The news about cybercrime is overwhelming to those who fight to secure our organizations. Cybercrime organizations are sophisticated and constantly changing. But there’s a hidden truth in cybercrime attacks: cybercriminals exploit the same weaknesses they’ve been exploiting for years. This should give us some hope; we know where our organizations are weakest, which gives us a good place to start. But these weaknesses are often hard to address. They require not just technical solutions, but a lot of thought, coordination, planning, and continual re-evaluation. Most often thought of as technical problems, compliance frameworks provide a solid starting point for properly framing the thought, coordination, planning, and continual re-evaluation that is necessary. Our guest, Terry McGraw will walk us through these solutions and the support that compliance frameworks provide to ensure continued success. Terry is a retired Lieutenant Colonel from the United States Army and now serves the CEO of Cape Endeavors, Inc, with over 20 years of providing expertise in cyber security threat analysis, security architectural design, network operations and incident response for both commercial and government sectors. Links: <ul> <li><a href= "https://www.linkedin.com/pulse/ransomware-stages-grief-terry-mcgraw/" target="_blank" rel="noopener">Ransomware Stages of Grief</a></li> <li><a href= "https://www.secureworks.com/-/media/Files/US/Reports/state%20of%20the%20threat/secureworks-state-of-the-threat-report-2024.ashx" target="_blank" rel="noopener">2024 State of the Threat – A Year in Review</a></li> <li><a href= "https://www.cm-alliance.com/cybersecurity-blog/detecting-top-initial-attack-vectors-in-2024" target="_blank" rel="noopener">Detecting Top Initial Attack Vectors in 2024</a></li> <li><a href= "https://www.darkreading.com/threat-intelligence/three-common-initial-attack-vectors-account-for-most-ransomware-campaigns" target="_blank" rel="noopener">3 Common Initial Attack Vectors Account for Most Ransomware Campaigns</a></li> <li><a href= "https://www.secureworks.com/-/media/files/us/white-papers/secureworksse1keepingtabsonaconstantlyevolvingthreatlandscape.pdf" target="_blank" rel="noopener">Meeting a Greater Demand for Cybersecurity</a></li> </ul>

<description>&lt;p class="MsoNormal"&gt;The news about cybercrime is overwhelming to those who fight to secure our organizations. Cybercrime organizations are sophisticated and constantly changing. But there’s a hidden truth in cybercrime attacks: cybercriminals exploit the same weaknesses they’ve been exploiting for years. This should give us some hope; we know where our organizations are weakest, which gives us a good place to start. But these weaknesses are often hard to address. They require not just technical solutions, but a lot of thought, coordination, planning, and continual re-evaluation. Most often thought of as technical problems, compliance frameworks provide a solid starting point for properly framing the thought, coordination, planning, and continual re-evaluation that is necessary.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Our guest, Terry McGraw will walk us through these solutions and the support that compliance frameworks provide to ensure continued success. Terry is a retired Lieutenant Colonel from the United States Army and now serves the CEO of Cape Endeavors, Inc, with over 20 years of providing expertise in cyber security threat analysis, security architectural design, network operations and incident response for both commercial and government sectors.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Links:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;!-- [if !supportLists]--&gt;&lt;a href= "https://www.linkedin.com/pulse/ransomware-stages-grief-terry-mcgraw/" target="_blank" rel="noopener"&gt;Ransomware Stages of Grief&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href= "https://www.secureworks.com/-/media/Files/US/Reports/state%20of%20the%20threat/secureworks-state-of-the-threat-report-2024.ashx" target="_blank" rel="noopener"&gt;2024 State of the Threat – A Year in Review&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href= "https://www.cm-alliance.com/cybersecurity-blog/detecting-top-initial-attack-vectors-in-2024" target="_blank" rel="noopener"&gt;Detecting Top Initial Attack Vectors in 2024&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href= "https://www.darkreading.com/threat-intelligence/three-common-initial-attack-vectors-account-for-most-ransomware-campaigns" target="_blank" rel="noopener"&gt;3 Common Initial Attack Vectors Account for Most Ransomware Campaigns&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href= "https://www.secureworks.com/-/media/files/us/white-papers/secureworksse1keepingtabsonaconstantlyevolvingthreatlandscape.pdf" target="_blank" rel="noopener"&gt;Meeting a Greater Demand for Cybersecurity&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p class="MsoNormal" style="margin-left: .25in;"&gt; &lt;/p&gt;</description>

The news about cybercrime is overwhelming to those who fight to secure our organizations. Cybercrime organizations are sophisticated and constantly changing. But there’s a hidden truth in cybercrime attacks: cybercriminals exploit the same...

9 - Cybercrime–The Landscape – Part 1/4

CMMC’s security requirements are not new. What is new about CMMC is the level of rigor. With the recent publication of the CMMC rule, DoD is ever closer to requiring contractors to comply with CMMC security requirements and back them up with an assessment. The CMMC Rule, like any new regulation, is packed with details. Details that have been rumored, speculated, and drafted. Now that they’re known and final, we’re here to help you see clearer. In today’s episode, our host, Cole French becomes the expert guest. As Director of Cybersecurity Services and CMMC Capability Lead at Kratos, Cole answers all the questions you might still have about CMMC and its impact on your organization: ·       When will assessments start? ·       What can my organization do now? ·       When will CMMC be required in DoD contracts? ·       How does the rule impact my use of external service providers? ·       Can I qualify for a self-assessment or must I go through a C3PAO assessment? And more! Links: <ul> <li class="MsoNormal"><a href= "https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program">The Rule</a></li> <li class="MsoNormal"><a href= "https://www.kratoscyber.com/-/media/k/pdf/s/c/ds-369-prepare-for-cmmc-certifications.pdf">Kratos’ CMMC Services Data Sheet</a></li> <li class="MsoNormal"><a href= "https://dodcio.defense.gov/Portals/0/Documents/CMMC/CMMC101.pdf">DoD’s CMMC Overview</a></li> <li class="MsoNormal" style= "color: #212529; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list .5in; background: white;"> <a href= "https://www.kratoscyber.com/cmmc/7-key-takeaways-to-help-you-move-forward"> CMMC’s New Rule Has Finally Arrived: 7 Key Takeaways to Help You Move Forward</a></li> </ul>

<description>&lt;p class="MsoNormal"&gt;CMMC’s security requirements are not new. What is new about CMMC is the level of rigor. With the recent publication of the CMMC rule, DoD is ever closer to requiring contractors to comply with CMMC security requirements and back them up with an assessment. The CMMC Rule, like any new regulation, is packed with details. Details that have been rumored, speculated, and drafted. Now that they’re known and final, we’re here to help you see clearer.&lt;/p&gt; &lt;p class="MsoNormal"&gt;In today’s episode, our host, Cole French becomes the expert guest. As Director of Cybersecurity Services and CMMC Capability Lead at Kratos, Cole answers all the questions you might still have about CMMC and its impact on your organization:&lt;/p&gt; &lt;p class="MsoListParagraphCxSpFirst" style= "text-indent: -.25in; mso-list: l0 level1 lfo2;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;      &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;When will assessments start?&lt;/p&gt; &lt;p class="MsoListParagraphCxSpMiddle" style= "text-indent: -.25in; mso-list: l0 level1 lfo2;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;      &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;What can my organization do now?&lt;/p&gt; &lt;p class="MsoListParagraphCxSpMiddle" style= "text-indent: -.25in; mso-list: l0 level1 lfo2;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;      &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;When will CMMC be required in DoD contracts?&lt;/p&gt; &lt;p class="MsoListParagraphCxSpMiddle" style= "text-indent: -.25in; mso-list: l0 level1 lfo2;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;      &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;How does the rule impact my use of external service providers?&lt;/p&gt; &lt;p class="MsoListParagraphCxSpLast" style= "text-indent: -.25in; mso-list: l0 level1 lfo2;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;      &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;Can I qualify for a self-assessment or must I go through a C3PAO &lt;span data-teams="true"&gt;&lt;span class= "ui-provider a b c d e f g h i j k l m n o p q r s t u v w x y z ab ac ae af ag ah ai aj ak" dir="ltr"&gt;assessment&lt;/span&gt;&lt;/span&gt;?&lt;/p&gt; &lt;p class="MsoNormal"&gt;And more!&lt;/p&gt; &lt;p class="MsoNormal"&gt;Links:&lt;/p&gt; &lt;ul&gt; &lt;li class="MsoNormal"&gt;&lt;!-- [if !supportLists]--&gt;&lt;a href= "https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program"&gt;The Rule&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal"&gt;&lt;!-- [if !supportLists]--&gt;&lt;a href= "https://www.kratoscyber.com/-/media/k/pdf/s/c/ds-369-prepare-for-cmmc-certifications.pdf"&gt;Kratos’ CMMC Services Data Sheet&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal"&gt;&lt;a href= "https://dodcio.defense.gov/Portals/0/Documents/CMMC/CMMC101.pdf"&gt;DoD’s CMMC Overview&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal" style= "color: #212529; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list .5in; background: white;"&gt; &lt;span style= "font-size: 12.0pt; font-family: 'Arial',sans-serif; mso-fareast-font-family: 'Times New Roman';"&gt; &lt;a href= "https://www.kratoscyber.com/cmmc/7-key-takeaways-to-help-you-move-forward"&gt; &lt;span style="color: #731b36;"&gt;CMMC’s New Rule Has Finally Arrived: 7 Key Takeaways to Help You Move Forward&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;&lt;/li&gt; &lt;/ul&gt;</description>

CMMC’s security requirements are not new. What is new about CMMC is the level of rigor. With the recent publication of the CMMC rule, DoD is ever closer to requiring contractors to comply with CMMC security requirements and back them up with an...

8 - The CMMC Rule … Finally

AI is bringing speed and velocity never seen before. Some studies show that the output is the equivalent to what 35-40 humans can produce. This speed and velocity is applied to countless use cases across just about every economic sector. Cybersecurity compliance is laden with repetitive, redundant, and time-consuming manual tasks. While humans bring nuanced ingenuity and problem-solving capabilities, we are prone to errors, especially across such repetitive, redundant, and time-consuming tasks. Worse, cybersecurity compliance requirements are far from standardized, though there is a tremendous amount of overlap. In these circumstances, humans take short cuts. It’s not a matter of whether short cuts result in errors, only how many errors. The real power of AI in the world of cybersecurity compliance is the ability to bridge all gaps of compliance documentation with minimal to no errors. Furthermore, AI can then be trained to leverage compliance documentation to code and perform actual tasks within a system. In the world of cybersecurity, AI opens the doors to a world in which security truly is baked in from the beginning. Today’s guest is Nic Chaillan, technology entrepreneur, software developer, cyber expert and inventor. He has over 23 years of domestic and international experience with strong technical and subject matter expertise in cybersecurity, software development, product innovation, governance, risk management and compliance. Specifically, these fields include Cloud computing, Cybersecurity, DevSecOps, Big Data, multi-touch, mobile, IoT, Mixed Reality, VR, and wearables. Resources: ·         AskSage Training Materials: <a href= "https://chat.asksage.ai">https://chat.asksage.ai</a>

<description>&lt;p class="MsoNormal"&gt;AI is bringing speed and velocity never seen before. Some studies show that the output is the equivalent to what 35-40 humans can produce. This speed and velocity is applied to countless use cases across just about every economic sector. Cybersecurity compliance is laden with repetitive, redundant, and time-consuming manual tasks. While humans bring nuanced ingenuity and problem-solving capabilities, we are prone to errors, especially across such repetitive, redundant, and time-consuming tasks. Worse, cybersecurity compliance requirements are far from standardized, though there is a tremendous amount of overlap. In these circumstances, humans take short cuts. It’s not a matter of whether short cuts result in errors, only how many errors. The real power of AI in the world of cybersecurity compliance is the ability to bridge all gaps of compliance documentation with minimal to no errors. Furthermore, AI can then be trained to leverage compliance documentation to code and perform actual tasks within a system. In the world of cybersecurity, AI opens the doors to a world in which security truly is baked in from the beginning.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Today’s guest is Nic Chaillan, technology entrepreneur, software developer, cyber expert and inventor. He has over 23 years of domestic and international experience with strong technical and subject matter expertise in cybersecurity, software development, product innovation, governance, risk management and compliance. Specifically, these fields include Cloud computing, Cybersecurity, DevSecOps, Big Data, multi-touch, mobile, IoT, Mixed Reality, VR, and wearables.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Resources:&lt;/p&gt; &lt;p class="MsoListParagraph" style= "text-indent: -.25in; mso-list: l0 level1 lfo1;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;        &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;AskSage Training Materials: &lt;a href= "https://chat.asksage.ai"&gt;https://chat.asksage.ai&lt;/a&gt;&lt;/p&gt;</description>

AI is bringing speed and velocity never seen before. Some studies show that the output is the equivalent to what 35-40 humans can produce. This speed and velocity is applied to countless use cases across just about every economic sector. Cybersecurity...

7 - AI and Cyber Compliance

Supply chain security is not new, though it certainly feels as though it is. Thanks to globalization, supply chains are ever growing in their depth, complexity, and interconnectedness. Unfortunately, like so many other systems, security of supply chains hasn’t been at the top of the list of things to consider when evaluating supply chains. Understandably, economics led the way. A supply chain exists to foster economic growth and profit-making. None of these are bad but there’s a painful irony: the less security is considered, the greater the costs, which drives down growth and profit-making. Costs aren’t just financial, either. The cost of losing a competitive edge is significant but almost impossible to quantify in dollars. It runs much deeper. As data theft has proliferated on an unprecedented scale, the need for securing supply chains has begun it’s rise to the top of our consciousness. The intriguing thing about supply chain security is that it isn’t all that different than traditional risk management activities. Today’s guest is John Santore, Director of Cybersecurity Services here at Kratos. Together, we’ll dive into supply chain security. We’ll outline what a supply chain is, what to consider when evaluating your supply chain, some of the challenges you might encounter along the way and we’ll outline a basic supply chain risk management approach. Resources: The core tenants of a supply chain risk management approach: <ul> <li>Inventory your supply chain</li> <li>Ensure strong relationships are in place with those in your supply chain</li> <li>Develop criteria for evaluating the risk of suppliers within your organization</li> <li>Work with your suppliers to obtain the information necessary to perform the evaluation</li> <li>Develop a process for scrutinizing suppliers that are identified as high-risk</li> <li>Repeat the process on a defined frequency</li> <li>Ensure that it is applied as part of any supplier intake</li> </ul> Links: <ul> <li class="MsoNormal"><a href= "https://doi.org/10.6028/NIST.SP.800-161r1">NIST SP 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations</a></li> <li class="MsoNormal"><a style= "text-align: justify; text-indent: -0.25in;" href= "https://csrc.nist.gov/csrc/media/Projects/cyber-supply-chain-risk-management/documents/20240719_C-SCRMFactSheetFinal.pdf"> C-SCRM Factsheet</a></li> <li class="MsoNormal"><a style= "text-align: justify; text-indent: -0.25in;" href= "https://doi.org/10.6028/NIST.SP.800-218">NIST SP 800-218: Secure Software Development Framework</a></li> <li class="MsoNormal"><a style="text-indent: -0.25in;" href= "https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/"> Executive Order 14028</a></li> <li class="MsoNormal"><a style="text-indent: -0.25in;" href= "https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf"> OMB M-22-18</a></li> <li class="MsoNormal"><a style="text-indent: -0.25in;" href= "https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security-1.pdf"> OMB M-23-16</a></li> </ul>

<description>&lt;p class="MsoNormal"&gt;Supply chain security is not new, though it certainly feels as though it is. Thanks to globalization, supply chains are ever growing in their depth, complexity, and interconnectedness. Unfortunately, like so many other systems, security of supply chains hasn’t been at the top of the list of things to consider when evaluating supply chains. Understandably, economics led the way. A supply chain exists to foster economic growth and profit-making. None of these are bad but there’s a painful irony: the less security is considered, the greater the costs, which drives down growth and profit-making. Costs aren’t just financial, either. The cost of losing a competitive edge is significant but almost impossible to quantify in dollars. It runs much deeper. As data theft has proliferated on an unprecedented scale, the need for securing supply chains has begun it’s rise to the top of our consciousness. The intriguing thing about supply chain security is that it isn’t all that different than traditional risk management activities.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Today’s guest is John Santore, Director of Cybersecurity Services here at Kratos. Together, we’ll dive into supply chain security. We’ll outline what a supply chain is, what to consider when evaluating your supply chain, some of the challenges you might encounter along the way and we’ll outline a basic supply chain risk management approach.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Resources:&lt;/p&gt; &lt;p&gt;The core tenants of a supply chain risk management approach:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;!-- [if !supportLists]--&gt;Inventory your supply chain&lt;/li&gt; &lt;li&gt;&lt;span style="text-indent: -0.25in;"&gt;Ensure strong relationships are in place with those in your supply chain&lt;/span&gt;&lt;/li&gt; &lt;li&gt;&lt;span style="text-indent: -0.25in;"&gt;Develop criteria for evaluating the risk of suppliers within your organization&lt;/span&gt;&lt;/li&gt; &lt;li&gt;&lt;span style="text-indent: -0.25in;"&gt;Work with your suppliers to obtain the information necessary to perform the evaluation&lt;/span&gt;&lt;/li&gt; &lt;li&gt;&lt;span style="text-indent: -0.25in;"&gt;D&lt;/span&gt;&lt;span style= "text-indent: -0.25in;"&gt;evelop a process for scrutinizing suppliers that are identified as high-risk&lt;/span&gt;&lt;/li&gt; &lt;li&gt;&lt;span style="text-indent: -0.25in;"&gt;Repeat the process on a defined frequency&lt;/span&gt;&lt;/li&gt; &lt;li&gt;&lt;span style="text-indent: -0.25in;"&gt;Ensure that it is applied as part of any supplier intake&lt;/span&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p class="MsoNormal"&gt;Links:&lt;/p&gt; &lt;ul&gt; &lt;li class="MsoNormal"&gt;&lt;!-- [if !supportLists]--&gt;&lt;a href= "https://doi.org/10.6028/NIST.SP.800-161r1"&gt;NIST SP 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal"&gt;&lt;a style= "text-align: justify; text-indent: -0.25in;" href= "https://csrc.nist.gov/csrc/media/Projects/cyber-supply-chain-risk-management/documents/20240719_C-SCRMFactSheetFinal.pdf"&gt; C-SCRM Factsheet&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal"&gt;&lt;a style= "text-align: justify; text-indent: -0.25in;" href= "https://doi.org/10.6028/NIST.SP.800-218"&gt;NIST SP 800-218: Secure Software Development Framework&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal"&gt;&lt;a style="text-indent: -0.25in;" href= "https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/"&gt; Executive Order 14028&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal"&gt;&lt;a style="text-indent: -0.25in;" href= "https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf"&gt; OMB M-22-18&lt;/a&gt;&lt;/li&gt; &lt;li class="MsoNormal"&gt;&lt;a style="text-indent: -0.25in;" href= "https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security-1.pdf"&gt; OMB M-23-16&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt;</description>

Supply chain security is not new, though it certainly feels as though it is. Thanks to globalization, supply chains are ever growing in their depth, complexity, and interconnectedness. Unfortunately, like so many other systems, security of supply...

6 - Supply Chain Security

IT support is tricky for most businesses, especially for those not in the IT business. Thus, IT is a cost of doing business and a high cost at that. High costs drive down profits. Less profit makes it harder for businesses to invest in the products or services that they’re making and selling. Retaining IT staff is even more difficult. This is due to the extremely low unemployment rate and the higher-than-average annual salary. These two factors almost guarantee that IT staff hired by non-IT businesses will eventually get a better offer some place else. To mitigate the problem with IT staff, businesses have turned to outsourcing to managed service providers or external service providers. By doing so businesses are giving up the information necessary to make well-informed choices, instead choosing to trust the IT service providers they’re buying from. This asymmetry of information creates a market phenomenon called a market for lemons. A market for lemons phenomenon exists when sellers hold more knowledge than buyers. Because buyers are price-sensitive and are only willing to pay a certain price the market becomes distorted such that high-quality sellers are gobbled up quickly and the market is left with lemons. In sum, the market for lemons works to drive quality out of the market. Today’s guest is Andy Paul. Andy is an engineer, data privacy professional and a Certified CMMC Assessor from Gray Analytics with more than 15 years of experience helping firms design, implement and secure everything from globally spanning networks to small boutique and highly specified and regulated networks. During our conversation, we discuss the current situation in the IT services market, the market for lemons phenomenon, how the CMMC ecosystem is setup to alleviate the problems that markets for lemons introduce, and how you can outsource confidently. Resources: Links: ·       <a href= "https://www.sfu.ca/~wainwrig/Econ400/akerlof.pdf">George Akerlof – The Quarterly Journal of Economics, Vol. 84, No. 3 (Aug. 1970), pp. 488-500</a> ·       <a href="https://cyberab.org/Catalog">Cyber AB Marketplace</a>

<description>&lt;p class="MsoNormal"&gt;IT support is tricky for most businesses, especially for those not in the IT business. Thus, IT is a cost of doing business and a high cost at that. High costs drive down profits. Less profit makes it harder for businesses to invest in the products or services that they’re making and selling. Retaining IT staff is even more difficult. This is due to the extremely low unemployment rate and the higher-than-average annual salary. These two factors almost guarantee that IT staff hired by non-IT businesses will eventually get a better offer some place else. To mitigate the problem with IT staff, businesses have turned to outsourcing to managed service providers or external service providers. By doing so businesses are giving up the information necessary to make well-informed choices, instead choosing to trust the IT service providers they’re buying from. This asymmetry of information creates a market phenomenon called a market for lemons. A market for lemons phenomenon exists when sellers hold more knowledge than buyers. Because buyers are price-sensitive and are only willing to pay a certain price the market becomes distorted such that high-quality sellers are gobbled up quickly and the market is left with lemons. In sum, the market for lemons works to drive quality out of the market.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Today’s guest is Andy Paul. Andy is an engineer, data privacy professional and a Certified CMMC Assessor from Gray Analytics with more than 15 years of experience helping firms design, implement and secure everything from globally spanning networks to small boutique and highly specified and regulated networks. During our conversation, we discuss the current situation in the IT services market, the market for lemons phenomenon, how the CMMC ecosystem is setup to alleviate the problems that markets for lemons introduce, and how you can outsource confidently.&lt;/p&gt; &lt;p class="MsoNormal"&gt;Resources:&lt;/p&gt; &lt;p class="MsoNormal"&gt;Links:&lt;/p&gt; &lt;p class="MsoListParagraphCxSpFirst" style= "text-indent: -.25in; mso-list: l0 level1 lfo1;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;      &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;&lt;a href= "https://www.sfu.ca/~wainwrig/Econ400/akerlof.pdf"&gt;George Akerlof – The Quarterly Journal of Economics, Vol. 84, No. 3 (Aug. 1970), pp. 488-500&lt;/a&gt;&lt;/p&gt; &lt;p class="MsoListParagraphCxSpLast" style= "text-indent: -.25in; mso-list: l0 level1 lfo1;"&gt; &lt;!-- [if !supportLists]--&gt;&lt;span style= "font-family: Symbol; mso-fareast-font-family: Symbol; mso-bidi-font-family: Symbol;"&gt;&lt;span style="mso-list: Ignore;"&gt;·&lt;span style="font: 7.0pt 'Times New Roman';"&gt;      &lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;!--[endif]--&gt;&lt;a href="https://cyberab.org/Catalog"&gt;Cyber AB Marketplace&lt;/a&gt;&lt;/p&gt;</description>

IT support is tricky for most businesses, especially for those not in the IT business. Thus, IT is a cost of doing business and a high cost at that. High costs drive down profits. Less profit makes it harder for businesses to invest in the products or...

5 - The Market for Lemons

Welcome to “Cyber Compliance and Beyond,” a Kratos podcast that will bring clarity to compliance, helping put you in control of cybersecurity compliance in your organization. 

Kratos is a leading cybersecurity compliance advisory and assessment organization, providing services to both government and commercial clients across varying sectors including defense, space, satellite, financial services, and health care. Through "Cyber Compliance and Beyond," our cyber team of experts will share their insights on the latest compliance issues. 

We want to hear from you! What unanswered question would you like us to tackle? Is there a topic you’d like us to discuss? Or do you just have some feedback for us? Let us know on Linked and Twitter at Kratos Defense or by email at ccbeyond@kratosdefense.com.

Cyber Compliance & Beyond

Details

Recent Episodes