 800-53 that came before it. In today's episode, Bobby sat down with FedRAMP expert, Karen Stanford, to discuss the connection between the two publications and how you can use this to your advantage when preparing for an assessment. Many of the 800-171 controls can be traced back to 800-53 and it helps give more clarity to the requirements. We hope you enjoy today's episode!

Karen's LinkedIn: (2) Karen Stanford | LinkedIn

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

Today, Bobby and Kaleigh are joined by Dr. Ron Ross from NIST, an author of SP 800-172 and MUCH MORE. He shares the true purpose behind the document and what the new draft brings to the table. The draft was published on 11/13/24 and public comments are now being accepted until January of 2025.

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

In this podcast episode, Bobby Guerra, Kaleigh Floyd, and Vince Scott discuss the complexities of the Cybersecurity Maturity Model Certification (CMMC) and its phases. Vince shares his extensive background in cybersecurity, transitioning from offense to defense, and the challenges faced by small businesses in achieving compliance. The conversation delves into the realities of implementing CMMC standards, the importance of incident response, and the future implications of these regulations on businesses. They explore the phases of rollout, the importance of self-assessments, and the risks associated with not being certified. The discussion also highlights the capacity issues that may arise as the certification process unfolds and emphasizes the need for proactive measures to ensure compliance and readiness.

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

In this conversation, Kaleigh Floyd, Bobby Guerra, and Adam Evans discuss the distinctions between Cloud Service Providers (CSPs) and other service providers (ESPs), the significance of Controlled Unclassified Information (CUI), and the importance of vendor assessments in the context of the 32 CFR rule. They delve into the necessary audits, risk management strategies, and the implications of security protection data versus security protection assets for contractors and subcontractors in the defense industry.

They discuss the importance of selecting the right vendors for compliance, emphasizing the need for vendors to be prepared and knowledgeable. The conversation also highlights the ongoing nature of compliance, stressing that businesses must continually assess and update their practices.

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

Karen and Bobby dive into the complexities of cybersecurity audits, particularly focusing on the distinctions between CMMC and FedRAMP. They discuss operational challenges, the assessment processes, and the importance of recommendations in FedRAMP. The conversation also highlights misconceptions about FedRAMP, the implications of equivalency versus accreditation, and the future of cloud services in relation to these frameworks.

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

Are you an MSP navigating CMMC? Are you a contractor looking for the right MSP for your climb to CMMC? This episode is going to decipher the 32 CFR final rule with those to perspectives front-of-mind.

Bobby and Kaleigh discuss the assessment requirements of an ESP, what inheritance is, and how an MSP can prepare to help their clients in the DIB space.

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

In this conversation, Bobby Guerra and Kaleigh Floyd discuss the recent release of the 32 CFR Final Rule and its implications for organizations. They explore the importance of self-assessments, the complexities involved, and the distinctions between different types of compliance measures such as enduring exceptions, operational plans, and temporary deficiencies. 

The conversation also delves into the differences between Cloud Service Providers (CSPs) and External Service Providers (ESPs), providing insights into how organizations can navigate these new regulations effectively. Kaleigh and Bobby discuss FedRAMP requirements, the importance of understanding inheritance in compliance frameworks, and the recent changes in certification requirements for CCPs and CCAs.

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

32 CFR Final Rule!

The time has come. We wanted to hop on a quick video, before Kaleigh hops on a plane, to talk about the 32 CFR FINAL RULE. We may or may not have recorded a 2 hour long podcast this week that we now have to cut…but we are back and ready to review the Final Rule.

Phase extensions, SPD definitions, ESP requirements and more!

Read it Here: https://public-inspection.federalregister.gov/2024-22905.pdf

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

Hello Climbers, let's get real about the resources needed on your climb of CMMC. Bobby and Adam discuss the people, tools, and more that it takes to accomplish CMMC Level 2 compliance.They explore the importance of having knowledgeable personnel, the role of Managed Service Providers (MSPs) and consultants, the challenges in finding certified MSPs, and the technology resources required for compliance. The discussion emphasizes the significance of scoping, data flow, and security considerations, as well as the preparation needed for assessments and audits.

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

In this engaging conversation, Jason Sproesser shares his journey into the CMMC space and the evolution of the Sum IT Up podcast. The discussion highlights the importance of community, vulnerability, and authenticity in the cybersecurity field, as well as the challenges faced by MSPs. Jason emphasizes the need for collaboration and the value of sharing experiences to help others navigate the complexities of cybersecurity compliance. 

Website: https://www.axiom.tech/
YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Axiom's Linkedln: https://www.linkedin.com/company/axiomtech/

Bobby's Linkedln: https://www.linkedin.com/in/bobbyguerra/

Kaleigh's Linkedln: https://www.linkedin.com/in/kaleigh-floyd-079a52190/