Get NIST-y

Blacksmith InfoSec

Get NIST-y is a podcast that breaks compliance out of the checkbox trap and turns it into a real security advantage. No fluff, no FUD—just practical strategies to make compliance work for your MSP. Each week, we'll dive into compliance topics based on real questions from our MSP partners and subscribers.

  1. vor 4 Tagen

    Evidence Collection Without the Compliance Fire Drill

    Security questionnaires are not the finish line. They are the opening move in a negotiation, and saying “yes” to everything can create a bigger problem than admitting what is still in progress. In this episode of Get NIST-y, the cybersecurity and compliance podcast from Blacksmith InfoSec, Jared and Michael talk about turning evidence collection into a recurring habit instead of a Friday afternoon panic spiral. Takeaways: - Treat customer security questionnaires like a negotiation, not a checkbox confession booth - User audits should follow your policy, but monthly IDP reviews can catch offboarding misses and billing weirdness - Screenshots are not evidence if the underlying work is fake - Backup “success” logs are not enough if you never test whether restoration actually works We answer: - What evidence should an MSP collect regularly so client questionnaires stop becoming fire drills? - How much evidence is enough before the MSP becomes a full-time document janitor? - What should small businesses keep when changing vendors so old proof does not disappear? Make sure to follow the podcast or ask your own questions at: https://blacksmithinfosec.com/nisty/

    22 Min.

  2. 23. Juni

    Shared Responsibility, Shared Delusion, and MSP Risk

    Shared responsibility gets ugly when the client wants compliance, but not ownership. This week's episode is about keeping MSPs out of the unpaid compliance department trap. We answer: - A medical client's cyber insurer wants annual security policies, but the doctors want the front desk to handle it. What now? - How should an MSP separate recurring compliance help from client-owned decisions and project work? Takeaways: - A front desk person can help gather answers, but policy authority needs an executive sponsor or true practice manager. - MSPs can review vendor risk and explain options, but the client has to own the risk. - Executives who carve themselves out of MFA, training, or policy rules are teaching the whole company what actually matters. - Recurring compliance services need clear scope, with sprint work and emergency evidence collection treated as projects. Follow or subscribe so you don't miss the next messy MSP compliance problem. Want to get your own questions answered? https://blacksmithinfosec.com/nisty/

    22 Min.

  3. 16. Juni

    Compliance Without Security Is Just Paperwork

    Compliance is not security. Security is not compliance. But if you treat either one like a box-checking exercise, your client is going to have a bad time. In this episode of Get NIST-y, Jared and Mike talk with Shawn Duffy from Duffy Compliance Services about where SMBs, MSPs, and service providers keep stepping on the same rakes. Takeaways: - Why “we’re too small to be targeted” is technically true, but completely misses the point - Why HIPAA cleanup can cost way more than doing the work correctly the first time - Why “panic” is technically an incident response plan, just a terrible one - Why network diagrams and data flow diagrams are not optional compliance arts and crafts We also hit cyber insurance, forensics, CMMC scoping, MFA exceptions, security policies, weird robot tech support, and the danger of assuming your MSP is the answer to everything. Listen now and submit your own questions at https://blacksmithinfosec.com/nisty/

    47 Min.

  4. 9. Juni

    If You’re Having Mac Problems, I Feel Bad for You Son

    Justin Esgar's got 99 problems, but a Mac ain't one! Justin, the CEO of NYC-based MSP VirtuaComputer and host of the All Things MSP podcast, joins Get NIST-y to talk about the MSP myth that Macs are insecure, unmanageable, or somehow impossible to support without ritual sacrifice. Takeaways: - “We can’t secure Macs” usually means “we don’t know how” - Apple Business and domain claiming are basic security hygiene - Macs being more secure by default does not mean they are (a) more secure or (b) automatically compliant We answer: - Can Macs be managed and secured at scale? - What does Mac compliance look like for NIST, CIS, and CMMC? - Where do Jamf, Addigy, Intune, and Apple Business fit? - Why are some MSPs still treating Macs like cursed objects? Submit your question: https://blacksmithinfosec.com/nisty/

    45 Min.

  5. 2. Juni

    AI is Useful. AI Slop is Not

    AI can be wildly useful. It can also be a shiny button duct-taped onto your PSA, RMM, documentation platform, quoting tool, and possibly your coffee maker. This week on Get NIST-y, Jared and Mike talk about how MSPs can tell the difference between useful AI and vendor AI slop, plus what to ask before client data gets shoved into yet another “trust us bro” feature. Takeaways: - Useful AI should solve a real workflow problem, not create a paragraph you now have to babysit. - If you do not know where your data is going, you are not protecting it. - Read the MSA, DPA, privacy policy, subprocessors list, and AI terms before enabling AI features. - Vendors adding AI may be making a material product change, and your contract should matter. We answer: - How can MSPs separate useful AI from vendor AI slop? - What questions should MSPs ask before using AI features with client data? - Should vendors provide a separate DPA, AI addendum, opt-in, or click-through? - Is “trust us bro” now apparently a compliance framework? Submit your question: https://blacksmithinfosec.com/nisty/

    28 Min.

  6. 26. Mai

    Security on a Shoestring

    In March 2026, Jared gave a talk titled "Security on a Shoestring" at BSides in San Francisco. This week on Get NIST-y, we're bringing that talk to you. We'll be back next week with more answers to your questions. Want to get your own question answered? Head over to https://blacksmithinfosec.com/nisty

    30 Min.

  7. 19. Mai

    Starting a Security-Focused MSP Without Selling on Fear

    A crowded market is not the same thing as a dead market. This week on Get NIST-y, we tackled two questions MSPs should think about before they start selling security with a PowerPoint and a scary ransomware story. We talked about whether it still makes sense to start a security-focused MSP in 2026, and what it actually means to be an M365-based MSP now that identity, governance, and security posture matter more than just managing endpoints. Get NIST-y is the podcast where we make compliance and security practical for MSPs instead of turning them into checkbox theater. What we cover: - The MSP market is crowded, but the bottom is still heavily commoditized and there is room for firms that actually do the work well - Selling on fear is a bad long-term strategy. Trust and business value beat ghost stories - A strong MSP wedge usually starts with specialization, whether that is vertical, geography, or a specific capability - Being M365-based now means managing identity, conditional access, device trust, and user behavior, not just licenses and laptops We answer: - If you were starting a security-focused MSP in 2026, would you sell direct to SMBs, partner with existing MSPs, or avoid the market entirely? - What does it actually mean to be an M365-based MSP now that the real work has moved into identity, governance, and security posture? Submit your question: https://blacksmithinfosec.com/nisty/

    26 Min.

  8. 12. Mai

    CMMC Level 2 Without Lighting Money on Fire

    CMMC gets treated like a monster project. A lot of the time, bad scoping is the real monster. This week on Get NIST-y, we focused on CMMC Level 2 for smaller companies and cut through the panic. We talked about how to keep costs under control, how to scope tightly around the people and systems that actually touch CUI, and why buying tools is not the same thing as being audit-ready. Get NIST-y is the podcast where we make compliance practical for MSPs instead of turning it into theater. What we cover: - If only a few people touch CUI, scope the enclave tightly and keep the rest of the business out of it - You do not need to throw the whole company into GCC High if the work can be isolated properly - Mapping data flows first saves a lot of money and prevents scope creep later - CMMC gets harder when companies buy tools but never operationalize the controls behind them We answer: - What does a realistic CMMC Level 2 path look like for a small company without lighting money on fire? - Is CMMC Level 2 really that hard, or are companies making it harder by refusing to scope and operationalize it properly? Submit your question: https://blacksmithinfosec.com/nisty/

    23 Min.
Alle anzeigen (44)

Info

Get NIST-y is a podcast that breaks compliance out of the checkbox trap and turns it into a real security advantage. No fluff, no FUD—just practical strategies to make compliance work for your MSP. Each week, we'll dive into compliance topics based on real questions from our MSP partners and subscribers.

Informationen

  • Erstellt von
    Blacksmith InfoSec
  • Jahre aktiv
    2025 - 2026
  • Folgen
    44
  • Bewertung
    Unbedenklich
  • Copyright
    © Blacksmith InfoSec
  • Sendungswebsite
    Get NIST-y

Das gefällt dir vielleicht auch