# David M.

David M. creates RMF Pro, a training resource for people working in federal cybersecurity and governance, risk, and compliance (GRC). Their posts focus on applying risk-management practices, including FedRAMP cloud controls and hands-on STIG scenarios.

- Profile: https://b2binfluencer.marketing/creators/david-m/
- LinkedIn: https://www.linkedin.com/in/david-mciltrot
- LinkedIn followers: 1,172
- Based on 11 dated posts, latest 2026-10-20

## Summary

They are most useful for reaching federal GRC practitioners with practical FedRAMP and STIG content.

- Best for: A compliance automation or cloud key-management vendor campaign about inherited and shared controls.
- Not for: A consumer cybersecurity brand seeking broad awareness and mass reach.
- Check first: Ask for available sponsorship terms, rates, deliverables, and an inquiry route.

### Takeaways

- Inherited cloud controls still need documentation and ownership in the authorization package.
- Hands-on STIG scenarios cover five platforms, including mainframe.
- Assessor and administrator conflict is usually a difference in vantage point.

## Main ideas

- **Inherited cloud controls still need documentation and ownership**: David M. challenges the idea that once a FedRAMP-certified cloud provider supplies controls, a customer can stop thinking about them. A platform may cover personnel, physical, and environmental controls, but inherited does not mean handled and forgotten. Those controls still belong in the authorization package, and many are shared or hybrid, so the customer must document its side. The provider's shared responsibility matrix shows where responsibility divides.
- **Knowing the rules is not the same skill as applying judgment**: David M. points to a gap between passing certifications and making decisions on a live system. Studying rules and recognizing them in actual configurations demand different abilities, and the judgment step is usually learned on the job. RMF Pro is built to rehearse that step through simulated, real-world scenarios, letting people practice audits or defend implementations to an authorizing official before facing them for real.
- **Assessor and administrator conflict is usually a difference in vantage point**: In federal risk assessments, David M. describes a tension between auditors and administrators. Assessors want documentation, traceability, and defensible positions; system owners and administrators want working systems, met deadlines, and mission progress. They are not in disagreement about outcomes, David M. argues, only about what the work looks like from their chairs. The recommended move is to step into the other role's position and ask what they are trying to accomplish.
- **Certification dues are also a route to influence, not just a badge**: David M. treats certification as the usual first stop for a federal GRC career, but distinguishes the credential from the studied judgment that follows. They also argue that annual dues to a certifying body such as ISACA give members more than a credential: a voice in how the body operates. Practitioners should use that voice rather than treat dues as a transaction.

## Work to read

- [Inherited cloud controls still need to be documented](https://www.linkedin.com/posts/david-mciltrot_rmf-cloudcomputing-nist-activity-7489732143573667840-78j7)
- [Hands-on STIG scenarios across five platforms, including mainframe](https://www.linkedin.com/posts/david-mciltrot_grc-nist-rmf-activity-7486564426129723392-2tGT)
- [The gap between passing a certification and making a judgement call](https://www.linkedin.com/posts/david-mciltrot_grc-cybersecurity-nist-activity-7488665099730190355-wN6v)
- [Assessors and administrators want the same outcome from different chairs](https://www.linkedin.com/posts/david-mciltrot_isso-grc-cybersecurity-activity-7491309827579748352-cDWw)
- [Certification dues buy a voice in the issuing body, not just a badge](https://www.linkedin.com/posts/david-mciltrot_certifications-isaca-grc-activity-7514334245595754496-tINh)

## Brand relationships

- **RMF Pro** (owned_business)
- **ISACA** (mention)

## Partnerships

David M.'s posts describe no sponsorship, advertising, or paid-partnership formats. The one commercial product they discuss is RMF Pro, a training simulator they say they built for federal risk-management and STIG practice, promoted through a link in the comments of two posts; that is their own offering, not a sponsorship placement. The remaining posts are practice commentary and a note about ISACA membership dues and bylaw voting, which is a professional membership rather than a partnership arrangement. No media kit, sponsor policy, rate card, audience specification, or partnership inquiry route appears in the posts here, and the LinkedIn profile is the only official link mentioned. Ask directly about formats, rates, deliverables, availability, audience details, sponsor policy, and how to inquire.

## Alternatives

- Keith Mayfield: Choose Keith Mayfield when the campaign's buyer is a cloud service provider or independent software vendor weighing whether to pursue FedRAMP authorization at all, and the vendor sells FedRAMP readiness, authorization support, or compliance services to those sellers. Mayfield's posts frame authorization as a market-access and revenue decision: FedRAMP Moderate or Moderate Equivalency is a requirement for cloud companies serving the DoD supply chain, the authorization process can run 12–18 months against a November 2026 CMMC enforcement deadline, and holding an authorization disqualifies competitors before an RFP drops. That eligibility-and-pipeline framing suits a vendor whose offer is the business case for authorization and the path to it, rather than the control-level work inside the package.
- Thomas Ward: Choose Thomas Ward when the campaign targets defense contractors and their leadership who are unsettled by program changes and are deciding what to do next. Ward's post on the CMMC Phase II pause argues that NIST SP 800-171 obligations continue regardless of the certification timeline, and lists the work to keep doing: implementing and maturing controls, remediating gaps, writing policies that hold up in daily operations, preparing for future assessments in whatever form they take, and reducing risk instead of chasing an audit pass. A vendor selling fractional CISO services, gap assessments, SSP and POA&M development, or program-level compliance advisory can reach that buyer through Ward's framing.
- David Meece, MSc, MBA: Choose David Meece when the campaign is about the cybersecurity workforce rather than authorization mechanics: recruiting, career entry, mentorship, or community building. Meece's posts introduce Stronger Together: Women in Cybersecurity, a book of more than 100 women's stories in IT and cybersecurity whose proceeds go to WiCyS scholarships, and open their network to people looking for cybersecurity jobs with a three-step routine for introductions, commenting, and repetition. A vendor selling training, certification preparation, recruiting tools, or community programs can pair with that audience.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/