With the proliferation of so many information security standards, are we nearing a breaking point?
In the end, which standard will win?
In this episode, John Verry, Founder of Pivot Point Security, answers these questions and more in a guest appearance on the Encrypted Economy Podcast.
John covers: - The basics of CMMC - Why CMMC is the most significant standard in InfoSec’s history - Whether we are reaching a saturation point for security standards

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Let’s talk about the Cybersecurity Maturity Model Certification, or CMMC.   What is it, why should you care about it, and how do you know if it’s going to impact your business?
While the industry has always known that CMMC certification was going to move beyond the Defense Industrial Base (DIB,) we assumed it was going to likely be towards the end of 2021, likely into 2022 and 2023.   But it’s growing at lightning speed, and more and more businesses that previously didn’t think they were going to have to worry about it are suddenly finding themselves in a position of needing to start seriously considering it in order to keep the contracts that they have with a myriad of third parties.   In this episode of The Virtual CISO Podcast, host John Verry, CISO and Managing Partner at Pivot Point Security goes over everything involved in CMMC level 1 certification, and what businesses need to know to get ahead of the game.   John outlines: - What exactly is CMMC? - Why it’s hitting more companies than you may think - How your company can get CMMC ready -The time and resources needed to get CMMC certified   To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.   Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Manufacturing tends to resist new technology. Not aerospace, though. It's on the cutting edge.
In this episode of The Virtual CISO Podcast, John Virgolino, President/CEO at Consul-vation, Inc. & CEO at SENT, discusses what makes the aerospace sector different from technology and security perspective.
John discusses: - Why making security part of your culture is key - The security challenges facing aerospace companies - The trouble with government contracts - Reasons why you shouldn't look for a loophole in aerospace security compliance
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

In this episode of The Virtual CISO Podcast, host John Verry, CISO and Managing Partner at Pivot Point Security go over everything government staffing agencies need to know about CMMC Level 3 requirements.
John outlines: - How to tell if you have CUI in your environment - Whether your FCI can become CUI - If you need (or want) CMMC Level 3 compliance - The 3 steps to take when it comes to CMMC Level 3 compliance
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Keyword or phrase from headline
CMMC Level 3 government staffing

These days, everything is connected to the internet. Whether it’s your car, your light bulbs, your microwave, your pacemaker, or your cochlear implant, it’s all being run and dictated by the internet.
And with that brings a whole new set of concerns.
Where you used to just have to worry about keeping your bank account secure, or your home wifi network secure, now all of a sudden you have to worry about your car or your pacemaker being hacked?

How do we even go about categorizing all the IoT devices, and how do we protect them?

On this episode of Virtual CISO, I chat with Aaron Guzman, who in addition to being the Product Security Lead at Cisco Meraki, is also the Project Lead for the IOT Security Verification Standard (ISVS) at the OWASP Foundation. And if that wasn’t enough, he’s the author of a number of books on IoT, including IoT Penetration Testing Cookbook.
He was kind enough to talk about: - OWASP - What the ISVS is - Who ISVS is intended for - And, how ISVS is categorized
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Are you looking to get your product authorized for use by federal agencies?
Then you probably need to understand FedRAMP, how it works, and, most importantly, whether it applies to you.
In this episode, I chat with Stephen Halbrook, Partner and Government Compliance Specialist at Schellman & Co, who answers the most common questions about the government security assessment.
He answers: - What is FedRAMP and who does it apply to? - What is a typical timeline for the ATO process? - Should you go through JAB or an agency? - How much does it cost?
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Privacy is changing. Across the globe, new standards are recognizing it as a fundamental human right.
But between GDPR, CCPA, and all the other standards popping up, figuring out all your data privacy obligations can be quite the challenge.
That’s why I invited Dyann Heward-Mills, Lawyer and CEO of HewardMills, onto the show to discuss the challenges data privacy standards present — and how you can overcome them.
We discuss: - The history of data privacy - How to meet your privacy obligations - The role a Data Privacy Officer plays (and whether you need one)

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Getting your ducks in a row for a GRC audit can be a huge undertaking.
Especially when you get compliant for the audit, then don’t look at it again until the next one rolls around.
If this sounds familiar, you may have wondered whether investing in a GRC tool is worth it.
In this episode, Craig Unger, Founder and CEO at HyperProof, shares all the information you need to decide whether investing GRC is right for you.
What we talked about: - The challenges a GRC tool should address - Whether continuous compliance means continuous security - When you should implement a GRC tool

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

The DFARS interim rule that went into effect on November 30th has a lot of nuances to it — and many out there have questions about how it applies to them.
In this episode, I sit down with Corbin Evans, Principal Director, Strategic Programs at National Defense Industrial Association, to get answers to some of the most common questions about these CMMC nuances, including: - What do DIB orgs with a 7012 clause in their contracts need to do now? - What happens if you submit a low SPRS score? - What are the different types of CUI?
Check out this resource we mentioned during the podcast: - https://www.dodcui.mil/
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Should I migrate to GCC High? Do I have to? Are there alternatives?
If you’re a DIB member and you are using Office 365 — as so many do — reaching CMMC Level 3 compliance is going to force you to make some difficult decisions.
To help guide you through them, I invited Scott Edwards, President at Summit 7 Systems, onto the show to go over what CMMC Level 3 requires and how you can achieve it.
Scott explains: - The requirements for CMMC Level 3 compliance and what they mean for Office 365, G Suite, and in-house email companies - The process and expected costs of migrating to GCC High - How GCC High compares to alternatives

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.