Get Your Company and Team On Track for Cybersecurity Maturity Model Certification (CMMC)
Get Your Company and Team On Track for Cybersecurity Maturity Model Certification (CMMC) Risk Awareness Now | GeoCyber Systems LLC
📅 Saturday, April 18, 2026 ⏰ 9:30 AM – 1:45 PM PT | 11:30 AM – 3:45 PM CT | 12:30 – 4:45 PM ET 📍 Virtual Event – YouTube Live 💰 Free
About This Event
According to a 2025 industry study, only 1% of Defense Industrial Base organizations surveyed feel fully prepared for CMMC assessments. Fewer than 50% have completed foundational documentation. Between 33,000 and 44,000 companies are expected to exit the defense market by 2027 because compliance costs exceed their ability to absorb them.
And now the GAO has confirmed what practitioners have been saying for months: as of March 2026, the Department of Defense does not have a documented plan to address the assessor shortage. Certified assessors are already booked well into 2026. Organizations that wait are not buying time. They are losing it.
Most organizations know CMMC is coming. Fewer know what to actually do about it.
Phase 1 of the CMMC rollout began November 10, 2025. Phase 2 -- which requires third-party certification for most contractors handling Controlled Unclassified Information -- begins November 10, 2026. Under 600 certified assessors exist today against a need of 2,000 to 3,000. Many C3PAOs are already booked through 2026. The window to get on track is closing faster than most organizations realize.
This practitioner-led event brings together compliance specialists, organizational leaders, and workforce advocates to cut through the confusion and give you a clear, actionable picture of what CMMC means for your company, your team, and your career.
Whether you are a small business owner trying to keep your DoD contracts, a leader who has been handed a compliance mandate, a cybersecurity professional building toward certification, or someone looking to enter the field through the compliance pathway -- this event is built for you.
Each session stands on its own. Attend one or attend all four hours.
Who Should Attend
Small business owners and defense contractors navigating CMMC compliance
Organizational leaders responsible for cybersecurity posture and readiness
Cybersecurity professionals pursuing CCP, CCA, or related certifications
Workforce professionals and career pivoters entering the cybersecurity and compliance space
Program managers and prime contractors managing subcontractor compliance requirements
Anyone who has heard of CMMC and does not yet know what it means for their organization
What You Will Learn
What CMMC actually requires at each level and what the deadlines mean for your contracts
How to assess your organization's readiness and where most companies fall short
What the three dimensions of CMMC look like from a leadership and organizational perspective
How small businesses can navigate compliance without being overwhelmed by cost and complexity
What the CCP and CCA certification pathways look like and how RMF and NIST 800-171 fit in
How AI and automation are reshaping compliance workflows and what that means for the future of DIB security
Agenda
🟠 Opening -- 30 Minutes The CMMC Landscape: Where We Are and What It Means
🕤 9:30 – 10:00 AM PT | 11:30 AM – 12:00 PM CT | 12:30 – 1:00 PM ET
Host and Moderator: Philippa Burgess, NICE Cybersecurity Career Ambassador | GeoCyber Systems LLC
Topics include:
Why CMMC exists and what problem it was designed to solve
Where we are in the phased rollout and what the November 2026 deadline means
What the GAO's March 2026 findings reveal about systemic gaps in program implementation
The readiness gap across the DIB and why most organizations are still behind
How this event is structured and how to get the most from each session
🔵 Session 1 - CMMC from Three Sides: Compliance, Leadership, and the Workforce
🕙 10:00 – 10:45 AM PT | 12:00 – 12:45 PM CT | 1:00 – 1:45 PM ET
Panelists: Dirce Eduardo Hernandez, A-CCISO, CISM, CRISC, CISA, CDPSE, CSX, Rae McElroy, CMMC RP, John McNicholas, and Frank Unpingco III
Moderator: Philippa Burgess
This panel brings together three practitioners with distinct vantage points on CMMC -- the organizational, the technical, and the human. Together they map the full picture of what getting on track actually requires.
Topics include:
The three dimensions of CMMC most organizations overlook
Where leadership, IT, and compliance ownership break down inside organizations
What small businesses face that larger contractors do not
Workforce pathways into the compliance ecosystem
The most common misconceptions about what CMMC requires and when
Takeaway: Leave with a clear mental model of CMMC as an organizational challenge -- not just a technical checklist -- and understand which dimension applies most urgently to your situation.
🟢 Session 2 - CMMC and the Small Business Reality: Compliance Without Getting Overwhelmed
🕥 10:45 – 11:30 AM PT | 12:45 – 1:30 PM CT | 1:45 – 2:30 PM ET
Speaker: Rae McElroy, CMMC RP
Topics include:
What CMMC Level 1 and Level 2 actually mean for small businesses and subcontractors
How prime contractors are using CMMC readiness to filter their supply chains right now
Cost realities: what self-assessment vs. third-party certification actually involves
Practical first steps: gap analysis, SSP, POA&M, and SPRS scoring
Resources and support available to small businesses navigating compliance
Takeaway: Walk away with a realistic starting point -- what to prioritize, what it will cost, and what happens if you wait.
🟡 Session 3 - Organizational Readiness for CMMC: What Leadership Needs to Own
🕦 11:30 AM – 12:15 PM PT | 1:30 – 2:15 PM CT | 2:30 – 3:15 PM ET
Speaker: Frank Unpingco III
Topics include:
The three sides of CMMC every leadership team needs to understand
Why CMMC is not just an IT problem and what organizational ownership looks like
How to align leadership, operations, and cybersecurity teams around a compliance roadmap
What happens when compliance is delegated without adequate resourcing or authority
Building a culture of cybersecurity readiness that goes beyond certification
Takeaway: A leadership-level framework for assigning ownership, resourcing compliance properly, and building the internal momentum needed to meet the deadline.
🟠 Session 4 - CMMC Certification Pathways: CCP, CCA, RMF, and NIST 800-171
🕧 12:15 – 1:00 PM PT | 2:15 – 3:00 PM CT | 3:15 – 4:00 PM ET
Speaker: John McNicholas
Topics include:
What the CCP and CCA certifications require and who should pursue them
How RMF experience maps to CMMC compliance work
NIST SP 800-171 as the foundation of Level 2 and what full implementation looks like
The C3PAO assessment process and what to expect during a third-party review
Career pathways into CMMC compliance work for cybersecurity professionals and career pivoters
Takeaway: Whether you are building credentials or building a team, leave with a clear picture of the certification landscape and where to start.
🟣 Session 5 -- 45 Minutes CMMC Beyond Compliance: AI Governance, Identity, and the Future of DIB Security
🕐 1:00 – 1:45 PM PT | 3:00 – 3:45 PM CT | 4:00 – 4:45 PM ET
Speaker: Dirce Eduardo Hernandez, A-CCISO, CISM, CRISC, CISA, CDPSE, CSX
Topics include:
How AI governance frameworks intersect with CMMC compliance programs and what organizations need to own now
Identity security as a foundational layer of CMMC readiness and where most organizations leave it exposed
Insider threat considerations specific to the DIB and how to build detection into your compliance posture
What GRC maturity from the financial sector can teach defense contractors about sustained compliance
The evolving regulatory landscape and why CMMC certification is a floor, not a ceiling
Takeaway: Compliance gets you certified. This session shows you what a mature, AI-informed security posture looks like past the audit -- and why identity and insider threat are the two variables most organizations underestimate until it is too late.
Why This Event Exists
A March 2026 GAO report found that the DoD does not have a documented strategy to address the external factors most likely to derail CMMC implementation, including the assessor shortage that is already pushing wait times for new clients past 18 months.
The burden of figuring this out falls on contractors, small businesses, and the workforce. This event exists to help carry that burden.
Host and Moderator: Philippa Burgess, NICE Cybersecurity Career Ambassador | GeoCyber Systems LLC