Climbing Mount CMMC

In this episode of Climbing Mount CMMC, Bobby and Kaleigh discuss the critical aspects of maintaining CMMC compliance after you pass your assessment. They cover maintenance activities, evidence gathering, and scaling strategies for MSPs and organizations to stay compliant and prepared for audits. NIST 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems Website: https://ww...

In this episode of Climbing Mount CMMC, Kaleigh and Bobby discuss the complexities of CMMC readiness and the importance of proper preparation for assessments. They share insights from their experiences as an MSP navigating the evolving cybersecurity landscape. Podcast episode -The Game of Chicken with Lawrence Cruciana: https://youtu.be/NffcMSVnKUM Podcast episode -The State of CMMC Today with Mat...

In this special episode of Climbing Mount CMMC, Bobby and Kaleigh discuss the intricacies of the CMMC ecosystem with Matt Travis, CEO of the Cyber AB. They explore the challenges, opportunities, and future strategies for MSPs, assessors, and small businesses navigating cybersecurity compliance. 32 CFR Final Rule : 2024-22905.pdf Cyber AB Website : CyberAB > Home Time Stamps: 00:00-02:14 Introdu...

In this episode of Climbing Mount CMMC, Bobby and Kaleigh provide an in-depth look at the CCP and CCA certifications, including preparation strategies, course insights, and industry perspectives. They discuss topics that target those aiming to understand the certification process, improve their skills, or help organizations prepare for assessments. Tara Lemieux Game: SECTOR 171 — The Assessor&apos...

In this Spelunking episode of Climbing Mount CMMC, Kaleigh and Adams dive into the key differences between NIST 800-171 Rev2 and Rev3, focusing on incident response requirements for CMMC compliance. They share insights on preparing for Rev3, emphasizing 03.06's incident handling, reporting, and training strategies. Link to NIST 800-171 Rev 3: https://nvlpubs.nist.gov/nistpubs/SpecialPublicati...

In this episode of Climbing Mount CMMC, Bobby and Kaleigh explore the recent updates and implications of "significant changes" in the CMMC assessment process, focusing on how organizations can navigate reassessments, change management, and the role of C3PAOs. Link to 32 CFR Final Rule:  Federal Register :: Cybersecurity Maturity Model Certification (CMMC) Program Link to FAQ:  CYBERSECUR...

In this episode of Climbing Mount CMMC, Kaleigh speaks with Axiom's compliance officer, Adam Evans, to explore the complexities of inheritance in the context of CMMC compliance, cloud service providers, and external service providers. They discuss how inheritance works, common misconceptions, and practical tips for organizations navigating compliance assessments. Link to the CMMC Assessment P...

In this episode of Climbing Mount CMMC, Kaleigh and Bobby dive into a deep discussion on the complexities and challenges of achieving CMMC Level 2 certification for MSPs and OSCs with Lawrence Cruciana. They share insights on shared responsibility, operational maturity, and "the game of chicken" played between organizations in the cybersecurity compliance landscape. Lawrence's Linke...

In this episode of Cyb-Her, Kaleigh shares with Axiom employee, Maleah Adams, her journey from call coordinator to COO, speaking on her experiences in the MSP and cybersecurity space, including her work and transition to the CMMC ecosystem and her perspective as a woman in a male-dominated industry. Website: https://www.axiom.tech/ YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ...

In this episode of Climbing Mount CMMC, Fernando Machado (CCA) from CyberSec Investments shares his extensive experience with Kaleigh and Bobby about the CMMC assessment process, the journey to becoming a C3PAO, and practical insights for contractors navigating the certification landscape. They discuss the phases of assessments, scoping mistakes, and how to prepare effectively. Fernando's Lin...

In this episode, Kaleigh and, new to Axiom, Ashton Guerra discuss the critical questions organizations seeking CMMC Level 2 certification (OSCs) should ask their MSPs. They share insights on scope, security measures, and the importance of transparency in the certification journey. Website: https://www.axiom.tech/ YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ Axiom's Linked...

In this new series we like to call "Spelunking", Bobby and Kaleigh explore the updates in NIST 800-171 Revision 3, focusing on the differences from Rev 2, including control changes, assessment objectives, and preparation strategies for compliance. In this episode, they focus on control 03.02 Awareness and Training. They give valuable insights for MSPs, organizations, and assessors prepar...

In the season 5 premiere of Climbing Mount CMMC, Kaleigh and Bobby share practical, boots-on-the-ground insights on implementing CMMC self-assessments, especially for MSPs supporting multiple clients. They break down how to approach self-assessments with the discipline of a formal audit, while still building a process that can scale. Website: https://www.axiom.tech/ YouTube: https://www.youtube.co...

In the season 4 finale of Climbing Mount CMMC, Kaleigh and Bobby share their extensive experience navigating the complexities of achieving CMMC Level 2 certification as an MSP. They discuss the importance of commitment, education, strategic planning, and the realities of scaling support for government contractors. Website: https://www.axiom.tech/ YouTube: https://www.youtube.com/channel/UCaJagoDas...

In this episode of Climbing Mount CMMC, Kaleigh and Bobby discuss the concept of grace within the CMMC framework, particularly focusing on the NIST 800-171 controls, the role of C3PAOs, and the importance of mock assessments. They emphasize the need for proper training and certification, the significance of daily reviews during assessments, and the opportunities provided by the 10-day remediation...

In this episode of Climbing Mount CMMC, Bobby and Adam discuss the implications of Rev3 for MSPs in the context of CMMC. They explore the challenges MSPs face in achieving compliance, the role of external service providers, and the importance of documentation and shared responsibilities. They highlight the evolving landscape of cybersecurity requirements and the necessity for MSPs to fully commit...

In this episode of Climbing Mount CMMC, Bobby and Adam discuss the intricacies of Plan of Action and Milestones (POAM) in the context of cybersecurity assessments. They explore the importance of having a clear understanding of what constitutes a POAM, the distinction between operational plans and assessment findings, and the necessity of being prepared for assessments to ensure compliance. The con...

In this episode of Climbing Mounts CMMC, hosts Kaleigh Floyd and Bobby Guerra discuss the five stages of grief related to the CMMC compliance journey. They share personal experiences and insights on denial, anger, bargaining, depression, and acceptance, emphasizing the importance of understanding these emotions as organizations navigate the complexities of CMMC compliance. The conversation highlig...

In this episode, Kaleigh Floyd, Bobby Guerra, and Adam Evans discuss the complexities surrounding Cloud Service Providers (CSPs) and Managed Service Providers (MSPs) in the context of CMMC compliance. They clarify the definitions, roles, and responsibilities of MSPs and CSPs, particularly in relation to handling Controlled Unclassified Information (CUI) and navigating FedRAMP requirements. The con...

In this episode, the hosts discuss the significant changes introduced in NIST 800-171 Rev 3, focusing on the transition from Rev 2 to Rev 3, the importance of Organizational Defined Parameters (ODPs), and the role of external service providers in compliance. They emphasize the need for System Security Plans (SSPs) to be living documents that adapt to evolving security needs and the necessity for c...

In this episode, Kaleigh and Bobby are joined by Axiom's own, Adam Evans, to discuss the significant changes introduced in NIST 800-171 Rev 3, focusing on the transition from Rev 2 to Rev 3, the importance of Organizational Defined Parameters (ODPs), and the role of external service providers in compliance. They emphasize the need for System Security Plans (SSPs) to be living documents that a...

In this episode, Kaleigh and Bobby discuss the complexities of managing Controlled Unclassified Information (CUI) within the framework of CMMC compliance. They explore the challenges of physical boundaries, the role of personnel in safeguarding CUI, and the implications of printing and disposing of sensitive information. The conversation also touches on the nuances of working from home, the import...

In this episode of "Climbing Mount CMMC," hosts Kaleigh Floyd and Bobby Guerra delve into the intricacies of preparing for a CMMC Level 2 assessment, particularly focusing on the role of external service providers (ESPs) and Managed Service Providers (MSPs). They emphasize the importance of selecting a provider who not only understands the CMMC requirements but has also successfully guid...

In this episode of Climbing Mount CMMC, hosts Bobby and Kaleigh discuss the critical topic of self-attestation for CMMC level two requirements. They explore the evolution of self-attestation, the risks associated with misrepresentation, and the importance of accountability in the self-assessment process. The conversation emphasizes the need for organizations to prepare adequately for self-attestat...

In this episode, Kaleigh and Bobby discuss the significant changes and challenges that companies will face in 2026 regarding CMMC compliance. They delve into the implications of new CMMC Level 2 requirements, the importance of self-assessments versus third-party assessments, and the potential consequences of non-compliance. The conversation also touches on the risks of false claims and whistleblow...