Our Journey to CMMC Compliance

Emergency Podcast Episode 🚨 The 32 CFR Final Rule COMPLETED THE REVIEW PROCESS and things are heating up. We couldn't help but hop on the podcast and share this news and what it means for organizations and MSPs in the community.LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Let's get personal. Axiom has been on this CMMC journey for about 3 years now and we'd love to share our experience as an MSP and small business in the industry. In this episode, Bobby and Adam share how they got into this space and their fears and challenges going in. Bobby started Axiom over 20 years ago and the transition to a Level 2 Certified MSP has been challenging to say the least. They also share where they're at now and how they are supporting clients.LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

Let's talk about the CMMC Menu items. There are multiple ways that a business can tackle CMMC and we wanted to share with you 4 popular ways. In no way are we claiming these to be the only ways, but we do feel like these are the top four ways we've seen companies climb the mountain. Comment below if you have any questions or ideas on another way to climb. We'd love to hear!LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

(Season Two Episode 15) Bobby Guerra is joined by Jacob Hill, VP of cybersecurity at Alamo City Engineering Services and founder of GRC Academy. Jacob discusses the importance of education and training in the defense contractor industry. He shares his experience in implementing CMMC compliance and the challenges he faced in finding comprehensive education resources. Jacob explains the focus of his GRC Academy courses, including an overview course for practitioners and an awareness course for executives. He emphasizes the need for defense contractors to understand the requirements and implications of CMMC and advises against blindly following consultants without educating oneself.Axiom: https://www.axiom.tech/GRC Academy: https://grcacademy.io/Alamo Technologies: https://aces.biz/LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

In this conversation, Bobby is joined by Kyle Lai, President and Chief Information Security Officer at KL3. They discuss the challenges and considerations of CMMC compliance for organizations involved in software development. Kyle emphasizes the importance of selecting a C3PAO (CMMC Third-Party Assessor Organization) that understands the unique requirements of software development and can assess the organization effectively. Bobby and Kyle also highlight the need for scoping the software development process, identifying security protection assets, and defining the division of duties between IT and development teams. Kyle advises organizations to have a solid plan in place for managing software components, including vulnerability management and patching.LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

(Season Two Episode 13) In this episode, Bobby and Kaleigh discuss the Cost in their Let's Get Real Miniseries. They breakdown the cost into three categories: Scoping & Design, Implementation, and Maintenance. They are honest about their personal journey and costs of their CMMC track. Bobby explores Option A, which involves hiring and training internal staff, and Option B, which involves outsourcing to an external organization. They emphasize the importance of having a point of contact within the organization to work with the consultant and ensure the desired outcomes are achieved. LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

In this conversation, Bobby and Adam discuss the importance of being ready for an assessment and share their experiences with self-assessment. They highlight the need to have solid evidence and be able to demonstrate compliance with the controls and assessment objectives. They also emphasize the interconnectedness of controls and the importance of having evidence that covers multiple controls. They introduce a template they use for self-assessment and explain how it helps them track their progress and identify areas that need more focus. Overall, the conversation provides valuable insights and tips for organizations preparing for assessments.LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

If you're planning to get certified in the next two years and work with an MSP, you should ask them these questions. If you're an MSP/ESP providing services to companies aiming for certification, you should be prepared to answer these questions. It takes a company eight months to a year to become CMMC ready.Through this pointed and hard-hitting podcast episode, we aim to educate and challenge us all. Being an MSP helping clients on their CMMC path is serious business and a huge responsibility. This can't be solved with products or white labeling; it requires real people rolling up their sleeves and spending countless hours preparing not only to be certified themselves but also to embrace the duty of helping their clients do the same.LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

(Season 2 Episode 10) Bobby Guerra and Amira Armond discuss various cybersecurity challenges and solutions. They emphasize the need for strong physical defenses, proper training, and encryption when dealing with external media. They also highlight the importance of securing contractor-managed assets and implementing security measures across the entire network. It is critical for organizations to have a clear understanding of their entire network and the assets within it, even if they are not considered CUI assets. Lastly, Bobby and Amira have a discussion on the reporting requirements for cyber incidents in the defense contracting industry.LinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ

(Season 2 Episode 9) Alright Climbers, let's get real. We are ready to share our truth and honest opinions of our CMMC journey. Bobby and Kaleigh will be specifically breaking down the cost, resource, impact, and time. If you're interest in our journey and the things that we've learned along the way, make sure to tune in to this miniseriesLinkedIn: https://www.linkedin.com/in/bobbyguerra/Website: https://www.axiom.tech/YouTube: https://www.youtube.com/channel/UCaJagoDasNG3MqLqw2Af_ZQ