GRC Academy

🔥 "I Could Have Saved $300K on CMMC!" 🔥Miguel is the founder of Villa-Tech, a small but powerful tech company that is breaking into the defense contracting space.Miguel shares a raw and honest look at the costly missteps, lessons learned, and strategies that could save small businesses hundreds of thousands of dollars preparing for CMMC certification!👉 Here are some highlights:How he could have saved $300kBad advice is expensive - how to hire the right consultantsRebuilding their SSP 4 timesThe importance of CMMC education before diving inVilla-Tech has built a CUI enclave environment that other defense contractors can leverage! They also have an amazing set of capabilities and just achieved CMMC level 2 certification, so be sure to check out their capabilities statement below.Small businesses CAN succeed in CMMC, but the path is filled with pitfalls that can drain your budget.Don’t make the same mistakes - learn from someone who’s been through it!What were your biggest takeaways? Let me know in the comments!Follow Miguel on LinkedIn: https://www.linkedin.com/in/miguel-villarreal-0231286/Villa-Tech Website: https://www.villa-tech.comVilla-Tech Capabilities: https://villa-tech.com/government/capabilities-statement/Structura.io Website: https://structura.io/-----------Thanks to our sponsor Vanta!Need continuous visibility into the state of your security controls?Discover the new way to GRC here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e2&utm_campaign=courses#cmmc #nist #cybersecurity

It’s been a long and wild ride on this #cmmc ship! ⛵In this episode, I speak with Stacy Bostjanick who is the Director of the CMMC program at DoD CIO!Here are some highlights from the episode:Expectations for the initial phase in of CMMCWho determines CMMC levels for contracts?How will CMMC waivers work?Criteria for CMMC level 2 self-assessments and CMMC level 3Early use of NIST 800-171 r3And so much more!First mentioned in 2019, CMMC 1.0 was released in 2020 under the Trump administration.CMMC 1.0 was reviewed during the Biden administration, they released CMMC 2.0 in late 2021, and then… There was a great silence.If you threw a small rock, you’d hit ten people who thought CMMC was going away.All this time though, the DoD was quietly marching on.They released the proposed CMMC program rule in December 2023 and released the final CMMC program rule in October 2024 - which is now EFFECTIVE.After all of that, CMMC will FINALLY begin to phase into DoD solicitations and contracts by this summer.CMMC has been a LONG time coming, and it was an honor to hear the back story and why certain decisions were made!What were your biggest takeaways? Let me know in the comments!Follow Stacy on LinkedIn: https://www.linkedin.com/in/stacy-bostjanick-a3b67173/DoD CIO CMMC website: https://dodcio.defense.gov/CMMC/-----------Thanks to our sponsor Vanta!Want to save time filling out security questionnaires?Experience questionnaire automation here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e43&utm_campaign=courses#cmmc #nist #cybersecurity

Should you NEVER pay after a ransomware attack?In this episode I speak with Frank Riccardi about cybersecurity in healthcare and the event that triggered much more cyber accountability for the C-suite.Here are some of the highlights:Why healthcare workers are prone to social engineering attacksReasons you SHOULD and should NOT pay after ransomware attacksManaging shadow IT after acquisitions/mergersWhy every member of the C-suite must understand cyberThe importance of a culture of reportingFrank is a former C-level executive with 25 years of experience developing compliance and privacy programs for large healthcare systems comprised of hospitals, physician practice groups, urgent care centers, and other healthcare organizations.I really enjoyed Frank's description of shadow IT! I always thought of an employee who is using an unauthorized application, but I never thought of it from the standpoint of an acquisition/merger.What stood out most to you? Whatever your thoughts are, feel free to let me know in the comments!Follow Frank on LinkedIn: https://www.linkedin.com/in/frank-riccardi-261831b1/Frank's Book (Mobilizing the C-Suite: Waging War Against Cyberattacks): https://www.amazon.com/Mobilizing-C-Suite-Waging-Against-Cyberattacks/dp/1637424248/-----------Thanks to our sponsor Vanta!Want to save time filling out security questionnaires?Experience questionnaire automation here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e41&utm_campaign=courses#cybersecurity #healthcare #hospital #informationtechnology

SOC 2 isn't the only SOC out there! 🧦In this episode Cera Adams breaks down these SOC reports and what to expect in a SOC audit!Here are a few highlights from this episode:Why CPAs are involvedWhat SOC 1 / SOC 2 / SOC 3 reports mean to providers and consumersDifference between SOC 2 Type 1 and Type 2 reportsHow SOC scoping and audits workSOC consulting/audit independence requirementsCera is the Director of IT Assurance Services and leads OCD Tech's SOC 2 and IT Audit Practices. She has more than 20 years of experience in information security!I've spent most of my career working in the NIST cybersecurity space, so this was very interesting to me!I thought that the SOC 3 report was interesting, especially since many other frameworks don't have an equivalent.What were your takeaways? What is your best SOC pun? Let me know in the comments!Follow Cera on LinkedIn: https://www.linkedin.com/in/ceraadams/OCD Tech Website: https://ocd-tech.com/-----------Thanks to our sponsor Vanta!Want to save time filling out security questionnaires?Experience questionnaire automation here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e39&utm_campaign=courses#soc2 #cybersecurity #informationsecurity

Introducing the Penn State Whistleblower.In this episode, the whistleblower explains how he tried to stop Penn State from misrepresenting their NIST 800-171 compliance to the DoD and what he has faced since he blew the whistle!Whistleblower attorney Julie Bracker also shares what the media got wrong in this case and the latest on the Georgia Tech FCA case!Here are a few highlights from this episode:- Hear directly from the whistleblower in this False Claims Act case- What the media got wrong- Recommendations to universities- Advice for other whistleblowersMatthew Decker was the Chief Information Officer at the Applied Research Laboratory at Penn State from 2015 until 2023 and the interim Vice Provost and CIO responsible for all of Penn State from January 2016 until September 2016. Matthew currently serves as the Chief Data and Information Officer at NASA’s Jet Propulsion Laboratory since 2023.It was fascinating to learn that the university assumed compliance with their own AD95 security policy meant they were automatically compliant (at least to some measure) with NIST 800-171. This is a great reminder that the details always matter!Special thanks to Matt for sharing his story with us, and to Julie Bracker for coordinating this interview!Follow Julie on LinkedIn: https://www.linkedin.com/in/juliekeetonbracker/Bracker & Marcus LLC Website: https://www.fcacounsel.com/Connect with Matt on LinkedIn: https://www.linkedin.com/in/matt-decker-cio/Whistleblower's Handbook: https://www.amazon.com/New-Whistleblowers-Handbook-Step-Step/dp/1493028812/-----------Thanks to our sponsor Vanta!Want to save time filling out security questionnaires?Experience questionnaire automation here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e37&utm_campaign=courses#whistleblower #cmmc #cybersecurity

Is your MSP a cybersecurity liability?In this episode, I speak with Brian Hubbard, President of Evolved Cyber Solutions and the MSP Cybersecurity Exchange!We discuss the state of MSP cybersecurity and how MSPCyberX is elevating the security posture of MSPs everywhere!Here are some highlights:Why MSPs are so critical to our nation's securityThe inevitable regulations that will target MSPsMSPs involvement during CMMC assessmentsHow MSPCyberX can helpGRC Academy partnered with MSPCyberX early on to provide CMMC training to its members at a discount! It was great to hear about MSPCyberX's origin story!If your MSP is not a member of MSPCyberX, it is in your best interest that they join!Follow Brian on LinkedIn: https://www.linkedin.com/in/brian-scott-hubbard/Follow MSPCyberX on LinkedIn: https://www.linkedin.com/company/mspcyberx/MSPCyberX Website: https://www.mspcyberx.com/-----------Thanks to our sponsor Vanta!Want to save time filling out security questionnaires?Experience questionnaire automation here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e35&utm_campaign=courses

Want a high paying job in GRC? Want to build a powerful GRC team?In this episode, I spoke with Kenneth Moras, Security GRC Lead at Plaid.Kenneth has worked in critical GRC roles in big tech companies like Adobe and Meta! He was heavily involved in the cyber response to international regulators after severe breaches.Here are some highlights:What you need to do and know to get a job in GRCHow to master GRC3 critical skillsets you need in your cyber GRC teamHow regulatory incident response differs from traditional cyber incident responseKenneth is a true GRC master! His advice for folks wanting to get into GRC is the best I've heard! His tips on building successful GRC teams were excellent as well!What were your biggest takeaway? Do you agree that GRC teams need technical knowledge? Looking forward to your thoughts!Follow Kenneth on LinkedIn: https://www.linkedin.com/in/kennethmoras/Plaid Website: https://plaid.com/-----------Thanks to our sponsor Vanta!Want to save time filling out security questionnaires?Register for Vanta's webinar on Questionnaire Automation here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e33&utm_campaign=courses

Introducing the Georgia Tech Whistleblowers.In this episode, the whistleblowers explain how they tried to stop Georgia Tech from allegedly LYING to the government about their NIST 800-171 compliance and what they have faced since they blew the whistle!Whistleblower attorney Julie Bracker also shares what could come next and how much Georgia Tech may have to pay out!Here are a few highlights from this episode:Hear directly from the whistleblowers in this False Claims Act caseDetails on the "Fictitious" NIST 800-171 SPRS ScoreHow much money Georgia Tech might have to payRecommendations to universitiesAdvice for other whistleblowersBoth of the whistleblowers have a long history with Georgia Tech and truly care for the institution.Christopher Craig has worked at Georgia Tech for more than 20 years. He was the Associate Director of Cybersecurity where he managed all central cyber security personnel and built the GRC team until Georgia Tech demoted him to an Enterprise Security Architect.Kyle Koza worked at Georgia Tech for more than 15 years until he left his role as a Principal Information Security Engineer in 2022. He got his bachelor’s and master's degrees from Georgia Tech and also co-wrote and still teaches a security incident response master's degree course at the university.I thought Christopher's recommendation (24:37) for universities to centralize their labs was excellent!How can a university expect to maintain its NIST / CMMC compliance if multiple labs are built and managed by different teams who may not even be familiar with the NIST 800-171 security controls?I also loved hearing Chris tell us about the support he has received from the cyber community (38:00)! Who in cyber doesn't want to do the right thing? I would like to think those with bad intent are an extremely small percentage.Special thanks to Christopher and Kyle for sharing their stories with us, and to Julie Bracker for coordinating this interview!Follow Julie on LinkedIn: https://www.linkedin.com/in/juliekeetonbracker/Bracker & Marcus LLC Website: https://www.fcacounsel.com/-----------Thanks to our sponsor Vanta!Want to save time filling out security questionnaires?Register for Vanta's upcoming webinar on Questionnaire Automation here: https://vanta.com/grcacademy-----------Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e31&utm_campaign=courses