In episode 158 of Cybersecurity Where You Are, Sean Atkinson is joined by Andy Weidner, Product Manager at Nerdio, and Jason Ingalls, Chief Cybersecurity Officer at C3 Integrated Solutions. Together, they explore how organizations can navigate the complexities of Cybersecurity Maturity Model Certification (CMMC) compliance using automation, scalable infrastructure, and hardened cloud environments.

The conversation dives into the challenges faced by managed service providers (MSPs) and defense contractors, the importance of baking in security from the start, and how Nerdio’s platform acts as a force multiplier for compliance and operational efficiency. Jason shares a compelling anecdote from his time in a security operations center (SOC), illustrating the real-world stakes of cybersecurity and the origins of CMMC.

Here are some highlights from our episode:

• 00:44. Introductions to Andy and Jason
• 01:17. How to address common challenges of CMMC compliance
• 03:40. A real-world story of data exfiltration and its national security impact
• 08:34. How Nerdio and CIS Hardened Images® help organizations in their CMMC journey
• 12:15. Understanding the vision to scale configuration management
• 18:14. Strategy and automation as key elements to approaching CMMC Level 2
• 25:19. The value of baking scalability in vs. bolting it on
• 26:38. Segregation of duties as a means of pursuing dual-scope CMMC certification
• 29:22. Where to learn more about Nerdio and C3 Integrated Solutions

Resources

• Nerdio
• C3 Integrated Solutions
• CIS Hardened Images®
• How to Plan a Cybersecurity Roadmap in 4 Steps
• CIS Controls v8.1 Mapping to CMMC 2.0
• CIS Controls v8.1 Mapping to NIST SP 800-53 Rev 5
• CIS Controls v8.1 Mapping to NIST SP 800-171 Rev 3

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 157 of Cybersecurity Where You Are, Sean Atkinson sits down with Matthew Grieco, Cyber Incident Response Team (CIRT) Principal Analyst at the Center for Internet Security® (CIS®), and Dustin Cox, CIRT Analyst at CIS. Together, they explore the unpredictable world of cyber incident response. From ransomware investigations to digital forensics, the team shares how they adapt to evolving threats, leverage open-source tools, and collaborate to support state and local governments. The conversation highlights the mission-driven mindset that fuels their work and the importance of continuous learning, effective communication, and teamwork in cybersecurity. Here are some highlights from our episode:

• 00:44. Introductions to Matt and Dustin
• 01:20. Inside the typically untypical day of a CIRT analyst
• 05:33. Continuous learning and teamwork as ways to keep up with evolving threats
• 07:38. Inside the cybersecurity tooling used by CIRT to support state and local governments
• 14:51. How different skillsets on the team produce a unified incident response methodology
• 19:26. The work of a mission-driven team to uncover root causes for security incidents
• 25:52. An example of a case handled by Matt and Dustin
• 30:16. How CIRT assesses potential talent and looks for problem solvers

Resources

• Multi-State Information Sharing and Analysis Center®
• The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
• Episode 152: Driving Response Time While Enriching Telemetry
• Episode 126: A Day in the Life of a CTI Analyst
• Combatting Ransomware

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 156 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Stephanie Gass, Sr. Director of Information Security at Center for Internet Security® (CIS®), and Angelo Marcotullio, Chief Information Officer at CIS. Together, they explore how CIS practices what it preaches by using CIS products and services internally, which includes implementation of the CIS Critical Security Controls® (CIS Controls®) and CIS Benchmarks®, automation, and alignment to compliance frameworks. Their discussion highlights how CIS builds a strong cybersecurity foundation while adapting to evolving threats and regulatory requirements.

The conversation dives into practical applications, cultural alignment, and the importance of repeatable processes for scaling security across new products and services. It also touches on the role of privacy regulations, cyber risk quantification, and the community-driven approach that underpins CIS best practices. Here are some highlights from our episode:

• 01:12. Why CIS “drinks its own champagne” when it comes to cybersecurity
• 02:56. Three ways the CIS Controls help modern enterprises defend against threat actors
• 04:02. The importance of pulling together security lessons learned in a way that's translatable
• 10:03. Our use of the CIS Controls to align to SOC 2, ISO 27001, and other frameworks
• 12:01. How governance, risk, and compliance (GRC) engineering works with automation to help build repeatable processes
• 22:43. The role of collaboration and communication in building a cybersecurity program
• 27:17. Privacy regulations as a catalyst for security innovation
• 30:24. The CIS Community Defense Model and evidence-based practices
• 32:40. How CIS leverages lessons learned to improve our security best practices

Resources

• Episode 146: What Security Looks Like for a Security Company
• Implementation Guide for Small and Medium-Sized Enterprises CIS Controls IG1
• How to Construct a Sustainable GRC Program in 8 Steps
• Mapping and Compliance with the CIS Controls
• CIS Completes SOC 2 Type II Audit Using CIS Best Practices
• Episode 74: The Nexus of Cybersecurity & Privacy Legislation
• CIS Community Defense Model 2.0
• Episode 121: The Economics of Cybersecurity Decision-Making
• Episode 77: Data's Value to Decision-Making in Cybersecurity
• CIS Communities

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 155 of Cybersecurity Where You Are, Tony Sager is joined by John Gilligan, President and Chief Executive Officer (CEO) of the Center for Internet Security® (CIS®). Together, they reflect on 25 years of progress for CIS and look ahead to the future. They explore the driving forces behind "CIS 2.0," including the shift toward addressing multidimensional threats, expanding CIS’s audience, and leveraging tools driven by generative artificial intelligence (GenAI). Their discussion highlights how CIS is adapting to a new era while staying true to its mission-driven roots and foundational principles. Here are some highlights from our episode:

• 01:11. The need for a mission-driven nonprofit to support the role of government
• 04:28. Understanding the primary catalyst behind CIS 2.0
• 05:53. Multidimensional threats, expanded audiences, and revamped tools as adaptive opportunities
• 12:57. The challenge of linking technology risk to operational risk
• 13:45. How attackers tend to be more systems-level thinkers than defenders
• 15:50. Culture as a support system for navigating the evolving skills and processes of CIS 2.0
• 22:24. Collaboration, partnerships, mission focus, and culture as foundational CIS elements
• 31:11. How our engagement with state and local governments, thought leadership, and products and services will change going forward
• 40:47. Parting thoughts and an important reminder

Resources

• 25 Years of Creating Confidence in the Connected World
• Episode 119: Multidimensional Threat Defense at Large Events
• Strengthening Critical Infrastructure: SLTT Progress & Priorities
• Enhanced Cyber Resilience as a Secure Cyber City
• The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
• Episode 115: Continuous Feedback as CIS Employee Culture
• Episode 125: How Leadership Principles Influence CIS Culture
• CIS Culture
• CIS Communities
• Episode 97: How Far We've Come preceding CIS's 25th Birthday
• Why Whole-of-State Cybersecurity Is the Way Forward
• An Introduction to Artificial Intelligence
• Reasonable Cybersecurity

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 154 of Cybersecurity Where You Are, Sean Atkinson discusses incident response in DevSecOps, exploring challenges and solutions in modern software development. He emphasizes the importance of integrating security into development processes and speaks about common issues like alert fatigue and software supply chain vulnerabilities. Here are some highlights from our episode:

• 01:32. Common challenges with modern software development
• 03:54. High-speed and continuous deployment
• 07:08. Incident correlation with cloud deployment strategies
• 10:00. Software supply chain vulnerabilities
• 12:45. Alert fatigue and false positives
• 14:30. Testing and automation as enablers of real-time anomaly detection
• 17:40. The responsibility of incident responders to understand what they see
• 18:58. Automated control and a projectized approach to implementing zero trust
• 21:26. Oversight and governance with artificial intelligence and machine learning
• 23:24. Continuous improvement and early detection
• 28:08. Continuous monitoring and logging, automation, and incident response drills
• 30:03. Moving down a path of helping incident responders become culturally aware

Resources

• Cloud Security and the Shared Responsibility Model
• CIS Software Supply Chain Security Guide
• An Introduction to Artificial Intelligence
• Defense-in-Depth: A Necessary Approach to Cloud Security
• Episode 63: Building Capability and Integration with SBOMs
• Episode 44: A Zero Trust Framework Knows No End
• Leveraging Generative Artificial Intelligence for Tabletop Exercise Development

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 153 of Cybersecurity Where You Are, Sean Atkinson is joined by Jason Ashong, IT Support Specialist at the Center for Internet Security® (CIS®). Jason shares his journey from tinkering with tech as a kid to working in IT and pursuing cybersecurity research. The conversation covers education, mentorship, hands-on experience, and advice for newcomers entering the field. Here are some highlights from our episode:

• 01:10. Jason’s early days in IT of fixing devices and breaking things to learn
• 02:14. First professional IT/helpdesk experience at Dutchess Community College
• 03:48. The importance of mentors pushing you to grow
• 06:02. Jason’s advice to students of understanding foundational computing knowledge
• 08:45. The value of technical skills in networking, cryptography, and coding
• 11:00. Hands-on experience through labs, competitions, and research projects
• 16:08. Self-confidence, practice, and dedicated time as tips for navigating the job market
• 19:29. The role of attitude in opening up new opportunities
• 24:40. Jason flips the script and interviews Sean
• Mistakes to avoid when entering the field: imposter syndrome and perfectionism
• Cybersecurity as a path of continuous learning
• Opportunities for newcomers with experience in artificial intelligence and data science

Resources

• Episode 129: Embedding Cybersecurity in Project Management
• Episode 95: AI Augmentation and Its Impact on Cyber Defense
• Episode 44: A Zero Trust Framework Knows No End
• TryHackMe
• Hack The Box

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 152 of Cybersecurity Where You Are, Sean Atkinson is joined by Cliff Moten, Manager, Cybersecurity Solutions Engineering at the Center for Internet Security® (CIS®); and Richard Vargas, Security Operations Center Manager at CIS. Together, they discuss how the 24x7x365 CIS Security Operations Center (SOC) and CIS Managed Detection and Response™ (CIS MDR™) work together to accelerate response time while enriching telemetry. Here are some highlights from our episode:

• 01:40. Demystifying SOCs and MDR as cybersecurity concepts
• 02:52. How the CIS SOC works to provide information, context, and next steps for an event
• 05:04. Artificial intelligence and automation as ways to accelerate response time
• 10:20. Real-world instances where a fast response time made a difference
• 13:10. What it means to support underfunded organizations with the resources they need
• 17:22. The role of contextual cyber threat intelligence in accelerating response times
• 19:01. The value of security orchestration, automation, and response (SOAR) in helping defenders move quickly
• 27:33. Lessons that organizations can use to cut down on their incident response times

Resources

• The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity
• Episode 148: How MDR Helps Shine a Light on Zero-Day Attacks
• Episode 144: Carrying on the MS-ISAC's Character and Culture
• Episode 137: National Cybersecurity Through SLTT Resilience
• Combatting Ransomware
• Establishing Essential Cyber Hygiene
• CIS Community Defense Model 2.0

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 151 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager conclude their mid-year review of 12 Center for Internet Security® (CIS®) experts' cybersecurity predictions for 2025. Here are some highlights from our episode:

• 01:12. The importance of consolidating security operations and using what already exists
• 03:18. The promise of generative artificial intelligence (GenAI) in relieving grunt work
• 08:26. The great responsibility and burden of integrating GenAI into business operations
• 10:53. How control and inspection generate trust in systems
• 17:57. Post-quantum cryptography, IoT in edge computing, and GenAI's sociopolitical risks
• 30:21. The need for a more holistic understanding of compliance
• 33:34. Why zero trust doesn't mean "no trust"
• 36:56. The need for AI as an element of critical security control
• 41:33. The dynamic challenge of protecting all assets with varying levels of security

Resources

• 12 CIS Experts' Cybersecurity Predictions for 2025
• Episode 145: 2025 Cybersecurity Predictions H2 Review — Pt 1
• Episode 135: Five Lightning Chats at RSAC Conference 2025
• Establishing Essential Cyber Hygiene
• Episode 95: AI Augmentation and Its Impact on Cyber Defense
• Guide to Asset Classes: CIS Critical Security Controls v8.1
• An Examination of How Cyber Threat Actors Can Leverage Generative AI Platforms
• An Introduction to Artificial Intelligence
• Episode 120: How Contextual Awareness Drives AI Governance
• Episode 118: Preparing for Post-Quantum Cryptography
• Episode 63: Building Capability and Integration with SBOMs
• Episode 99: How Cyber-Informed Engineering Builds Resilience
• Mapping and Compliance with the CIS Controls
• Mapping and Compliance with the CIS Benchmarks
• CIS Community Defense Model 2.0

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 150 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Chad Rogers, Sr. Manager, Digital Media Services, at the Center for Internet Security® (CIS®); Rudy Uhde, Video Editor at CIS; and David Bisson, Sr. Content Strategist at CIS. Together, they use a roundtable chat to celebrate 150 episodes of Cybersecurity Where You Are. Here are some highlights from our episode:

• 01:33. How the cybersecurity landscape and podcast have changed since Episode 100
• 05:40. The "labor of love" that goes into editing and preparing an episode for publication
• 12:13. Memorable guests and moments that changed the team's thinking about cybersecurity
• 25:45. How the larger podcast team drives continuous improvement and innovation
• 30:13. Parting thoughts for the audience

Resources

• Episode 100: Celebrating 100 Episodes and Looking Ahead
• Episode 149: Human Error, AI Missteps, and Other VM Risks
• Episode 9: Mitigating Risk: Information Security Governance
• Episode 96: Making Continuous Compliance Actionable for SMBs
• Episode 121: The Economics of Cybersecurity Decision-Making
• Episode 114: 3 Board Chairs Reflect on 25 Years of Community
• Episode 136: How WiCyS Advances Women in Cybersecurity
• Episode 120: How Contextual Awareness Drives AI Governance
• Episode 116: AI-Enhanced Ransomware and Defending Against It
• Episode 146: What Security Looks Like for a Security Company
• Episode 110: How Security Culture and Corporate Culture Mesh

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 149 of Cybersecurity Where You Are, Sean Atkinson is joined by Chris McCullar, Director of Sales, Cloud Security, at the Center for Internet Security® (CIS®); and Mishal Makshood, Sr. Cloud Security Account Executive at CIS. Together, they discuss how to navigate human error, artificial intelligence (AI) missteps, and other landmarks in a new frontier of virtual machine (VM) risks. Here are some highlights from our episode:

• 00:50. Introductions with Chris and Mishal
• 02:20. The ongoing need to address the risk of human error when configuring VMs
• 04:55. The value of building trusted security into a VM image by design
• 07:28. A reality check of what the shared responsibility model means to an organization
• 13:06. How the integration of AI into DevOps accelerates both automation and mistakes
• 15:21. The importance of a secure foundation in the cloud on which you can build with AI
• 18:19. Automated enforcement and AI's role in complementing human judgment
• 21:03. Two examples how CIS resources can drive governance and policy integration
• 28:05. Cybersecurity as a community-driven team sport
• 30:33. Lifecycle management as a way of addressing organizations' security needs

Resources

• Keep the Cloud Secure with CIS after Migrating to the Cloud
• Automated Compliance: The Byproduct of Holistic Hardening
• Meet the Shared Responsibility Model with New CIS Resources
• Episode 135: Five Lightning Chats at RSAC Conference 2025
• 2025 Data Breach Investigations Report

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].