GRC Academy

Jacob Hill

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform for GRC professionals, executives, and anyone else who wants to increase their knowledge in the GRC space!

  1. Deltek's Journey to FedRAMP Moderate Equivalency

    18/11/2025

    Deltek's Journey to FedRAMP Moderate Equivalency

    I have a surprise for you --- the last GRC Academy podcast! In this last episode, Michael Greenman from Deltek shares the journey to FedRAMP Moderate Equivalency for Deltek Costpoint GovCon Cloud Moderate (GCC-M). And let me tell you, it's quite a story: changes in the control baseline, new policy from the DoW, and lessons learned. Here are some of the biggest takeaways: The real-world implications of DoW's equivalency definitionHow the absence of continuous monitoring shapes the trust modelHow Deltek developed a customer responsibility matrix that reduces friction for their customersShould the DoW blow up FedRAMP moderate equivalency?We also discussed improvements that can be made by the DoW, the Cyber AB, and more! We recorded this months ago, but this conversation is still very relevant. On another note, it is kind of surreal to think this is the last episode of the GRC Academy podcast. I hope you've enjoyed listening!! What were your biggest takeaways? Let me know in the comments. Follow Michael on LinkedIn: https://www.linkedin.com/in/michael-greenman-94952a3/ Deltek Costpoint GCC-M: https://www.deltek.com/en/government-contracting/costpoint/cloud ----------- Online GRC Training: https://tekfused.com/marketplace/?utm_source=podcast&utm_medium=s2-12&utm_campaign=marketplace #cmmc

    36 min
  2. What's Next for GRC Academy and Jacob Hill

    04/09/2025

    What's Next for GRC Academy and Jacob Hill

    I have an incredible announcement to share! 👀 Before that though, let me share some of my history with you. Back in 2016, I started a side-business called TEKFused LLC focused on web design/hosting. Fast forward to 2022, I launched GRC Academy, and since then I’ve released 3 CMMC courses, released 50+ podcast episodes, and partnered with some amazing companies. Earlier this year, life threw me a curveball when I was laid off from my full-time role. Thanks to the incredible support of my AMAZING LinkedIn network, I had new opportunities on the table immediately! Within a week, I accepted a role with Summit 7 as Director of Cybersecurity - a company I’ve admired since 2019. And here’s the part I NEVER expected: 👉 Summit 7 has officially acquired GRC Academy!! 🎉🥳🎉 And guess what?!? I've already completely updated and rerecorded my CMMC training!! And it's even better than it was before!! GRC Academy students with active enrollments to my CMMC training will receive access to the new training on Summit 7's platform. It will take some time to get this all together, so keep your eyes open for that announcement. I'll be contributing to Summit 7's YouTube channel in the future as well, so subscribe if you haven't already: https://youtube.com/@summit7 I will still be reselling PECB training at my TEKFused LLC website! If you need to get certified in ISO 27001/42001 (and more), be sure to keep me on your list: https://tekfused.com/courses/?utm_source=podcast&utm_medium=s2-11&utm_campaign=s7-acquisition-announcement On a personal note, I’m very thankful that this transition allows me to spend way more time with my family - while continuing my mission of educating the Defense Industrial Base! I learned so much during this chapter of my life. I want to thank all of you for your support - it truly made this possible. #cmmc #nist #cybersecurity

    4 min
  3. The Business Case for CMMC - Surviving DOGE

    19/06/2025

    The Business Case for CMMC - Surviving DOGE

    CMMC certification could be the key to surviving DOGE cuts! 👀 In this episode, I’m joined by Derek Kernus of Aethon Security to discuss the business case for CMMC! This episode was really refreshing to me. Yes, our discussions about deep CMMC topics are important, but learning how to convince your company leadership to make the CMMC investment is even more critical. Here are some takeaways: How CMMC early adopters can shape contracts and limit competitionHow to frame the CMMC investment to internal leadershipThe impending CMMC bottleneck of doom 👻What mock assessments are and how they can help you prepareWhy choosing the wrong MSP could actually kill your chances at certificationAfter being impacted by DOGE myself, I've put a lot of thought into how small businesses will be impacted by DOGE + CMMC. Most of my concern is for SMBs that haven't started preparing for CMMC. That costs a lot of money, and if SMBs lose revenue due to DOGE cuts before they prepare for CMMC, I'm not sure they'll be able to survive in the defense contracting space. But there is great opportunity for CMMC early adopters to be part a small cadre of CMMC certified companies and operate in a much smaller competitive space. It turns out CMMC actually could be your business's savior. Who knew!?! I really enjoyed this conversation! What were your biggest takeaways? Let me know in the comments. Follow Derek on LinkedIn: https://www.linkedin.com/in/derekkernus/ Aethon Security Website: https://www.aethonsecurity.com/ ----------- Thanks to our sponsor Vanta! Get back time to focus on strengthening security and scaling your business. Discover the new way to GRC here: https://vanta.com/grcacademy ----------- Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform! Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-10&utm_campaign=courses #cmmc

    53 min
  4. The Compliance Playbook to Cybersecurity

    05/06/2025

    The Compliance Playbook to Cybersecurity

    "Compliance is the security referee - frameworks are the playbooks." In this episode, I’m joined by Tim Golden, Founder of Compliance Scorecard, to unpack the misunderstood, and mission-critical world of cyber GRC. Tim shares what he’s learned from decades of hands-on work - from implementing NIST frameworks before “GRC” was even a term, to helping teams understand why writing policies is just as important as patching vulnerabilities. Here are some highlights from the episode: What GRC actually means - and why governance is the most misunderstood partWhy people who say "compliance isn't security" are missing the pointHow explaining the "why" of cybersecurity controls aids in acceptanceWhy data retention policies can protect you from major legal headachesAnd yes… a story about how Tim accidentally ransomwared himself 🙃This is a must-listen for anyone navigating compliance, cybersecurity, or just trying to understand how it all fits together! I really enjoyed this conversation! What were your biggest takeaways? Let me know in the comments. Follow Tim on LinkedIn: https://www.linkedin.com/in/timothygolden/ Compliance Scorecard Website: https://compliancescorecard.com/ ----------- Thanks to our sponsor Vanta! Get back time to focus on strengthening security and scaling your business. Discover the new way to GRC here: https://vanta.com/grcacademy ----------- Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform! Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e9&utm_campaign=courses #cybersecurity

    32 min
  5. How HITRUST Fixes What’s Broken in Cybersecurity Compliance

    27/05/2025

    How HITRUST Fixes What’s Broken in Cybersecurity Compliance

    Cybersecurity frameworks can learn a lot from HITRUST. In this episode, Ryan Patrick of HITRUST explains how HITRUST approaches the assurance problem, from centralizing the certification process to frequent updates to the control sets based on threat data. I barely knew anything about HITRUST going in, but it’s clear they’re tackling the cybersecurity assurance problem in a radically different way. Here’s what stood out to me: HITRUST reviews its security controls quarterly based on threat intel and control effectivenessThere are three distinct assessment levels (like CMMC)HITRUST itself issues a certification after the 3rd party assessment and running the assessment results through two stages of QAEvery 3rd assessment gets reviewed. Every. Single. One.The centralized approach of HITRUST allows them to provide feedback to its assessment community after each and every assessment which results in assessments that are more consistent and higher quality. HITRUST certified organizations are contractually required to report incidents which then allows them to evaluate the effectiveness of their controls. I personally think that commercial cybersecurity frameworks should take a look at HITRUST. What were your biggest takeaways? Let me know in the comments. Follow Ryan on LinkedIn: https://www.linkedin.com/in/ryan-patrick-3699117a/ HITRUST Website: https://hitrustalliance.net/ ----------- Thanks to our sponsor Vanta! Get back time to focus on strengthening security and scaling your business. Discover the new way to GRC here: https://vanta.com/grcacademy ----------- Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform! Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e8&utm_campaign=courses #hitrust

    56 min
  6. CUI Masterclass with Ryan Bonner

    09/05/2025

    CUI Masterclass with Ryan Bonner

    "Outread the others" - that's how Ryan Bonner mastered CUI. If you're confused about Controlled Unclassified Information (CUI) - you're not alone. Many defense contractors (not to mention DoD themselves) misunderstand what is CUI, where it comes from, and how to handle it. In this episode, Ryan Bonner, CEO of DEFCERT, gives a masterclass in understanding CUI from the actual laws and regulations - not just hearsay. 👉 Here are the highlights: What CUI really is - and what it’s notHow to use the NARA and DoD CUI registriesThe proprietary paradoxHow to decontrol CUIThe difference between FCI and CUIDoD memo on determining CMMC levels This is essential listening for anyone working with the defense industrial base - primes, subs, and especially DoD program managers who want to avoid missteps. What were your biggest takeaways? Let me know in the comments. Follow Ryan on LinkedIn: https://www.linkedin.com/in/rybonner/ DEFCERT Website: https://defcert.com/ ----------- Thanks to our sponsor Vanta! Get back time to focus on strengthening security and scaling your business. Discover the new way to GRC here: https://vanta.com/grcacademy ----------- Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform! Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e7&utm_campaign=courses #cui #cmmc

    51 min
  7. Small Business Achieves CMMC Level 2 Certification: Reynolds Construction's DIY Success Story

    24/04/2025

    Small Business Achieves CMMC Level 2 Certification: Reynolds Construction's DIY Success Story

    HR guy leads his company to CMMC level 2 certification! 👀 In this episode I’m joined by Eric Fields of Reynolds Construction to learn how he led his business to CMMC level 2 certification! I call him "Eric the Great" - you'll see why in a moment. Eric's background was in HR and business operations. He had no background in IT or cybersecurity. They did it in-house - with just two people and smart choices. 👉 Here’s how they did it: CMMC training from GRC AcademyResources and advisory services from Kieri SolutionsCCP & CCA trainingMeticulous documentationThis episode is very special to me - Eric's intro to CMMC was through GRC Academy more than 2 years ago, and he was actually the second person to leave a 5-star review on my CMMC training for defense contractors: https://grcacademy.io/course-reviews/cmmc-overview-training-eric-f-20230127/ This episode is a great reminder that small businesses can achieve CMMC certification without breaking the bank. That said, time is no longer a luxury. With CMMC phasing in this summer, small businesses need to move fast - and partnering with a CMMC-focused MSP can help accelerate the process. What were your biggest takeaways? Feel free to celebrate with "Eric the Great" in the comments! Follow Eric on LinkedIn: https://www.linkedin.com/in/ericfields6/ Reynolds Construction Website: https://www.reynoldscon.com/ ----------- Thanks to our sponsor Vanta! Get back time to focus on strengthening security and scaling your business. Discover the new way to GRC here: https://vanta.com/grcacademy ----------- Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform! Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e6&utm_campaign=courses #cmmc #nist #cybersecurity

    36 min
  8. The FASTEST Way to CMMC Compliance - CUI Enclaves

    10/04/2025

    The FASTEST Way to CMMC Compliance - CUI Enclaves

    CMMC rolls out in a few months and there are STILL companies who are JUST getting started! In this episode I’m joined by Daniel Akridge of Summit 7 to talk about the real challenges facing the Defense Industrial Base - and the FASTEST path to CMMC certification. To CUI Enclave, or not to CUI enclave - that is the question! 👉 Here are some of the highlights: What the big primes are saying about their subs and CMMCThe biggest CMMC hurdles for defense contractorsWhy MOST DoD contracts could require CMMC Level 2 certification - not just self-attestationDeep dive into CUI enclaves and their pros and consI personally like CUI enclaves because it keeps government cybersecurity regulations and incident reporting requirements out of my corporate IT environment... However if you are a small business that primarily supports the DoD, CUI enclaves begin to make less sense - even as I try to reason otherwise! What were your biggest takeaways? Do you LUV CUI enclaves?? Let me know in the comments! Follow Daniel on LinkedIn: https://www.linkedin.com/in/danielakridge/ Summit 7 Website: https://www.summit7.us/ ----------- Thanks to our sponsor Vanta! Need continuous visibility into the state of your security controls? Discover the new way to GRC here: https://vanta.com/grcacademy ----------- Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform! Online GRC Training: https://grcacademy.io/courses/?utm_source=podcast&utm_medium=s2-e5&utm_campaign=courses #cmmc #nist #cybersecurity

    58 min
Elenco completo (55)

Descrizione

Governance, Risk, and Compliance Academy (GRC) Academy is a training and research platform for GRC professionals, executives, and anyone else who wants to increase their knowledge in the GRC space!

Informazioni

  • Creatore
    Jacob Hill
  • Anni di attività
    2023 - 2025
  • Puntate
    55
  • Classificazione
    Contenuti adatti a tutti
  • Copyright
    © Copyright GRC Academy
  • Sito web del podcast
    GRC Academy