Marcia McKeithen-Seabrooks, MS-MSIS, CISSP

Excited to share an updated overview of what we do at Cyber Brews. Cyber Brews is a Huntsville-based cybersecurity training and industry engagement organization supporting: ✅ Defense Industrial Base ✅ Commercial technology partners ✅ Govcon teams pursuing CMMC readiness Our work spans practical training, compliance-aligned readiness support, tabletop exercises, and curated industry engagement events that connect mission-driven professionals across government and industry. As we head into a busy 2026, we wanted to make it easy for partners and organizations to understand our core capabilities. #Cybersecurity #CMMC #DefenseIndustrialBase #HuntsvilleAL #ZeroTrust #GovCon

16

🚀 Exciting News for DOD Contractors! 🚀 As many of you know, achieving CMMC Level 2 compliance is no longer optional—it's a necessity. But navigating the path to compliance doesn't have to be overwhelming or financially draining. We're proud to announce that our comprehensive DOD MSP program now includes Cyber Compliance Management specifically designed for CMMC compliancen. 🌟 Key Highlights: Understand your current status: Many contractors lack visibility into their technology stack, which is crucial for L2 compliance. Start small, grow steadily: Our program allows you to gradually progress by first diving into Level 1 at minimal cost. Prepare for the future: Our approach focuses on building the visibility and process maturity required for successful compliance. Don’t let compliance overwhelm you! Partner with us to navigate the journey to CMMC L2 without breaking the bank. We have a structured program tailored specifically for your organization’s needs. Let's work together to secure your future! 💼🔒 #CMMC #Compliance #DOD #CyberSecurity #MSP #Level2 #BusinessGrowth

Ever wonder what a federal IT implementation partner actually does all day? It’s not just coffee and FAR clauses (though we do see a lot of both). From staying on top of agency priorities to drafting proposals that balance compliance and innovation—and ending the day solving real modernization and cybersecurity challenges—this is what partnership looks like behind the scenes. It’s not glamorous. But it is mission‑critical. 🎥 Take a quick look at a day in the life of a federal partner helping agencies deliver secure, effective outcomes—on time and on budget. Featuring Makpar President Kaamil Khan #FederalIT #GovTech #PublicPrivatePartnerships #DigitalModernization #Cybersecurity #FederalPartners

19

1 Comment

Deepfakes. Ransomware. Identity theft. The threats are real and evolving fast. Join us Aug 11th as Dr. Dannielle Eason DBA CISSP equips you with practical tools to stay secure.

2

MS-ISAC (a division within the Center for Internet Security) is a trusted cybersecurity partner for 18,000+ U.S. State, Local, Tribal, and Territorial (SLTT) government organizations. It's one of the most successful multi-jurisdictional/non-profit public-private partnerships that's ever been established. And, SLTT's need MS-ISAC to be operating at full-strength. In my view, the decision by the federal government to end financial support is shortsighted and weakens/harms the nation's ability to prepare for, respond to, and recover from the inevitable cyberattacks of today and tomorrow. https://lnkd.in/gJPRaRqP

8

2 Comments

As promised, the latest CMMC & NAICS (unofficial) Guide to Sam.gov, and you can add NAICS Code 339999 to the latest codes needing CMMC compliance. #CMMC #DOW #DIB #DOD #CUI #FCI #SAM #48CFR #Cybersecurity #NAICS #32CFR

6

Today I’ll be presenting along with @KellyHood on “CMMC in Practice: What Assessors Look for and How to Prepare” for the @ISACA Central Maryland Chapter. The timing couldn’t be better. The #CMMC final rule has officially been published, and the countdown to implementation is on. Starting November 10, CMMC requirements will begin appearing in DoD contracts. In this virtual training we will be sharing all about: - What assessors are really looking for during certification - Common red flags that can derail the process - How to make sure your evidence is audit-ready - The latest on CMMC timelines and the phased roll-out Whether you’re just starting your CMMC journey or gearing up for an assessment, you’ll walk away with practical guidance to avoid compliance pitfalls and move forward with confidence. Register to join us! https://lnkd.in/egryVJEj #ISACA #ISACACMC #Maryland #OpticCyber

18

2 Comments

If you’re thinking about getting into cybersecurity, this is such a great opportunity! Cyber Florida’s CyberWorks program gives you hands-on training + a path to earn your CompTIA Security+ certification. Definitely worth checking out! Also, if you know anyone transitioning careers, veterans, or first responders, share this with them. #CyberFlorida #Cybersecurity #CareerGrowth #TechCareers #Upskill #CyberWorks

3

Loving some of the Easter Eggs in the DoD FAQ: C-Q12: What qualifies as a "significant change" that would require an Organization Seeking Assessment to undergo a new evaluation under the CMMC Program? LAST SENTENCE 👉 ".....Failure to sufficiently demonstrate adherence to the previous SSP may result in a future failed assessment." So important ⚠️ Minor changes using proper change control - Okay. ✅ Major changes - Reassessment or failed future assessment and noncompliance in the meantime. 🚨 And YES! THEY TOOK A STAB AT DEFINING SIGNIFICANT CHANGE: #CMMC #CCP #CCA #C3PAO #DIB Carter Schoenberg Kyle Lai Brian Rhodes Melvin Scott Alexy J. Jeff Baldwin, DSc, Jacob Hill, Mike Bramm, Fred Tschirgi, Fernando Machado, CISSP, CISM, CCA, CCP, Daniel Akridge, Joy Belinda Beland, James Goepel, Matthew Titcombe, Matt Hoeper, Katherine "Kat" Adams, Scott Singer, CAPT USN (Ret), Thomas Graham, PhD, CISSP, MBA, Robert J. Teague, MBA, CCA, CCP, Nancy Laney, CMMC Coach, Stuart Itkin

61

9 Comments

Continuous validation is the missing piece in most FedRAMP journeys. NodeZero Federal™ brings clarity to what’s exploitable vs. theoretical so CSPs can focus resources and 3PAOs can verify with confidence.

1

Those of us in the CMMC Ecosystem are anxiously awaiting the publication of the final version of the United States Department of Defense's updates to DFARS 252.204-7021! When that happens, it will set in motion the long-awaited Cybersecurity Maturity Model Certification ("CMMC") Program. Once the CMMC Program is "live", 200,000+ companies will need to demonstrate their compliance with appropriate CMMC requirements before they can be awarded a DoD contract (or subcontract). This will create a HUGE demand for CMMC-related services. People holding the CMMC Certified Professional ("CCP") certification have undergone extensive training and have passed a difficult and comprehensive examination to validate that they understand the CMMC program's requirements. Aside from CMMC Certified Assessors ("CCAs"), CCPs are some of the best-qualified persons to be helping defense contractors meet their CMMC requirements. There are currently only about 1,000 people worldwide who have earned CCP certifications. When the CMMC Program takes effect, we will need a LOT more CCPs to help meet market demand. From internal employees to external consultants, CCPs play mission-critical roles in the CMMC Ecosystem and in helping their organizations stay competitive in a rapidly changing business climate. Are you ready to take your career to new heights by becoming a CCP? If so, be sure to register for Ascend Cyber's October 2025 CCP course! We might even have a guest appearance by Matthew Titcombe! For more details and to register, visit https://lnkd.in/eEt_UT48

14

Getting started with CMMC as a subcontractor doesn’t have to be overwhelming. Start with the basics: 1. Register in SAM.gov 2. Set up PIEE / SPRS access 3. Confirm your CMMC scope 4. Perform a gap analysis 5. Self-assess and start remediation The goal is simple: know what information you handle, understand what level applies, document your gaps, and build a practical path to readiness. #CMMC

5

1 Comment

Audit Retrospective: Persistent Gaps in DoD IT Program Management A 2024 GAO assessment of major DoD business IT programs found ongoing issues with cost, schedule, performance tracking, and cybersecurity planning. This highlights the enduring challenge of managing risk and achieving consistent oversight in large, complex federal IT portfolios. The audit examined 21 major IT business programs, analyzing their cost, schedule, and performance from FY2022-2024 and assessing their use of software development and cybersecurity practices. The review identified that 13 of the 21 programs reported cost increases ranging from $0.5 million to $1.3 billion, with a median increase of $163.3 million. Auditors found that 7 programs reported schedule delays ranging from 15 to 36 months (median of 24 months), and 4 programs had rebaselined or expected to rebaseline. The report documented that 6 of the 21 programs did not fully report required performance metrics, and several still lacked an approved cybersecurity strategy—an issue identified in prior audits. For the 10 programs actively developing software, the assessment noted that 4 did not use required Agile metrics and management tools to track customer satisfaction and development progress. Such findings serve as critical benchmarks, revealing systemic weaknesses that require sustained management attention. The underlying tension between adopting modern agile practices and maintaining rigorous oversight in large-scale acquisitions is universal: what mechanisms has your organization found most effective for balancing agility with governance and accountability in major IT investments? For detailed findings, review the 2024 GAO report GAO-24-106912, "IT SYSTEMS ANNUAL ASSESSMENT: DOD Needs to Strengthen Software Metrics and Address Continued Cybersecurity and Reporting Gaps." #GAO #Audit #ITManagement #ProjectManagement #Cybersecurity #DoD #Governance #RiskManagement

2

875K Settlement – A Wake-Up Call for Defense Contractors   Defense Contractor Georgia Tech Research Corporation reached a settlement to resolve False Claims Act violations for the alleged submission of a falsified cyber assessment and failure to implement cybersecurity requirements mandated by the Department of Defense. This should send a clear message to all DoD contractors and subcontractors, but don’t take our word for it…   “Those who knowingly provide deficient cybersecurity products or services, misrepresent their cybersecurity practices or protocols, or violate obligations to monitor and report cybersecurity incidents and breaches must be held accountable. Enforcement efforts like this should serve as a reminder to industry to prioritize DoD cybersecurity compliance” warns Stacy Bostjanick, CMMC Program Leader.   And from Assistant Attorney General Brett Shumate in a Sept. 30 release from DoJ, “Together with DoD and other agency partners, the Department of Justice will continue to pursue and litigate violations of cybersecurity requirements to hold contractors accountable when they violate their cybersecurity commitments.”   With CMMC implementation starting November 10, the stakes have never been higher. Don't let compliance gaps put your contracts at risk. SSE is already CMMC Level 2 Certified and specializes in CMMC compliance. We help defense contractors build a customized plan for compliance.   𝐒𝐜𝐡𝐞𝐝𝐮𝐥𝐞 𝐲𝐨𝐮𝐫 𝐜𝐨𝐧𝐬𝐮𝐥𝐭𝐚𝐭𝐢𝐨𝐧 𝐭𝐨𝐝𝐚𝐲 𝐭𝐨 𝐞𝐧𝐬𝐮𝐫𝐞 𝐲𝐨𝐮𝐫 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐢𝐬 𝐫𝐞𝐚𝐝𝐲: https://lnkd.in/g9pAu_Dj   #SSE #CMMC #Cybersecurity #DefenseContractors #NIST800171 #Compliance #FalseClaimsAct #CyberSecurity #DoD

9

ESN Recognized Among DOD’s Top 250 Technology and Support Services Providers for FY2024 WOODBRIDGE, VA – Engineering Services Network, Inc. (ESN), a leading provider of engineering, cyber, and software solutions based in Woodbridge, VA, proudly announces its inclusion in the 2025 OrangeSlices Vanguard DOD 250. This prestigious recognition highlights the most successful firms supporting the U.S. Department of Defense (DoD) through federal services contracts during Fiscal Year 2024. The list, published by GOVTECH Connect in collaboration with HigherGov—a leading provider of federal market intelligence and business development tools—identifies companies based on total obligated contract dollars (including both prime and reported subcontractor awards) across targeted NAICS and PSC codes. Selected firms are recognized for their proven performance, reliability, and measurable impact across the DoD's technology and support services sectors. “ESN is honored to be recognized by these organizations and will continue to drive innovative engineering and cyber solutions to our end customers,” said Douglas Lopez, President & COO of ESN and a service-disabled U.S. Marine Corps veteran. “Over the past 30 years, ESN has built a strong reputation for delivering mission-critical support and tailored solutions to defense and federal clients, playing a vital role in advancing national security through technology innovation and operational excellence.” ESN’s inclusion in the Vanguard DOD 250 reinforces its continued commitment to delivering exceptional results and value in support of the Department of Defense’s evolving mission needs.

25

Reminder, next week we will be starting a fully live CCP course if you are interested in becoming a CMMC Certified Professional. Beyond being a requirement for aspiring assessors, CCP training is great for consultants and implementers who want to understand the requirements and effectively perform self-assessments for organizations. Understanding the requirements and having the same training as assessors allows you to communicate with the same terminology and understanding of assessment processes. The February CCP course will run for 3 full days, 10am - 6 PM EST, February 24th through 26th. The later morning start makes this more accessible to other time zones. The training is all online and remote, no travel required, and recorded for playback after the course in a LMS that you will not lose access to, so that you can study on your schedule after the course. Also, if you are in need of Continuing Professional Education (CPE) credits for other certifications, this course is 21 hours of live instruction that can be used for CPEs. As always, if this timing does not work for you, then I have the self-paced guided learning option that allows you to start at anytime and complete the material at your own pace. Full registration details for the February training can be found here: https://lnkd.in/eytvA_dk The next fully live CCA course will be March 17th to March 19th. #cmmc #dib #nist800171 #spacecoastcyber

16

2 Comments