// Field Notes
From the front line of compliance
AI attacks, threat intelligence & the Veytruss defense →Podcasts, talks & interviews
The Evolving World of Cybersecurity Compliance
IT Matters Podcast · Ep. 39
CMMC levels, why 80–90% of the work is documentation, the scoping gotcha, and why you need one internal owner.
Listen / watch ↗Creating a Resilient Compliance Culture with CMMC
SecureWorld Charlotte 2026
Moving from a checkbox mindset to a sustainable culture of compliance.
Listen / watch ↗Navigating the Current State of CMMC
Advancing Construction Cybersecurity
Why CMMC is a business-critical priority for construction and fabrication firms, and how to start.
Listen / watch ↗CMMC Compliance, Georgia Tech and Zero Trust
Cybersecurity Podcast (co-host)
The DOJ whistleblower case over NIST 800-171 non-compliance, and what Zero Trust really means.
Listen / watch ↗Compliance, CMMC and the CrowdStrike outage
Cybersecurity Podcast (co-host) with Joe Anderson
A conversation on compliance, CMMC readiness and lessons from the CrowdStrike incident.
Listen / watch ↗Articles
Phase 03
80–90% of CMMC is documentation. Here's how to do it right.
The technical controls are often already in your Microsoft tenant. The real work is proving your policies match what you actually do.
6 min read →
Phase 00–02
Your first 30 days toward CMMC Level 2
If you're starting now, you're behind — but a focused first month can get you scoped, owned, and scored.
5 min read →
Scoping
GCC High: do you actually need it?
Microsoft GCC High is powerful and expensive. Here's how to decide whether your CUI footprint justifies it.
7 min read →
Leadership
Compliance should help the business, not hold it back
Stop blaming security. The best programs find creative answers that are just as secure and keep the mission moving.
4 min read →