Cyberspin
Addressing cybersecurity’s latest trends, tactics, tools and best practices.
75 episodes
latest
monthly cadence
English language
https://cyberspin.redspin.com/feed.xml
Episodes
Reading the feed…
Addressing cybersecurity’s latest trends, tactics, tools and best practices.
Reading the feed…
In this August session, we are joined by John Fitch, Redspin's lead Azure Architect, and Carley Salmon from Microsoft for a joint session on the cloud questions defense contractors ask most. The panel breaks down GCC vs. GCC High (and Azure Commercial vs. Azure Gov), when G3 licensing is enough versus when G5 pays for itself, and how to prevent CUI from leaking out of a commercial O365 mailbox using Purview DLP, labels, and conditional access. Plus a field update from DoW CIO Kirsten Davies at Black Hat (officially a pause, not a suspension), what primes are telling us about third party valida
In this July edition of CMMC Connect, Redspin tackles the biggest news of the year: the CMMC Phase 2 pause. Rob Teague shares takeaways from his in-person meeting at the Pentagon with DoW CIO Kirsten Davies, including her real feedback on NIST 800 171 (she thinks it's too governance heavy) and what she's actually considering next. The panel walks through what's paused, what's still in effect (spoiler: DFARS 7012 and every NIST 800 171 requirement), why third party assessments still matter, and how to make your voice heard through the open RFI. Plus a Rev 3 timeline update, whether your Level 2
In this June edition of CMMC Connect, Redspin's assessors and consultants cut through the noise on the questions defense contractors are asking right now: Why November 10, 2026 is a phase milestone (not a drop dead deadline) What the re-released federal CUI rule signals about the shift to NIST 800 171 Rev 3 The new post quantum cryptography (PQC) strategy and its December 31, 2030 enforcement date What actually triggers a reassessment when AI/ML tools, M&A, or cloud changes hit your environment Multi-tenant organization (MTO) considerations across GCC High tenants The real rules for remote wor
The panel digs into what FIPS 140-2 moving to historical status on September 21, 2026 means for your tech stack, how to tell if your MSP is actually doubling as a CSP, what does and doesn't count as CUI when COTS items and PII (CUI//SP PRVCY) are in play, whether non US citizens can serve as admins in a GCC High environment, what to do when your SSP says whitelisting but your tools are actually blacklisting under CM.L2 3.4.8, and how strict the separation between administrative and standard user accounts really needs to be (spoiler: admins demonstrating they can't open user files is now part o
In this April edition of CMMC Connect, Redspin's assessors and consultants take on the questions defense contractors are asking most right now. The panel digs into whether OSCs in the middle of a Level 2 assessment can keep working as subs on prime contracts, when NIST 800 171 Rev3 will become the standard and what's new in it, how to handle CUI when running AI tools on AWS GovCloud, how strict the separation between administrative and standard user accounts really needs to be, and the most common pitfalls that send "ready" organizations into a failed Level 2 assessment. You'll also get the la
What are organizations getting wrong when it comes to CMMC? In this replay of March’s CMMC Connect, Redspin’s assessors break down the real-world questions organizations are asking right now, from Rev. 2 vs. Rev. 3 implications to scoping decisions, shared environments, and what truly changes when you add systems into your boundary. We cover what happens after certification, how to think about inherited controls and micro-business models, what differentiates C3PAOs, and how to determine if you’re truly assessment-ready—not just policy-ready. If you’re navigating CMMC Level 2, managing CUI, or
How did this much happen in just 30 days? In this replay episode of February's CMMC Connect, we break down the latest DFARS Class Deviations, GSA’s new “CMMC-like” program, key takeaways from the Cyber AB Town Hall, and the biggest questions shaping the CMMC landscape right now. We cover why mock assessments can’t convert to formal certifications, why documentation is everything, how contract requirements drive CMMC Levels, and what you need to know about CUI access, training, and assessment readiness. If you’re navigating CMMC, FAR/DFARS, or federal contract compliance, this is your 60-minute
CMMC is moving fast, and the questions from the DIB are getting more specific... In this January 2026 replay of Redspin's live CMMC Connect, our CMMC Certified Assessors (CCAs) unpack the latest updates from the field and answer real-world questions OSCs are facing as CMMC Level 2 assessments ramp up. This episode (literally) covers: Recent DoD CMMC FAQ updates and what they clarify (and don’t) ISACA’s new role as CAICO and what it means for CCP and CCA certifications The growing pace of completed CMMC assessments and what that signals for 2026 Scoping challenges: virtual machines, shared reso
In this holiday edition of CMMC Connect, the Redspin team wraps up a busy year by tackling real questions from the Defense Industrial Base, sharing practical best practices, and looking ahead to what 2026 may bring for CMMC. From lessons learned in the field to what contractors should be thinking about next, this session covers a wide range of timely topics — with a little holiday fun mixed in. We also share what’s new for CMMC Connect in 2026. Sessions will continue on the last Thursday of every month, starting January 29, but with a simplified registration process. Going forward, you’ll only
Phase 1 of CMMC is officially here, and this month’s CMMC Connect dives straight into what contractors are experiencing on the ground. Redspin’s panel of CCAs break down the newest DoD updates, rising assessment backlogs (or is it rising false-starts?), early Level 2 contract requirements, and the most common “not met” trends they’re seeing in real assessments. They also unpack key findings from Redspin’s new Momentum but Slow Movement report, based on data from 180 DoD contractors, including the growing wave of flow-down demands from primes. If you want clear, practical answers on scoping, ev
In this special Halloween edition of CMMC Connect, the Redspin team swapped their suits for costumes and dove into what’s next as CMMC Phase 1 officially begins on November 10. Join Dr. Thomas Graham, Jeremy Mares, Rob Teague, and Phil Conrad, hosted by Lauren Frickle, as they unpack: Why November 10 marks the start of CMMC, not the finish line What to do before the rollout — including updating your SPRS scores When service providers (like CPA firms) come into scope Key insights from the field — over 430 Level 2 assessments completed and counting Tips to prepare for the 2026 Phase 2 rollout an
CMMC timelines, DFARS 7025, FedRAMP CRM responsibilities, interim compliance signals, and what’s next for NIST 800-171 Rev. 3, our team of CMMC Certified Assessors (CCAs) covered the hottest questions the DIB is asking right now. If you’re aiming for Level 2 or fielding customer requests for proof of certification in Phase 1, this conversation is your quick-hit guide to what matters most. CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the la
The long-awaited final 48 CFR DFARS 7021 rule has dropped, and CMMC is officially headed into contracts. In this special live call-in edition of Cyberspin, the Redspin team gives their quick breakdown to the finalized rule before answering audience questions on everything from SSO/MFA and joint ventures to whether small contractors can realistically achieve Level 2 certification. We also dive into separation of duties, prime pressure on subs, and the most cost-effective paths to certification, and so much more Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform.
In this live CMMC Connect session, Redspin’s experts tackle audience questions head-on: How soon after 48 CFR finalization will CMMC Level 2 show up in contracts? What’s the best way to secure printers in hybrid work environments? And what happens when CMMC shortfalls trigger False Claims Act investigations? Tune in for real-world answers, practical tips, and a candid look at the signals DoD contractors can’t afford to miss. CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast p
In this episode, we unpack one of the most common questions in the CMMC space: What actually triggers a reassessment? From changes in CUI flow to infrastructure shifts and company acquisitions, we break down when you might need to re-certify—and what’s still awaiting clarity from the DoD. We also share lessons learned from the field, including common missteps organizations are making in cloud environments. Misconfigured policies, inherited templates, and SSPs that don’t reflect reality are tripping up otherwise prepared teams. Next, we take a closer look at the Shared Responsibility Model. You
Big moves in CMMC rulemaking are happening, and the signals from DoD leadership are loud and clear. In this episode, we break down the recent milestone that sent 48 CFR to OIRA for final review, the critical July 18th memo from THEE Secretary of Defense, and what it all means for the Defense Industrial Base. We’ll talk terminology ("effective" vs. "enforceable"), and timelines for contractors. Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.
In this CMMC Connect replay episode, we dive into the most pressing questions facing the Defense Industrial Base right now. Kicking things off with a state-of-the-ecosystem update, our panel tackles the big-ticket items—how much CMMC actually costs, where we are in the implementation timeline, and how many assessments have already been completed. We also break down the current stats on authorized C3PAOs and certified professionals in the ecosystem. After setting the stage, we shift into audience-driven content, answering pre-submitted questions and opening the floor for a lively live Q&A with
This month, our expert panel tackles the real-world challenges of CMMC compliance, from getting started and surviving assessments to sustaining success. We break down training must-haves, insider threat risks, MFA requirements, retroactive CUI headaches, and how tools like VDI and FedRAMP fit into your strategy. Tune in for practical tips, pitfalls to avoid, and audience Q&A that dives into the details you actually care about. CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast
A long time ago (okay, April 24, 2025), in an ecosystem not so far away…Redspin hosted a CCA and CCP Q&A packed with practical advice for navigating CMMC compliance. Topics spanned NIST 800-171 Rev. 3 updates, ERP system management, SSP maintenance, CUI handling in Azure GCC vs. GCC High, remote access security, and cost distribution across federal contracts. Panelists also explored user privileges, FedRAMP equivalency, and how CUI management differs between civilian and DoD contexts. Listen in for real-world insights and strategies to conquer the complexities of CMMC! CMMC Connect happens eve
With headlines swirling about the new DoD nominee reviewing 48 CFR( the rule that puts CMMC in contracts), is CMMC on the chopping block? Rob Teague, Dr. Thomas Graham, and special guest David Bailey break down the headlines and clear up the confusion. Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can always stream the latest episodes at redspin.com.
Insights from our CMMC Assessor team on: Preparing for CMMC assessments The implications of using AI in compliance Requirements for cloud services. The session also addresses common questions regarding vulnerability data, SPRS compliance, and the differences between GCC and GCC High environments. The conversation concludes with a live AMA session where participants can engage directly with the panelists. CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to Cyberspin on Apple iTunes, Spotify, or your preferred podcast platform. You can alwa
This month, we cover important updates regarding CMMC compliance, including a JSVA update and Katie Arrington's return to the driver's seat. Our panelists delve into the complexities of compliance with CUI regulations, the challenges of recovering costs in future contracts, and the importance of customer responsibility matrices in FedRAMP. It also addresses the nuances of CMMC compliance, particularly regarding subcontractor challenges and the integration of ERP solutions, plus so much more. CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscrib
This month, we break down the FAR CUI proposed rule and what it means for your CMMC readiness. Our experts, Phil, Les, Dr. Thomas, Rob, and Jeremy, tackle key topics, including: Security awareness training – Who needs it and why? Reporting requirements – What’s changing and how to stay compliant. Assessment costs – What impacts pricing and how to save money. GRC tools & cloud compliance – Choosing the right solutions. Join us for practical insights and expert advice on navigating CMMC. CMMC Connect happens every last Thursday at 1 PM ET. Register: redspin.com/events/cmmc-connect Subscribe to C
In this episode, the Redspin team of Certified CMMC Assessors (CCAs) gets together to break down the latest updates and buzz in the CMMC ecosystem. They discuss the surprises in the recently published proposed FAR CUI rule, the status of the 48 CFR rule (CMMC in contracts) and when to expect it to be finalized, as well as what CMMC Level 3 means for the Defense Industrial Base (DIB) and where to start. The team also explores the potential impact of a new administration on rulemaking progress and CMMC initiatives, dives into updates on NIST 800-171 Rev 3, and discusses whether CMMC could expand
In this episode of Cyberspin, we bring you a replay of December’s CMMC Connect session, featuring an engaging discussion with our CCPs and CCAs: Jeremy Meyers, Rob Teague, Dr. Thomas Graham, and Belen Coleman. The team tackles audience questions, dives into the implications of the finalized and in effect 32 CFR rule, and explores practical strategies for achieving and maintaining CMMC compliance. Key topics include: Preparing for the effective date of 32 CFR and beyond. Addressing challenges with EMASS and certification timelines. Best practices for balancing compliance and operational needs.
