Cyber Compliance & Beyond

Organizations often approach CMMC as a technology problem, but many assessment failures stem from foundational decisions made long before tools and configurations. In this episode, we break down the most common pitfalls we see in CMMC Level 2 assessments—from using non-compliant cloud environments to writing SSPs at the control level instead of the assessment-objective level, creating immediate and costly gaps. You will also learn about: Frequent implementation issues like inconsistent MFA, especially on critical security assets such as firewalls Why many risk assessments fall short because they are outdated, incomplete, or treated like control checklists rather than true threat evaluations. How to effectively work with MSPs and ESPs, including what a solid shared responsibility matrix should include. How assessors handle fixes during the assessment window and what qualifies under Security Requirement Reevaluation. This episode offers clear, practical guidance for any team preparing for CMMC Level 2—and looking to avoid the common false starts that derail assessments before they even begin.

Organizations chasing CMMC often jump straight to "what tech should we buy?" but scoping begins with people, policies, processes and how information actually flows across the business. In this episode offers Clear, candid guidance for any team wrestling with scope and architecture for CMMC and trying to do it right the first time.We walk through the real trade-offs between enclave vs. enterprise approaches, why enclave complexity can hurt day-to-day work, and where a hybrid model can make sense if you have the internal expertise (or the right MSP). We discuss practical criteria for selecting MSP/ESP partners, break down the 36-month assessment window, the kinds of environmental/business changes that might trigger reassessment, and explore NIST SP 800-171, Revision 3 readiness. Highlights: Start scoping with people, processes, and information flow—not the "shiny tech." Enclave vs. enterprise vs. hybrid: reduce user complexity, weigh operational realities and plan for 36 months. What to ask MSPs/ESPs: Level 2 status, shared responsibility matrix specifics, contract gaps, and insurance. Changes that can trigger reassessment and how proactive change control avoids surprises. Revision 3: prepare now; certification momentum on Revision 2 still pays dividends.

In this Q&A-style episode, we revisit the CMMC landscape following the implementation of the rule and the finalization of the Title 48 procurement rule. We break down what's changed, how CMMC requirements are phased into contracts and most importantly, the types of CMMC services available to help you take your next best step. We dive into boundary identification and definition, gap analysis/assessment, documentation support, readiness assessments, and formal Level 2 C3PAO assessments, along with key questions you should ask service providers to avoid confusion and unnecessary costs. Whether you're just starting out or preparing for assessment, this episode is designed to help you better navigate CMMC confidently and with clarity. References Episode 11 – CMMC Rollout Q&A Phased Implementation of CMMC (each one year in length) Phase 1: Level 1 and Level 2 self-assessments; possibility of Level 2 C3PAO Phase 2: Level 2 C3PAO for initial contract award; possibility of Level 3 and Level 2 C3PAO for option year awards Phase 3: Level 2 C3PAO for option year awards; Level 3 Phase 4: Level 3 and full implementation across all contracts Key questions to ask CMMC service providers Does the assessment allow me to still leverage you as a C3PAO? Does the assessment mimic a full formal assessment, including all evidence collection? This is important, as some only include interviews and live demonstrations, but do not include formal evidence gathering. Can I use evidence collected in one of these preparatory assessments during my formal assessment? Generally, the answer is yes, but a good rule of thumb is that the evidence shouldn't be more than 90 days old during a formal assessment. Do you offer a scoped preparatory assessment? Alternatively, you may want to only cover the controls for which a POA&M is not allowed. Ask if these are a possibility. They'll save you money, time, and give you the peace of mind you're looking for. Contact the Kratos CMMC team Cape Endeavors

There's no shortage of cybersecurity tools, but most compromises don't happen because of technology failures, they happen because of a failure in organizational processes. In today's episode, we explore how penetration testing and red teaming expose the people, processes and operational weaknesses that technology alone cannot. We discuss why security is ultimately a people problem, why organizations struggle to identify their own blind spots and how offensive testing reveals hidden vulnerabilities that technologies alone miss. In today's broad ranging episode, we cover the following: Penetration testing vs. red team engagements What a real red team assessment looks like Attack vectors that still work surprisingly well Interesting "ins" from the real-world The ongoing role of social engineering Custom tooling vs. off-the-shelf frameworks Staying current with attacker techniques Finding business-logic flaws automated tools miss The hardest parts of offensive security work Common organizational mistakes that create risk Making findings actionable for engineering teams Skills the next generation of operators should build Soft skills that matter in offensive security How AI and cloud are changing modern red teaming Underestimated attack surfaces Whether offense will always outpace defense

Waste, fraud, and abuse. These three words usually make headlines when government resources are misused on a massive scale. But the truth is, efforts to eliminate waste, fraud, and abuse extend far beyond the headline-grabbing cases. In this episode, our experts explore how the government combats waste, fraud, and abuse, and why cybersecurity is now front and center in the conversation. Over the past 40 years, federal agencies have increasingly relied on contractors, which has in turn increased the need for enforcement mechanisms to combat waste, fraud, and abuse. This episode goes over: The history and role of the False Claims Act How the Department of Justice's Civil Cyber-Fraud Initiative is using it to tackle cybersecurity-related fraud The unique role of whistleblowers, who gain both protections and incentives to report fraud A real-world use case that illustrates how enforcement plays out Practical strategies organizations can adopt to reduce their False Claims Act risk If your organization works with the federal government, this conversation is a must-listen. Resources: DOJ's False Claims Act website The False Claim Act (law)

The cyber workforce is as diverse as the challenges it faces. From process designers and behavioral analysts to business strategists and communicators, cybersecurity thrives on a diversity of skill sets. It's important to understand what it takes to join the field, especially given the current shortage of cybersecurity professionals. In today's episode, we're breaking down the misconception that cybersecurity is only for hackers and codebreakers. We'll dive into why soft skills like communications and organizational collaboration are just as essential as technical skills. We'll talk about how to break into the field. Spoiler alert: it's not as hard as you might think. On this episode, we discuss: Why the cyber workforce is broader than you might think How non-technical skills are critical in a technical field The importance of soft skills Why cybersecurity needs process thinkers, analysts, and business minds, too Today's guest is Mike Thompson. Mike brings a unique perspective to the table. Mike's experience spans recruitment, compliance sales, and cybersecurity assessments. His journey through the field offers great insight into the many ways professionals can contribute to cybersecurity without fitting the traditional mold. Links: FedRAMP's R311 Requirements CMMC: Ecosystem Professionals > Assessing and Certification

What are the real costs of cybersecurity implementation? Spoiler alert: it's far more complex than it appears on the surface. Cybersecurity is a people and process problem, not a technology problem. Most of implementation costs come in the form of time, effort and coordination throughout the organization. In this episode, we reach back to the classroom for a refresher on how to conduct effective risk analyses. Risk analyses –or risk assessments– are critical tools for guiding smart cybersecurity investments and decisions. They're the best tool for successfully navigating the intersection of business and cybersecurity. Whether you're a compliance professional, business leader or just curious about how cybersecurity aligns with real-world business needs, this episode is full of insights to help you think more strategically. A few highlights: Why the cost of cybersecurity is hard to measure – but why it's necessary Why many organizations struggle to properly conduct risk analyses How risk analyses help bridge the gap between business goals and cybersecurity priorities The importance of gaining executive buy-in for cybersecurity initiatives How to conduct a risk analysis Today's guests are Dr. T. Selwyn Ellis and Dr. Jae Ung (Jake) Lee. Dr. Ellis is the Balsley-Whitmore Endowed Professor in the College of Business at Louisiana Tech University. He is the Chair of the Department of Computer Information Systems and the Director for the Center for Information Assurance. He earned a Bachelor of Science with a double major in Mathematics and Computer Science, as well as an MBA from Mississippi College and DBA in Quantitative Analysis and Management Information Systems from Louisiana Tech University. He has published over forty articles in various academic journals including Communication of the ACM, IEEE Transactions on Professional Communication, and European Journal of Information Systems. His research is mainly in data analytics and behavioral aspects of information technology. Dr. Lee is an Associate Professor of Computer Information Systems in the College of Business, Louisiana Tech University. He earned a Ph.D. in Management Science and Systems from the State University of New York at Buffalo. His research interests include information security and privacy, emergency response, cloud computing, and telework. His research has appeared in European Journal of Information Systems, Information Systems Frontiers, and the International Journal of Information Management, among others.

Mobile devices have become an extension of ourselves, seamlessly integrated into our daily lives like never before. But as we prioritize convenience—wanting our devices to "just work"—we often overlook security. This episode dives into the growing cybersecurity challenges that come with mobile adoption and what individuals and organizations can do to stay protected. We'll go over: Why reliance on convenience creates security vulnerabilities (hint: it isn't primarily vulnerabilities in the technical sense, more in the human sense) Key technical and compliance components driving mobile device security Technologies organizations can leverage to balance security and usability Links: https://www.hypori.com/use-cases

The CMMC training and certification ecosystem is ambitious as it aims to support training material development and certification of both instructors and assessors. It is currently on a path to providing a strong foundation for CMMC as a whole. In this episode our cybersecurity experts dive into the details and nuances of the training and certification requirements in the CMMC ecosystem. Hear them define the terms, discuss the requirements, contrast CMMC training and certification with other compliance frameworks, grapple with challenges and finally address what lies ahead. Joining host Cole French is Joe Lissenden, CEO of Precision Execution, provider of CMMC training and certification services. Joe has more than 25 years of consulting, training, and auditing experience over a wide range of systems and standards. Reference material: Acronyms: APP: Approved Publishing Partner (formerly Licensed Publishing Partner) ATP: Approved Training Provider (formerly Licensed Training Provider) CCI: CMMC Certified Instructor (formerly Provisional Instructor) CAICO: Cybersecurity Assessor & Instructor Certification Organization CAP: CMMC Assessment Process CATM: CAICO Approved Training Material CCP: CMMC Certified Professional CCA: CMMC Certified Assessor OSC: Organization Seeking Certification RPO: Registered Provider Organization Links: Cybersecurity Assessor & Instructor Certification Organization (CAICO) CMMC Assessment Process (CAP)

CMMC's security requirements are not new. What is new about CMMC is the level of rigor. With the recent publication of the CMMC rule, DoD is ever closer to requiring contractors to comply with CMMC security requirements and back them up with an assessment. The CMMC Rule, like any new regulation, is packed with details. Details that have been rumored, speculated, and drafted. Now that they're known and final, we're here to help you see clearer. In today's episode, our host, Cole French becomes the expert guest. As Director of Cybersecurity Services and CMMC Capability Lead at Kratos, Cole answers all the questions you might still have about CMMC and its impact on your organization: · When will assessments start? · What can my organization do now? · When will CMMC be required in DoD contracts? · How does the rule impact my use of external service providers? · Can I qualify for a self-assessment or must I go through a C3PAO assessment? And more! Links: The Rule Kratos' CMMC Services Data Sheet DoD's CMMC Overview CMMC's New Rule Has Finally Arrived: 7 Key Takeaways to Help You Move Forward

Supply chain security is not new, though it certainly feels as though it is. Thanks to globalization, supply chains are ever growing in their depth, complexity, and interconnectedness. Unfortunately, like so many other systems, security of supply chains hasn't been at the top of the list of things to consider when evaluating supply chains. Understandably, economics led the way. A supply chain exists to foster economic growth and profit-making. None of these are bad but there's a painful irony: the less security is considered, the greater the costs, which drives down growth and profit-making. Costs aren't just financial, either. The cost of losing a competitive edge is significant but almost impossible to quantify in dollars. It runs much deeper. As data theft has proliferated on an unprecedented scale, the need for securing supply chains has begun it's rise to the top of our consciousness. The intriguing thing about supply chain security is that it isn't all that different than traditional risk management activities. Today's guest is John Santore, Director of Cybersecurity Services here at Kratos. Together, we'll dive into supply chain security. We'll outline what a supply chain is, what to consider when evaluating your supply chain, some of the challenges you might encounter along the way and we'll outline a basic supply chain risk management approach. Resources: The core tenants of a supply chain risk management approach: Inventory your supply chain Ensure strong relationships are in place with those in your supply chain Develop criteria for evaluating the risk of suppliers within your organization Work with your suppliers to obtain the information necessary to perform the evaluation Develop a process for scrutinizing suppliers that are identified as high-risk Repeat the process on a defined frequency Ensure that it is applied as part of any supplier intake Links: NIST SP 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations C-SCRM Factsheet NIST SP 800-218: Secure Software Development Framework Executive Order 14028 OMB M-22-18 OMB M-23-16

Vulnerabilities are everywhere and on every IT asset within an organization. This makes vulnerability management one of the most important – if not the most important – risk mitigation activities an organization undertakes. But, the complexities inherent in many organizations combined with the sheer number of vulnerabilities leaves many not knowing where to even begin when it comes to vulnerability management. On today's episode, we'll demystify vulnerability management by defining some context, outlining an effective vulnerabilities management program, discussing potential challenges, tying it all to compliance, and decoupling vulnerability management from the inherent complexities. Today's guest is Andrew Overmyer, Security Assessor, subject matter expert, and general cybersecurity jack-of-all-trades at Kratos. During our conversation, we distill this often-nebulous concept into the concrete tenets necessary to build an effective program to drive vulnerability remediation efforts. Resources: · The Core Tenets of Vulnerability Management o Asset Management: a tool or set of tools accompanied by a process that build and maintain an accurate asset inventory; an asset inventory must include but not be limited to network segments and IT assets across all types o Patch Management: a tool or set of tools accompanied by a process that supports identifying and applying patches o Vulnerability Scanning: a tool or set of tools accompanied by a process that support identifying vulnerabilities on IT assets; vulnerability scans must be run with credentials, to the greatest extent possible, to fully identify vulnerabilities present o Compliance Scanning: a tool or set of tools accompanied by a process that support identifying misconfigurations on IT assets; misconfigurations are deviations from a defined baseline (e.g., Center for Internet Security benchmarks) · Vulnerability Scanning Schedule o Daily: Asset scans to identify assets on the network; these are not vulnerability scans, but rather simple scans to identify assets on the network o Weekly: Vulnerability scans of all assets on the network o Monthly: Compliance scans of all applicable assets on the network · CVSS: Common Vulnerability Scoring System Version 4.0 · EPSS: Exploit Prediction Scoring System · SSVC: Stakeholder-Specific Vulnerability Categorization

Some recent estimates have postulated that data is now the world's most valuable asset. Unlike other assets, like oil, for example, data proliferates on a staggering scale. In other words, it doesn't seem to be finite, subject the law of scarcity. This hammers home the importance of answering the question that each of you are wrestling with: how do I protect all this data? A simple answer to this question is encryption. But any simple answer has you immediately asking more questions: what encryption should I use? How should I configure it? How can I be sure it is adequate? And, perhaps most interestingly, is it possible to future proof my data protection techniques? Today's guest is Evgeny Gervis, CEO of SafeLogic. SafeLogic, founded in 2012, is a leading cryptographic solutions provider. Their validated, holistic, and interoperable cryptographic solutions enable enduring privacy and trust in the ever-changing digital world. Used by many of the world's top technology firms, SafeLogic expedites and streamlines the adoption of FIPS 140-validated classical and post-quantum cryptography. Beyond simply using encryption to protect data, we dive into the intersection of compliance and encryption, specifically the role of the FIPS standard for encryption. While Evgeny provides technical expertise, I share some important compliance guidance and nuance we've learned from years of supporting our clients in evaluating FIPS 140 implementations. To close, Evgeny and I discuss the future of encryption, standards, and the likely effect of quantum computing.