"Outread the others" - that's how Ryan Bonner mastered CUI.

If you're confused about Controlled Unclassified Information (CUI) - you're not alone. Many defense contractors (not to mention DoD themselves) misunderstand what is CUI, where it comes from, and how to handle it.

In this episode, Ryan Bonner, CEO of DEFCERT, gives a masterclass in understanding CUI from the actual laws and regulations - not just hearsay.

👉 Here are the highlights:

• What CUI really is - and what it’s not
• How to use the NARA and DoD CUI registries
• The proprietary paradox
• How to decontrol CUI
• The difference between FCI and CUI
• DoD memo on determining CMMC levels

This is essential listening for anyone working with the defense industrial base - primes, subs, and especially DoD program managers who want to avoid missteps.

What were your biggest takeaways? Let me know in the comments.

Follow Ryan on LinkedIn: https://www.linkedin.com/in/rybonner/

DEFCERT Website: https://defcert.com/

-----------

Thanks to our sponsor Vanta!

Get back time to focus on strengthening security and scaling your business.

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e7&utm_campaign=courses

#cui #cmmc

HR guy leads his company to CMMC level 2 certification! 👀

In this episode I’m joined by Eric Fields of Reynolds Construction to learn how he led his business to CMMC level 2 certification!

I call him "Eric the Great" - you'll see why in a moment.

Eric's background was in HR and business operations. He had no background in IT or cybersecurity.

They did it in-house - with just two people and smart choices.

👉 Here’s how they did it:

• CMMC training from GRC Academy
• Resources and advisory services from Kieri Solutions
• CCP & CCA training
• Meticulous documentation

This episode is very special to me - Eric's intro to CMMC was through GRC Academy more than 2 years ago, and he was actually the second person to leave a 5-star review on my CMMC training for defense contractors: https://grcacademy.io/course-reviews/cmmc-overview-training-eric-f-20230127/

This episode is a great reminder that small businesses can achieve CMMC certification without breaking the bank.

That said, time is no longer a luxury. With CMMC phasing in this summer, small businesses need to move fast - and partnering with a CMMC-focused MSP can help accelerate the process.

What were your biggest takeaways? Feel free to celebrate with "Eric the Great" in the comments!

Follow Eric on LinkedIn: https://www.linkedin.com/in/ericfields6/

Reynolds Construction Website: https://www.reynoldscon.com/

-----------

Thanks to our sponsor Vanta!

Get back time to focus on strengthening security and scaling your business.

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e6&utm_campaign=courses

#cmmc #nist #cybersecurity

CMMC rolls out in a few months and there are STILL companies who are JUST getting started!

In this episode I’m joined by Daniel Akridge of Summit 7 to talk about the real challenges facing the Defense Industrial Base - and the FASTEST path to CMMC certification.

To CUI Enclave, or not to CUI enclave - that is the question!

👉 Here are some of the highlights:

• What the big primes are saying about their subs and CMMC
• The biggest CMMC hurdles for defense contractors
• Why MOST DoD contracts could require CMMC Level 2 certification - not just self-attestation
• Deep dive into CUI enclaves and their pros and cons

I personally like CUI enclaves because it keeps government cybersecurity regulations and incident reporting requirements out of my corporate IT environment...

However if you are a small business that primarily supports the DoD, CUI enclaves begin to make less sense - even as I try to reason otherwise!

What were your biggest takeaways? Do you LUV CUI enclaves?? Let me know in the comments!

Follow Daniel on LinkedIn: https://www.linkedin.com/in/danielakridge/

Summit 7 Website: https://www.summit7.us/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e5&utm_campaign=courses

#cmmc #nist #cybersecurity

“We built a second company from scratch…”

Is that what it takes for MSPs to get CMMC'd!?! 👀

In this episode I’m joined by Bobby Guerra and Kaleigh Floyd from Axiom, an IT Managed Service Provider (MSP). They explain exactly what it took to achieve CMMC level 2 certification - after 4 years of effort.

Most MSPs aren’t ready for CMMC. Many believe it's just another checkbox, but it’s a complete operational shift that requires rethinking your tools, processes, and client relationships!

Here are some of the highlights:

• How much money they allocated for CMMC (it’s more than you think)
• How to build scalable and repeatable processes to support compliance
• The tools, contracts, and agreements you MUST have in place
• How to prepare for the assessment (and avoid sleepless nights!)

Bobby Guerra is the CEO of Axiom and has led the MSP for over 22 years. Under his leadership, Axiom became one of the first MSPs in the U.S. to achieve CMMC Level 2 Certification. Bobby now helps guide clients through their own CMMC journeys, focusing on sustainable security and compliance.

Kaleigh Floyd is the Marketing Director at Axiom and Co-Host of the Climbing Mount CMMC podcast. Raised in the MSP world, she now educates others through Microsoft 365 training and cybersecurity content. Her passion lies in simplifying tech and making a lasting impact in the industry.

This is a true CMMC for MSPs masterclass! So much great advice packed into this episode!

What were your biggest takeaways? Let me know in the comments!

Follow Bobby on LinkedIn: https://www.linkedin.com/in/bobbyguerra/

Follow Kaleigh on LinkedIn: https://www.linkedin.com/in/kaleigh-floyd-079a52190/

Axiom's Website: https://www.axiom.tech/

Climbing Mount CMMC Podcast: https://www.axiom.tech/climbing-mount-cmmc-the-podcast/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e4&utm_campaign=courses

#cmmc #nist #cybersecurity

Preparing for a CMMC assessment, but don't know what to expect?

Get ready to learn from CMMC Lead Assessor Fernando Machado as he explains EXACTLY what happens in each phase of the CMMC assessment process!

Fernando is the Managing Principal of Cybersec Investments which is an authorized C3PAO. Fernando has been involved with CMMC starting in 2020 as a member of the Cyber AB's Standards Management Industry Working Group.

Cybersec Investments has already issued 12 CMMC certifications since CMMC assessments began in January of 2025 and previously participated in nearly 20 Joint Surveillance Voluntary Assessments (JSVAs).

👉 Here are some highlights:

• What to expect during a CMMC assessment
• The 4-phases of the CMMC Assessment Process (v2.0)
• No self-assessment? No independent assessment
• Common issues that could cause assessment failures
• How to make the assessment easier for your assessor (and you)

It is overwhelming preparing for a CMMC assessment, but don't go into it without knowing what to expect!

What were your biggest takeaways? Let me know in the comments!

Follow Fernando on LinkedIn: https://www.linkedin.com/in/fernando-machado-cissp-cism-cca-ccp-5b5581124/

Cybersec Investments Website: https://cybersecinvestments.com/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e3&utm_campaign=courses

#cmmc #nist #cybersecurity

🔥 "I Could Have Saved $300K on CMMC!" 🔥

Miguel is the founder of Villa-Tech, a small but powerful tech company that is breaking into the defense contracting space.

Miguel shares a raw and honest look at the costly missteps, lessons learned, and strategies that could save small businesses hundreds of thousands of dollars preparing for CMMC certification!

👉 Here are some highlights:

• How he could have saved $300k
• Bad advice is expensive - how to hire the right consultants
• Rebuilding their SSP 4 times
• The importance of CMMC education before diving in

Villa-Tech has built a CUI enclave environment that other defense contractors can leverage! They also have an amazing set of capabilities and just achieved CMMC level 2 certification, so be sure to check out their capabilities statement below.

Small businesses CAN succeed in CMMC, but the path is filled with pitfalls that can drain your budget.

Don’t make the same mistakes - learn from someone who’s been through it!

What were your biggest takeaways? Let me know in the comments!

Follow Miguel on LinkedIn: https://www.linkedin.com/in/miguel-villarreal-0231286/

Villa-Tech Website: https://www.villa-tech.com

Villa-Tech Capabilities: https://villa-tech.com/government/capabilities-statement/

Structura.io Website: https://structura.io/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e2&utm_campaign=courses

#cmmc #nist #cybersecurity

CMMC and DFARS compliance is hard - especially in the cloud.

Got AWS? They've given you tools that make compliance much easier!

In this episode, I sit down with Travis Goldbach from Amazon Web Services (AWS) to break down the solutions AWS has created to simplify CMMC and DFARS compliance.

👉 Here are some highlights:

• AWS compliance automation - reducing manual effort and risk
• Shared Responsibility Model - what AWS secures vs. what you manage
• AWS GovCloud vs. Commercial Cloud - choosing the right environment
• Landing Zone Accelerator - your shortcut to a secure, compliant AWS setup
• How AWS is pursuing its own CMMC certification & what that means for you

I didn't know that AWS was so mature when it came to CMMC and DFARS compliance!

It was really awesome to learn how they are making compliance easier!

What were your biggest takeaways? Let me know in the comments!

Follow Travis on LinkedIn: https://www.linkedin.com/in/travis-goldbach-b446a223/

AWS CMMC website: https://aws.amazon.com/compliance/cmmc/

-----------

Thanks to our sponsor Vanta!

Need continuous visibility into the state of your security controls?

Discover the new way to GRC here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e1&utm_campaign=courses

#cmmc #nist #cybersecurity #aws

It’s been a long and wild ride on this #cmmc ship! ⛵

In this episode, I speak with Stacy Bostjanick who is the Director of the CMMC program at DoD CIO!

Here are some highlights from the episode:

• Expectations for the initial phase in of CMMC
• Who determines CMMC levels for contracts?
• How will CMMC waivers work?
• Criteria for CMMC level 2 self-assessments and CMMC level 3
• Early use of NIST 800-171 r3
• And so much more!

First mentioned in 2019, CMMC 1.0 was released in 2020 under the Trump administration.

CMMC 1.0 was reviewed during the Biden administration, they released CMMC 2.0 in late 2021, and then… There was a great silence.

If you threw a small rock, you’d hit ten people who thought CMMC was going away.

All this time though, the DoD was quietly marching on.

They released the proposed CMMC program rule in December 2023 and released the final CMMC program rule in October 2024 - which is now EFFECTIVE.

After all of that, CMMC will FINALLY begin to phase into DoD solicitations and contracts by this summer.

CMMC has been a LONG time coming, and it was an honor to hear the back story and why certain decisions were made!

What were your biggest takeaways? Let me know in the comments!

Follow Stacy on LinkedIn: https://www.linkedin.com/in/stacy-bostjanick-a3b67173/

DoD CIO CMMC website: https://dodcio.defense.gov/CMMC/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e43&utm_campaign=courses

#cmmc #nist #cybersecurity

Your MSP could be a CMMC disaster. 💥💣💥

I wish I was joking.

In this episode I speak with Joy Beland about the critical role IT Managed Service Providers (MSPs) play in the CMMC space and why so many of them will cause their clients to fail their CMMC assessments.

Here are some of the highlights:

• The NEW critical CMMC requirement for MSPs
• Why so many MSPs will cause their clients to fail CMMC assessments
• Why MSPs SHOULD still get CMMC certified
• Questions to ask your MSP to gauge their CMMC readiness

Joy is the Vice President of Cybersecurity Compliance at Summit 7 and brings over 20 years of experience as a former MSP owner. Summit 7 is a specialized MSP exclusively supporting defense contractors.

If you use an MSP, don't just assume that everything is OK and your MSP has it all covered.

It's highly likely that they do NOT and you'll FAIL your CMMC assessment because of them.

There are some great CMMC-focused MSPs out there, but the majority of MSPs have NO BUSINESS supporting defense contractors.

Choose wisely!

What stood out most to you? Whatever your thoughts are, feel free to let me know in the comments!

Follow Joy on LinkedIn: https://www.linkedin.com/in/joy-belinda-beland/

Summit 7 website: https://www.summit7.us/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e42&utm_campaign=courses

Should you NEVER pay after a ransomware attack?

In this episode I speak with Frank Riccardi about cybersecurity in healthcare and the event that triggered much more cyber accountability for the C-suite.

Here are some of the highlights:

• Why healthcare workers are prone to social engineering attacks
• Reasons you SHOULD and should NOT pay after ransomware attacks
• Managing shadow IT after acquisitions/mergers
• Why every member of the C-suite must understand cyber
• The importance of a culture of reporting

Frank is a former C-level executive with 25 years of experience developing compliance and privacy programs for large healthcare systems comprised of hospitals, physician practice groups, urgent care centers, and other healthcare organizations.

I really enjoyed Frank's description of shadow IT! I always thought of an employee who is using an unauthorized application, but I never thought of it from the standpoint of an acquisition/merger.

What stood out most to you? Whatever your thoughts are, feel free to let me know in the comments!

Follow Frank on LinkedIn: https://www.linkedin.com/in/frank-riccardi-261831b1/

Frank's Book (Mobilizing the C-Suite: Waging War Against Cyberattacks): https://www.amazon.com/Mobilizing-C-Suite-Waging-Against-Cyberattacks/dp/1637424248/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e41&utm_campaign=courses

#cybersecurity #healthcare #hospital #informationtechnology