Climbing Mount CMMC

We sat down with Dr. Ron Ross about his story and how he got to where he is today. He shares what his first job was out of the Army and his health battle while writing publications for NIST. His journey is incredibly inspiring, and we feel such gratitude to be able to share this with all of you. To hear about the man behind the publications, was something truly special. Website: https://www.axiom....

You can't have NIST SP 800-171 without the 800-53 that came before it. In today's episode, Bobby sat down with FedRAMP expert, Karen Stanford, to discuss the connection between the two publications and how you can use this to your advantage when preparing for an assessment. Many of the 800-171 controls can be traced back to 800-53 and it helps give more clarity to the requirements. We ho...

Today, Bobby and Kaleigh are joined by Dr. Ron Ross from NIST, an author of SP 800-172 and MUCH MORE. He shares the true purpose behind the document and what the new draft brings to the table. The draft was published on 11/13/24 and public comments are now being accepted until January of 2025. Website: https://www.axiom.tech/ YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ Axiom&...

In this podcast episode, Bobby Guerra, Kaleigh Floyd, and Vince Scott discuss the complexities of the Cybersecurity Maturity Model Certification (CMMC) and its phases. Vince shares his extensive background in cybersecurity, transitioning from offense to defense, and the challenges faced by small businesses in achieving compliance. The conversation delves into the realities of implementing CMMC sta...

In this conversation, Kaleigh Floyd, Bobby Guerra, and Adam Evans discuss the distinctions between Cloud Service Providers (CSPs) and other service providers (ESPs), the significance of Controlled Unclassified Information (CUI), and the importance of vendor assessments in the context of the 32 CFR rule. They delve into the necessary audits, risk management strategies, and the implications of secur...

Karen and Bobby dive into the complexities of cybersecurity audits, particularly focusing on the distinctions between CMMC and FedRAMP. They discuss operational challenges, the assessment processes, and the importance of recommendations in FedRAMP. The conversation also highlights misconceptions about FedRAMP, the implications of equivalency versus accreditation, and the future of cloud services i...

Are you an MSP navigating CMMC? Are you a contractor looking for the right MSP for your climb to CMMC? This episode is going to decipher the 32 CFR final rule with those to perspectives front-of-mind. Bobby and Kaleigh discuss the assessment requirements of an ESP, what inheritance is, and how an MSP can prepare to help their clients in the DIB space. Website: https://www.axiom.tech/ YouTube: http...

In this conversation, Bobby Guerra and Kaleigh Floyd discuss the recent release of the 32 CFR Final Rule and its implications for organizations. They explore the importance of self-assessments, the complexities involved, and the distinctions between different types of compliance measures such as enduring exceptions, operational plans, and temporary deficiencies.  The conversation also delves into...

32 CFR Final Rule! The time has come. We wanted to hop on a quick video, before Kaleigh hops on a plane, to talk about the 32 CFR FINAL RULE. We may or may not have recorded a 2 hour long podcast this week that we now have to cut…but we are back and ready to review the Final Rule. Phase extensions, SPD definitions, ESP requirements and more! Read it Here: https://public-inspection.federalregister....

Hello Climbers, let's get real about the resources needed on your climb of CMMC. Bobby and Adam discuss the people, tools, and more that it takes to accomplish CMMC Level 2 compliance. They explore the importance of having knowledgeable personnel, the role of Managed Service Providers (MSPs) and consultants, the challenges in finding certified MSPs, and the technology resources required for c...

In this engaging conversation, Jason Sproesser shares his journey into the CMMC space and the evolution of the Sum IT Up podcast. The discussion highlights the importance of community, vulnerability, and authenticity in the cybersecurity field, as well as the challenges faced by MSPs. Jason emphasizes the need for collaboration and the value of sharing experiences to help others navigate the compl...

In this podcast episode, Bobby Guerra and Kaleigh Floyd discuss the challenges and implications of the CMMC (Cybersecurity Maturity Model Certification) ruling. They highlight the impact of the 32 CFR (Code of Federal Regulations) on organizations and vendors who need to meet the level two requirements. They emphasize that many companies were not intentionally misleading or non-compliant, but rath...

Fresh off the press! Bobby and Adam just completed a gap assessment done by a C3PAO and they want to share what they've learned with all of you. Here are the top 5 things that made their assessment so difficult. We hope you enjoy. Website: https://www.axiom.tech/ YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ Axiom's LinkedIn: https://www.linkedin.com/company/axiomtech...

Emergency Podcast Episode 🚨  The 32 CFR Final Rule COMPLETED THE REVIEW PROCESS and things are heating up. We couldn't help but hop on the podcast and share this news and what it means for organizations and MSPs in the community. Website: https://www.axiom.tech/ YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ Axiom's LinkedIn: https://www.linkedin.com/company/axiomtech...

Let's get personal. Axiom has been on this CMMC journey for about 3 years now and we'd love to share our experience as an MSP and small business in the industry. In this episode, Bobby and Adam share how they got into this space and their fears and challenges going in. Bobby started Axiom over 20 years ago and the transition to a Level 2 Certified MSP has been challenging to say the leas...

Let's talk about the CMMC Menu items. There are multiple ways that a business can tackle CMMC and we wanted to share with you 4 popular ways. In no way are we claiming these to be the only ways, but we do feel like these are the top four ways we've seen companies climb the mountain.   Comment below if you have any questions or ideas on another way to climb. We'd love to hear! Websit...

(Season Two Episode 15) Bobby Guerra is joined by Jacob Hill, VP of cybersecurity at Alamo City Engineering Services and founder of GRC Academy. Jacob discusses the importance of education and training in the defense contractor industry. He shares his experience in implementing CMMC compliance and the challenges he faced in finding comprehensive education resources. Jacob explains the focus of his...

In this conversation, Bobby is joined by Kyle Lai, President and Chief Information Security Officer at KL3. They discuss the challenges and considerations of CMMC compliance for organizations involved in software development. Kyle emphasizes the importance of selecting a C3PAO (CMMC Third-Party Assessor Organization) that understands the unique requirements of software development and can assess t...

(Season Two Episode 13) In this episode, Bobby and Kaleigh discuss the Cost in their Let's Get Real Miniseries. They breakdown the cost into three categories: Scoping & Design, Implementation, and Maintenance. They are honest about their personal journey and costs of their CMMC track. Bobby explores Option A, which involves hiring and training internal staff, and Option B, which involves...

In this conversation, Bobby and Adam discuss the importance of being ready for an assessment and share their experiences with self-assessment. They highlight the need to have solid evidence and be able to demonstrate compliance with the controls and assessment objectives. They also emphasize the interconnectedness of controls and the importance of having evidence that covers multiple controls. The...

If you're planning to get certified in the next two years and work with an MSP, you should ask them these questions. If you're an MSP/ESP providing services to companies aiming for certification, you should be prepared to answer these questions. It takes a company eight months to a year to become CMMC ready. Through this pointed and hard-hitting podcast episode, we aim to educate and cha...

(Season 2 Episode 10) Bobby Guerra and Amira Armond discuss various cybersecurity challenges and solutions. They emphasize the need for strong physical defenses, proper training, and encryption when dealing with external media. They also highlight the importance of securing contractor-managed assets and implementing security measures across the entire network.  It is critical for organizations to...

(Season 2 Episode 9) Alright Climbers, let's get real. We are ready to share our truth and honest opinions of our CMMC journey. Bobby and Kaleigh will be specifically breaking down the cost, resource, impact, and time. If you're interest in our journey and the things that we've learned along the way, make sure to tune in to this miniseries Website: https://www.axiom.tech/ YouTube: h...

(Season 2 Episode 8) Koren Marie Wise, CEO of Wise Technical Innovations, and Bobby Guerra emphasize the importance of having a skilled and knowledgeable team, conducting thorough gap assessments, and understanding the flow of Controlled Unclassified Information (CUI). Koren also highlights the need for proper scoping, accurate network diagrams, and the right skill sets to ensure compliance with t...

In this conversation, Bobby Guerra, Adam Evans and Brian Hubbard discuss the challenges faced by MSPs in meeting compliance requirements, particularly in relation to the CMMC. They explore the concept of Joint Surveillance Voluntary Assessments (JSVAs) and the benefits they offer in terms of getting a jumpstart on certification. They also discuss the importance of MSPs staying engaged with the Def...