It’s been a long and wild ride on this #cmmc ship! ⛵

In this episode, I speak with Stacy Bostjanick who is the Director of the CMMC program at DoD CIO!

Here are some highlights from the episode:

• Expectations for the initial phase in of CMMC
• Who determines CMMC levels for contracts?
• How will CMMC waivers work?
• Criteria for CMMC level 2 self-assessments and CMMC level 3
• Early use of NIST 800-171 r3
• And so much more!

First mentioned in 2019, CMMC 1.0 was released in 2020 under the Trump administration.

CMMC 1.0 was reviewed during the Biden administration, they released CMMC 2.0 in late 2021, and then… There was a great silence.

If you threw a small rock, you’d hit ten people who thought CMMC was going away.

All this time though, the DoD was quietly marching on.

They released the proposed CMMC program rule in December 2023 and released the final CMMC program rule in October 2024 - which is now EFFECTIVE.

After all of that, CMMC will FINALLY begin to phase into DoD solicitations and contracts by this summer.

CMMC has been a LONG time coming, and it was an honor to hear the back story and why certain decisions were made!

What were your biggest takeaways? Let me know in the comments!

Follow Stacy on LinkedIn: https://www.linkedin.com/in/stacy-bostjanick-a3b67173/

DoD CIO CMMC website: https://dodcio.defense.gov/CMMC/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e43&utm_campaign=courses

#cmmc #nist #cybersecurity

Your MSP could be a CMMC disaster. 💥💣💥

I wish I was joking.

In this episode I speak with Joy Beland about the critical role IT Managed Service Providers (MSPs) play in the CMMC space and why so many of them will cause their clients to fail their CMMC assessments.

Here are some of the highlights:

• The NEW critical CMMC requirement for MSPs
• Why so many MSPs will cause their clients to fail CMMC assessments
• Why MSPs SHOULD still get CMMC certified
• Questions to ask your MSP to gauge their CMMC readiness

Joy is the Vice President of Cybersecurity Compliance at Summit 7 and brings over 20 years of experience as a former MSP owner. Summit 7 is a specialized MSP exclusively supporting defense contractors.

If you use an MSP, don't just assume that everything is OK and your MSP has it all covered.

It's highly likely that they do NOT and you'll FAIL your CMMC assessment because of them.

There are some great CMMC-focused MSPs out there, but the majority of MSPs have NO BUSINESS supporting defense contractors.

Choose wisely!

What stood out most to you? Whatever your thoughts are, feel free to let me know in the comments!

Follow Joy on LinkedIn: https://www.linkedin.com/in/joy-belinda-beland/

Summit 7 website: https://www.summit7.us/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e42&utm_campaign=courses

Should you NEVER pay after a ransomware attack?

In this episode I speak with Frank Riccardi about cybersecurity in healthcare and the event that triggered much more cyber accountability for the C-suite.

Here are some of the highlights:

• Why healthcare workers are prone to social engineering attacks
• Reasons you SHOULD and should NOT pay after ransomware attacks
• Managing shadow IT after acquisitions/mergers
• Why every member of the C-suite must understand cyber
• The importance of a culture of reporting

Frank is a former C-level executive with 25 years of experience developing compliance and privacy programs for large healthcare systems comprised of hospitals, physician practice groups, urgent care centers, and other healthcare organizations.

I really enjoyed Frank's description of shadow IT! I always thought of an employee who is using an unauthorized application, but I never thought of it from the standpoint of an acquisition/merger.

What stood out most to you? Whatever your thoughts are, feel free to let me know in the comments!

Follow Frank on LinkedIn: https://www.linkedin.com/in/frank-riccardi-261831b1/

Frank's Book (Mobilizing the C-Suite: Waging War Against Cyberattacks): https://www.amazon.com/Mobilizing-C-Suite-Waging-Against-Cyberattacks/dp/1637424248/

-----------

Thanks to our sponsor Vanta!

Want to save time filling out security questionnaires?

Experience questionnaire automation here: https://vanta.com/grcacademy

-----------

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform!

Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s1-e41&utm_campaign=courses

#cybersecurity #healthcare #hospital #informationtechnology