Episode 7

full
Published on:

26th Oct 2026

CMMC Compliance: 14 Lessons From a Level 2 Assessment

We were scheduled for six days of CMMC Level 2 assessment. We finished in four. Here are the 14 lessons that made it possible, most of them decided weeks before the assessor arrived.

This is for owners and executives in the defense industrial base working toward CMMC compliance with NIST 800-171. I cover how CUI scope decides your cost, what documentation actually survives scrutiny, the Excel cheat sheet that saved us two days, how to show up during prove-it week, and what to do when you disagree with your assessor.

I also cover the current pause: DFARS 7012, NIST 800-171, and your SPRS score didn't go away, and primes and DIBCAC can still require proof.

If you're a business executive looking for an independent strategy advisor, apply for a 30-minute call at https://titanof.tech.

Watch the video version: https://youtu.be/n4BSJXGUWvU

---

Independent fractional CIO for owners of $5M to $50M businesses. Technology and cybersecurity strategy, with no tools to sell, no commissions, and no conflict.

Work with me: https://titanof.tech

LinkedIn: https://www.linkedin.com/in/johnbarker78/

Transcript
Speaker:

John Barker (2025): The CMMC assessment was scheduled for six

Speaker:

days, 9:00 to 5:30, six days straight.

Speaker:

We finished in four days.

Speaker:

Four shortened days, 9:00 to 4:00, plus about two hours that bled

Speaker:

into day five, and we skipped the end-of-day debrief after the first

Speaker:

day because there was really nothing that we needed to debrief on.

Speaker:

I'm going to tell you exactly what made that possible.

Speaker:

Most of it wasn't in the tactical controls at all.

Speaker:

It was in decisions we made weeks before the assessor ever showed up.

Speaker:

And I'm also gonna tell you about the one argument we lost that I think

Speaker:

was probably still wrong So here are 14 things I took out of a CMMC

Speaker:

Level 2 certification assessment that we passed with a perfect score.

Speaker:

Most of them I don't know if we would've known going in until you've

Speaker:

actually experienced it yourself.

Speaker:

So hopefully this helps shortcut it for you.

Speaker:

First thing you're going to ask about, as I record this, the CMMC

Speaker:

assessment rollout is paused.

Speaker:

That's real.

Speaker:

What is not paused is the legal requirement to still be

Speaker:

compliant with all the controls.

Speaker:

DFAR 7012 didn't go away.

Speaker:

NIST 800-171 didn't go away.

Speaker:

Your SPRS score didn't go away.

Speaker:

And two things can still put you in front of an assessment regardless of the pause.

Speaker:

Your prime can require one contractually because primes flow down CUI whenever

Speaker:

they decide they need to, and the DIB-CAC, the Defense Industrial

Speaker:

Base Cybersecurity Assessment Center, can assess you directly.

Speaker:

So the pause changed the government's default gate.

Speaker:

It didn't change who can ask you to prove it.

Speaker:

Nobody knows what the program's gonna look like when the pause lifts.

Speaker:

Could happen any day now as I record this.

Speaker:

What I can tell you is what the process actually felt like

Speaker:

from the inside, because that part is unlikely to change much

Speaker:

So lessons one through three, who are you actually hiring?

Speaker:

Lesson one, the C3PAO is the organization.

Speaker:

The assessor is the person.

Speaker:

Those are not the same thing, and the difference matters

Speaker:

more than anyone tells you.

Speaker:

You can hire the same C3PAO as a partner business or come in

Speaker:

through a referral and still get a materially different experience.

Speaker:

The level of scrutiny can vary.

Speaker:

The methodology varies.

Speaker:

Two assessors, the same firm, same controls, different depth of questioning.

Speaker:

That's not really a knock on any of them.

Speaker:

It's the reality of an assessment ecosystem that's this young.

Speaker:

Lesson two, there's a good chance your assessor is an independent

Speaker:

contractor affiliated with the C3PAO and not a full-time employee of it.

Speaker:

This is publicly known.

Speaker:

It's how the cyber AB ecosystem is structured, and

Speaker:

you'll notice it in practice.

Speaker:

Our assessor regularly needed to go back to the parent company

Speaker:

on questions that they had.

Speaker:

A practical takeaway, when you get a ruling you don't like, understand

Speaker:

that the person delivering it may not be the person who sets the standard.

Speaker:

That shapes how you push back, which we'll get into a little bit later.

Speaker:

Lesson three, you have more than one C3PAO person involved, and they may rotate.

Speaker:

Your main assessor is there throughout.

Speaker:

A lead assessor may dip in and dip out of the meetings as they feel needed

Speaker:

to, and there may be other C3PAO reps who come in and come out as well.

Speaker:

So don't be thrown out by new faces midweek, and don't assume everybody

Speaker:

in the room has your full context.

Speaker:

Some of them are just joining cold, and they'll never say a word

Lesson four:

scope is the lever.

Lesson four:

Lesson four, and this is the highest leverage decision on this entire list.

Lesson four:

You determine your CUI boundary, not the assessor.

Lesson four:

The smaller you keep your CUI scope, the less you have to manage during

Lesson four:

the assessment, and the less you have to maintain forever afterwards.

Lesson four:

Every system inside that boundary is a system you document,

Lesson four:

control, monitor, and defend.

Lesson four:

Every system outside of it is not.

Lesson four:

So think about what that means.

Lesson four:

The decision that most determines your assessment cost and your ongoing

Lesson four:

compliance cost for years gets made before an assessor is ever in the

Lesson four:

room, and it usually gets made by whoever happens to be handling the

Lesson four:

technical work as a technical decision.

Lesson four:

It isn't a technical decision.

Lesson four:

It's a business decision about where the work actually happens and

Lesson four:

where CUI actually needs to travel.

Lesson four:

Get it wrong, and you'll pay for it every year

Lesson four:

Lesson five, pay for a pre-assessment.

Lesson four:

That typically will cover your three and five-point control documentation.

Lesson four:

It does cost several thousand dollars.

Lesson four:

I know that sounds like a lot until you look at what a real assessment

Lesson four:

runs, sixty to seventy thousand and up depending on your environment.

Lesson four:

What a pre-assessment buys you, of course, is not a passing grade.

Lesson four:

It buys you the answer to a question you can't answer yourself.

Lesson four:

Am I approaching this environment and this documentation the way

Lesson four:

an assessor expects to see it?

Lesson four:

You can be genuinely secure and still be documenting it in a way

Lesson four:

that doesn't survive scrutiny.

Lesson four:

better to learn that for a few thousand dollars than to learn it in a week one

Lesson four:

of a sixty thousand dollar engagement

Lesson four:

So lesson six and seven, documentation.

Lesson four:

Lesson six, explicitly address the control in your policy

Lesson four:

document explicitly in words.

Lesson four:

Here's the example that made this land for us, split tunnel DNS.

Lesson four:

You can have every technical control correctly configured.

Lesson four:

It can be genuinely verifiably locked down.

Lesson four:

But if your policy doesn't contain a sentence that says, "This company

Lesson four:

does not permit split tunnel DNS," you may be trending toward not met.

Lesson four:

Literally a, what, five sentence, five-word sentence I know how that sounds.

Lesson four:

The thing is actually secure, but the sentence is missing, so it's a finding.

Lesson four:

Kind of feels like theater, but it isn't entirely.

Lesson four:

The assessor is verifying that the organization made a decision, not

Lesson four:

that an engineer made a configuration.

Lesson four:

A config can be changed by anyone with access to it on a Tuesday.

Lesson four:

A policy statement is the organization committing to a specific position.

Lesson four:

That's the difference between security and compliance, and

Lesson four:

you need to be fluent in both.

Lesson four:

So when you write policy, walk the control text and make sure

Lesson four:

the words in your documents map to the words in the requirement.

Lesson four:

Don't make the assessor infer your intent Lesson seven: Rely on your

Lesson four:

documentation and not your memory.

Lesson four:

Depending on the size of your environment, there is no version of this where

Lesson four:

you're going to remember everything.

Lesson four:

You will be asked about a control you configured eight months ago.

Lesson four:

You'll be asked about a decision someone else made.

Lesson four:

If your answer is, "I'm pretty sure we handled that," you

Lesson four:

have already lost the exchange.

Lesson four:

Write everything down.

Lesson four:

That's the entire job before the assessment, and use that as a

Lesson four:

reference to walk them through it as they pick their, specific order.

Lesson eight:

The cheat sheet.

Lesson eight:

Lesson eight is the one I'd put money on being the reason

Lesson eight:

we finished two days early.

Lesson eight:

Build a control cheat sheet.

Lesson eight:

Ours was just in a simple Excel file.

Lesson eight:

Every control, 3.11,

Lesson eight:

straight through the end, and against each one, the exact location in our

Lesson eight:

documentation that addressed it.

Lesson eight:

Document the name, the section, so you know exactly where to go

Lesson eight:

look for it when you're asked.

Lesson eight:

Depending on your environment, you may have hundreds of pages of

Lesson eight:

documentation, so when an assessor asks about a specific control, you

Lesson eight:

don't wanna be hunting for 10 minutes.

Lesson eight:

You want to open the right document to the right section

Lesson eight:

in as few seconds as possible.

Lesson eight:

Two things about how we built it.

Lesson eight:

We built it independent of the assessment schedule because we didn't

Lesson eight:

have the schedule until right before the assessment was going to occur,

Lesson eight:

and we built it near the end, once the documents were relatively stable, and we

Lesson eight:

were just doing final polish and review.

Lesson eight:

Building it earlier means rebuilding it every time a document changes.

Lesson eight:

That's it.

Lesson eight:

That's the whole trick, just a spreadsheet.

Lesson eight:

Six days scheduled, four days actual, and the the cheat sheet is the biggest

Lesson eight:

single reason why we finished so early

Lesson eight:

So that's the first half, and it's the first half that matters most.

Lesson eight:

Scope, documentation, and knowing where your own evidence lives.

Lesson eight:

If that layer is the one nobody at your company owns, that's the gap.

Lesson eight:

I'll come back to it.

Lesson eight:

For now, the second half.

Lesson eight:

Here's what happens once the assessment actually starts and how

Lesson eight:

to not talk your way into a finding

Lesson eight:

Lessons nine and ten, structure and schedule.

Lesson eight:

Lesson nine, our assessment ran in two working stages.

Lesson eight:

The first stage was a document review, which was about a day and a half.

Lesson eight:

If gaps came up, we got an end of the day debrief.

Lesson eight:

And here's an important detail.

Lesson eight:

The assessor cannot coach you on how to fix it.

Lesson eight:

They can tell you what's deficient.

Lesson eight:

They can't tell you how to remediate it.

Lesson eight:

That's the independence line in their role, and you need to expect it because

Lesson eight:

the instinct when someone identifies a gap is to say, "Well, how do you fix it?

Lesson eight:

How do you close it?"

Lesson eight:

They can't actually answer that question.

Lesson eight:

The second stage was the long one, the prove it to me, show it to me stage, and

Lesson eight:

that's where the six days were budgeted in the second phase of the assessment.

Lesson eight:

Lesson ten, the assessor builds the schedule and picks the order

Lesson eight:

of control groups, not you.

Lesson eight:

You will not get to sequence this by what you feel most ready for.

Lesson eight:

Assume every group is up first.

Lesson eight:

And if you've done the pre-assessment, you should be able to go through

Lesson eight:

those much faster because it'll be the second time around and it

Lesson eight:

should be with the same assessor Lessons 11 and 12, how you show up.

Lesson eight:

Lesson 11, keep the number of voices small.

Lesson eight:

We had five people on our side, but we had one designated main speaker

Lesson eight:

who was the main rep from the client I was working with who was that speaker.

Lesson eight:

Everyone else was there to support, not to narrate.

Lesson eight:

think of it like single voicing a proposal.

Lesson eight:

Multiple voices produce inconsistency, contradictions, and volunteered

Lesson eight:

information nobody asked for.

Lesson eight:

One voice produces a coherent record.

Lesson eight:

Have your specialist present and available.

Lesson eight:

Bring them in deliberately when a question needs them, and you will need them, but

Lesson eight:

one person leads the charge when answering the questions at first from the assessor.

Lesson eight:

Lesson twelve, be ready for both evidence formats, screenshots and

Lesson eight:

configuration exports and live screen shares walking through the console.

Lesson eight:

We did all of it.

Lesson eight:

there was no clear rhyme or reason to which one got asked for.

Lesson eight:

Also worth knowing, ours was fully remote.

Lesson eight:

We did not require an on-site visit from the assessor.

Lesson eight:

That's going to be very company specific, and it depends on your environment,

Lesson eight:

so don't assume that either way.

Lesson eight:

That actually didn't come up in this particular case, I think until actually

Lesson eight:

the assessment started when it was, did they need to decide to come out or not?

Lesson eight:

And they said no Now lesson 13, the disagreement.

Lesson eight:

Lesson 13, you are allowed to push back politely but genuinely.

Lesson eight:

This framework is still young, and it may change again, obviously,

Lesson eight:

with this pause going on, which is probably just going to probably affect

Lesson eight:

the assessment process is my guess.

Lesson eight:

when you've questioned on something you believe is out of scope, just say so,

Lesson eight:

and if you and the assessor can't resolve it, ask the lead assessor to step in.

Lesson eight:

That's part of that person's role.

Lesson eight:

They kind of acted like referee during those situations.

Lesson eight:

here's ours, and I'll tell you upfront that we lost.

Lesson eight:

It was with regarding our office Wi-Fi.

Lesson eight:

Our position was that CUI lived only in an approved cloud environment with

Lesson eight:

access controls, in place around it, and therefore, which network connection

Lesson eight:

an authorized device used to reach that environment was immaterial to that data.

Lesson eight:

We had so many controls in place that were validated, and if government

Lesson eight:

uses them, it shouldn't matter.

Lesson eight:

We lost that one.

Lesson eight:

I still think we were right on the security merit, But here's

Lesson eight:

what that argument taught me, and it's the same reminder as

Lesson eight:

that split tunnel DNS sentence.

Lesson eight:

You still have got security and compliance that are two different things.

Lesson eight:

you can be correct about the risk and still lose the compliance argument

Lesson eight:

because compliance is assessing conformance to a written requirement,

Lesson eight:

not the elegance of your risk reasoning.

Lesson eight:

But feel free to push back anyway.

Lesson eight:

Some of these you may win, and there was definitely times where we probably

Lesson eight:

should-- could have pushed back on some others, but nobody wins the ones

Lesson eight:

that you don't raise a question about.

Lesson eight:

Just go in knowing which game you're playing at any given moment, and they will

Lesson eight:

do their best to explain why they think they're correct as well, of course Now

Lesson eight:

the safety net and what does it cover?

Lesson eight:

So one more thing you should know before you walk into this because

Lesson eight:

it changes how you handle a finding.

Lesson eight:

There is a mechanism for correcting limited deficiencies

Lesson eight:

during the assessment.

Lesson eight:

It applies to 52 of the 110 requirements, the ones DoD classifies as having

Lesson eight:

limited or indirect effect on security.

Lesson eight:

Note that how that mechanism reaches you depends entirely on your C3PAO.

Lesson eight:

We never once heard the program's official terminology for it Ours ran it through

Lesson eight:

a corrective action report on their own internal quality form with a defined

Lesson eight:

window that we needed to resolve it

Lesson eight:

That's lesson one showing up again.

Lesson eight:

The allowance is standardized.

Lesson eight:

The paperwork, the naming, the exact window you get are the C3PAOs.

Lesson eight:

So ask early what their correction process is and how long you get,

Lesson eight:

rather than assuming a number you read on somebody's blog.

Lesson eight:

Practically, this is your safety net for the kind of thing I described earlier.

Lesson eight:

You had split tunnel DNS correctly managed, you just

Lesson eight:

never wrote the sentence.

Lesson eight:

Fixable inside that window, and it'll take two minutes to do it, or maybe 15 when you

Lesson eight:

go through your change management process.

Lesson eight:

What it doesn't cover is the heavier requirements, your three

Lesson eight:

and five-point controls, they cannot go on a POAM, and there are

Lesson eight:

other six, level two requirements that can also never go on a POAM.

Lesson eight:

Just go look those up.

Lesson eight:

one of those is three dot one dot 20, external connections.

Lesson eight:

It is worth a single point in the scoring model, but it's still

Lesson eight:

not something you can defer.

Lesson eight:

I'm gonna make a whole video about that one, and it's the best example I have of

Lesson eight:

the scoring model and the risk model kind of not agreeing to each other and actually

Lesson eight:

trying to, identify exactly what, external connections mean in a cloud-based world.

Lesson eight:

So lesson 14, and this is the one that nobody probably says.

Lesson eight:

It's the last one.

Lesson eight:

Here you go.

Lesson eight:

It's free.

Lesson eight:

This process is very boring.

Lesson eight:

Six days of methodically proving that you do the thing you say you do in the

Lesson eight:

document where you said you'd do it.

Lesson eight:

It's not dramatic.

Lesson eight:

If you've done it right, it's not interesting.

Lesson eight:

Talking about CMMC is very boring.

Lesson eight:

Doing CMMC is even more boring, but you gotta buckle up and power through.

Lesson eight:

The tedium is not a sign that something's wrong.

Lesson eight:

The tedium is that the process is working, that you've done your job, that you've not

Lesson eight:

run into very many hiccups or road bumps or over-explanations or sitting there for

Lesson eight:

30 minutes trying to find a document that you know that you have actually written.

Lesson eight:

So if I can press all of that into one thing, almost everything that

Lesson eight:

determined how that assessment went was decided before the assessor showed up.

Lesson eight:

How tightly we scoped the CUI boundary, what was the CUI workflow within the

Lesson eight:

organization, where the policy language actually addressed the controls,

Lesson eight:

whether we could find our own evidence in 10 seconds instead of 10 minutes.

Lesson eight:

None of that's engineering work.

Lesson eight:

All of that is the kind of decision that needs somebody who understands

Lesson eight:

the business, not just the network.

Lesson eight:

If nobody at your company owns that layer, the business decisions, the

Lesson eight:

documentation, the scope, that's the gap worth closing, not during the assessment

Lesson eight:

'cause you're gonna be guaranteed to fail.

Lesson eight:

You gotta do that way ahead of time So two things.

Lesson eight:

I've made a separate video on 3.1.20

Lesson eight:

external connections, the one point control that still can't go on a POAM

Lesson eight:

because it's the cleanest example I've found of the scoring model

Lesson eight:

and the risk model disagreeing.

Lesson eight:

That one's linked below, and if you want this layer owned before the

Lesson eight:

assessor is in the room, hit me up on LinkedIn, that's where I actually

Lesson eight:

work through this with owners, or go check out https://titanof.tech

Lesson eight:

and schedule a 30-minute call and I'll let you know if you need a

Lesson eight:

fractional CIO, fractional CISO, and be able to help you out.

Lesson eight:

I'm John Barker, be the titan over your tech.

All Episodes Previous Episode

Listen for free

Show artwork for Titan of Tech

About the Podcast

Titan of Tech
Plain-English technology and cybersecurity strategy for business owners, from an independent fractional CIO.
Titan of Tech is for owners and executives of $5M to $50M organizations who want technology advice from someone who represents their interests. Not from someone who earns more commission the more licenses they sell.

I'm John Barker, an independent fractional CIO and 25-year technology and cybersecurity executive. I've led the work for federal contractors, Fortune 500s, and family-owned enterprises.

Each episode takes on a problem owners actually run into: paying for technology you don't use, outgrowing the setup you started with, or a customer, insurer, or regulator suddenly asking for proof of security. It's plain English with no vendor pitch. I don't sell tools, take commissions, or resell anything, so the advice is about what fits how your business runs.

If you want an independent voice above your IT provider, apply for a 30-minute call at https://titanof.tech.

Be the titan over your tech.

About your host

Profile picture for John Barker

John Barker

John Barker, MBA, CISSP, PMP, has worked as a Virtual CIO for the past 7 years. He has supported many executives in a wide range of industries. John's mission is to improve operational technology, identify technology value drivers, and improve cybersecurity defenses. John has led numerous cybersecurity evaluations. Using standard frameworks such as HIPAA and NIST cyber standards. John has been a regular featured columnist in Northern Virginia news outlets. He has over 35 technology columns published in the region.

John started his technology career working on Unisys mainframes in a manufacturing setting. This evolved into the lead network engineer for American Military University. The first online-exclusive accredited university in the United States. He has led a global multi-million-dollar Department of Defense technology program. That supports over 500,000 users. John advises high-net-worth families (300M+) on all technology and cybersecurity matters.

John is active in his community. John served four years in Culpeper County Broadband Planning Commission. The purpose was to expand high-speed internet access in the rural community. He has served on the Board of Directors for chambers of commerce. Served as the chairperson of marketing, and membership committees. John has been a regular at mock interviews and career days for local elementary and high schools. John has led technology entrepreneurial sessions for high school-age students. He instructs them on the steps to create a mock technology product and create a business plan. They "pitch" their ideas to other business leaders in the community.

In 2023, John served on the Technology Advisory Committee for Stafford County Public Schools. He assisted in writing the first A.I. policy voted on and approved by a School Board in the State of Virginia.

John currently works with two different cybersecurity organizations. John is a member of ISC2. He wrote new and reviewed questions for the current version of the Certified Information Systems Security Professional (CISSP) exam. This is the gold-standard information security certification. John is part of the Cyber Security Forum Initiative (CSFI.US) Cyber reporting team. The team aligns national security threat scenarios to common and uncommon cyber frameworks. The team also has access to information that cannot be disclosed.

Press List – Author
Mind-blowing AI Tools are here to stay
Date: March 4, 2023
Link: https://fredericksburg.com/opinion/comment-mind-blowing-ai-tools-are-here-to-stay/article_b603e478-b7c4-11ed-a7b0-838023b605f9.html
Category: artificial intelligence

Artificial Intelligence (AI) has seen an unprecedented leap into the public consciousness, especially with the advent of tools like ChatGPT, showcasing the potential for machines to mimic human conversation with remarkable fluency. AI's history, dating back to 1956, is built on the premise that human intelligence can be emulated by machines, leading to developments in reasoning, learning, and perception.
This technology has quietly underpinned everyday tools, from recommendation algorithms on YouTube to autonomous driving, without widespread public awareness of its mechanisms. The discussion around AI now also encompasses ethical considerations, such as the potential for plagiarism in AI-generated content and the embedding of biases within algorithms. Despite these challenges, the integration of AI into daily life and work is inevitable, urging a collective effort to harness its potential responsibly and ethically. The narrative is clear: AI is no longer a futuristic concept but a present reality, transforming how we interact with technology, understand creativity, and approach the ethical dimensions of digital innovation.

Cybersecurity is a people problem
Date: Oct 15, 2023
Link: https://fredericksburg.com/opinion/column/comment-cybersecurity-is-a-people-problem/article_042531f0-6924-11ee-8b91-fffa2f546f8c.html
Category: Cybersecurity
Cybersecurity incidents often stem from human error rather than technological flaws. For example, a major breach at MGM Resorts was enabled by social engineering, exploiting inadequate employee verification processes. Similarly, the Equifax breach resulted from unpatched servers, highlighting a lack of attention to basic security practices. Other incidents, like a casino hack via an internet-connected thermometer, illustrate the risks of integrating insecure IoT devices into critical networks. These examples underscore the importance of robust security protocols, regular updates, and education to mitigate human-related vulnerabilities. Awareness and proactive measures can significantly reduce the risk of cyber attacks.

Think Twice before using TikTok
Date: May 28, 2023
Link: https://fredericksburg.com/opinion/comment-think-twice-before-using-tiktok/article_55e76904-f3fe-11ed-b8a0-4fc03a885c17.html
Category: Cybersecurity
TikTok faces increasing scrutiny for its data privacy practices, with concerns over potential data sharing with the Chinese government due to its parent company ByteDance's ties. The platform's massive user engagement has drawn legislative attention, resulting in app bans and hearings aimed at mitigating security risks. Users are encouraged to critically evaluate their TikTok usage, considering the privacy and psychological implications of their engagement with the app.

‘Brute Force’ cellphone attack secures conviction
Date: April 22, 2023
Link: https://fredericksburg.com/opinion/columns/comment-brute-force-cellphone-attack-secures-conviction/article_0d2b4d80-ddff-11ed-8cd7-3b730ec21d54.html
Category: cybersecurity, law enforcement
At the heart of Alex Murdaugh's trial for family murder charges was a crucial cell phone video that challenged his innocence. The U.S. Secret Service's expertise in unlocking the phone revealed evidence critical to the case, showcasing the power and potential privacy concerns of digital forensic technology. This situation underscores the importance of robust personal cybersecurity measures, such as multi-factor authentication and secure passwords, to protect against unauthorized access to sensitive information.

Technology education evolving in Fredericksburg Region
Date: July 1, 2023
Link: https://fredericksburg.com/opinion/column/comment-technology-education-evolving-in-fredericksburg-region/article_248daac4-16b0-11ee-b3af-1ffb021e4fb5.html
Category: technology education

The document discusses the evolution of technology education in the region, highlighting the shift from traditional vocational programs to modern Career and Technical Education (CTE) offerings. It showcases local initiatives to engage youth in technology through summer camps and hands-on learning experiences. Programs range from building drones and gaming PCs to video game development and entrepreneurship in technology. These efforts are aimed at equipping students with industry-level certifications, real-world experience, and fostering a passion for technology from a young age, challenging them to think critically and innovatively.

Cybersecurity and the Internet of Things
Date: November 30, 2020
Link: https://www.youtube.com/watch?v=9UgaxG574TI&t=227s
Category: cybersecurity, IoT
John Barker leads a panel through a discussion of the cybersecurity risks in everyday household items that now connect to the internet.
Creating a Culture of Security
Date: Jan 23, 2020
Link: https://www.insidenova.com/culpeper/data-dump-creating-a-culture-of-security/article_6fd2bbb8-3de8-11ea-991b-9f8d164e71d4.html
Category: cybersecurity

Creating a culture of security is essential in combating the increasing threat of cyberattacks, which affect organizations of all sizes. Implementing foundational cybersecurity measures like firewalls, strong passwords, and patch management is crucial. Leadership must prioritize and practice these measures to influence the organization's culture positively. Regular training adapts to evolving cyber threats, emphasizing social engineering awareness. A non-punitive environment encourages reporting mistakes, fostering trust and improvement. External audits validate cybersecurity practices, ensuring adherence to standards. Despite existing regulations in some sectors, many companies lack comprehensive cybersecurity measures. Upcoming regulations, like the Cybersecurity Maturity Model Certification, will enforce stricter compliance and auditing, potentially extending to wider markets influenced by cybersecurity insurance trends.

Ignorance is not an excuse anymore!
Date: November 21, 2019
Link: https://www.insidenova.com/culpeper/data-dump-ignorance-is-not-an-excuse-anymore/article_a5309ae6-0c92-11ea-a3cf-e716081495ce.html
Category: cybersecurity


In recent travels and networking, a concerning trend of improperly secured websites has been observed, highlighting a persistent issue with security certificates. Many businesses, from startups to established companies, neglect basic web security, often resulting in vulnerable websites. The misconception that security breaches are unlikely and the lack of knowledge about the importance of SSL certificates contribute to this problem. It's emphasized that securing a website is a fundamental task that should not be overlooked, as it verifies the site's authenticity and secures data transmission. The article suggests actively ensuring web designers or hosting providers implement SSL certificates and explores options for securing websites, including free services. Ignorance of web security is no longer acceptable, underscoring the necessity for all, including those without technical backgrounds, to prioritize online security.

Is Your Cloud Data Safe from Prying Eyes?
Date: July 5, 2018
Link: https://www.insidenova.com/culpeper/archive/data-dump-is-your-cloud-data-safe-from-prying-eyes/article_c728ffc4-f902-5674-89be-9b178ad12ee1.html
Category: cloudy, security, privacy
The narrative explores the evolution and concerns surrounding cloud data security, focusing on encryption practices and the tension between user privacy and government access requests. It emphasizes the importance of encryption for data in transit and at rest, highlighting user control over encryption keys as critical for privacy. Major tech companies' struggle with government demands for data access is discussed, underscoring the ongoing battle for data privacy. The piece suggests that while cloud storage offers enhanced security and convenience compared to local storage, users should be aware of the potential for their data to be accessed by service providers or under legal compulsion.
Project Management Institute (PMI) Network Without Cringing (Really!) (Featured Guest)
Date: August 7, 2017
Link: https://www.pmi.org/learning/careers/network-without-cringing-really
Category: business, networking