David M.

A platform may cover personnel, physical, and environmental controls, but inherited does not mean handled and forgotten.

• Those controls still belong in the authorization package, and many are shared or hybrid, so the customer must document its side.
• The provider's shared responsibility matrix shows where responsibility divides.

The clearest example is storage encryption: the cloud service provider may encrypt the storage, while the customer manages the keys and access policies that govern it. Responsibility is therefore shared, not purely inherited or customer-owned.

Read original

Studying rules and recognizing them in actual configurations demand different abilities, and the judgment step is usually learned on the job. RMF Pro is built to rehearse that step through simulated, real-world scenarios, letting people practice audits or defend implementations to an authorizing official before facing them for real.

The scenarios cover five STIGs: RHEL 8, Windows Server 2025, Mozilla Firefox, Cisco IOS network devices, and IBM z/OS RACF. The mainframe scenario is deliberate: David M. notes that mainframe computing remains common in public and private sectors and has DISA STIGs.

Read original · Original 2

Assessors want documentation, traceability, and defensible positions; system owners and administrators want working systems, met deadlines, and mission progress.

• They are not in disagreement about outcomes, David M. argues, only about what the work looks like from their chairs.
• The recommended move is to step into the other role's position and ask what they are trying to accomplish.

The post suggests asking an assessor, ISSO, or ISSM, 'show me what you are trying to accomplish here,' and says that understanding another view can clarify your own. It invites readers who have held those seats to share what helped them see other perspectives.

Read original

They also argue that annual dues to a certifying body such as ISACA give members more than a credential: a voice in how the body operates. Practitioners should use that voice rather than treat dues as a transaction.

David M. says they exercised that voice by voting on ISACA's proposed bylaw changes. The post urges readers to remember this the next time they pay dues or join for the first time.

Read original · Original 2

Start here for the clearest technical argument in the set.

David M. tackles a misconception in cloud authorizations: teams treating inheritable controls as already implemented and no longer worth considering.

• The post distinguishes the cases.
• With a FedRAMP-certified cloud service provider, especially a GovCloud-authorized platform, many controls genuinely come from the platform — personnel requirements, physical security, environmental protections — and those are among the reasons to use cloud services.
• But, in their words, inherited does not mean handled and forgotten.
• Those controls should still appear in the authorization package, with the provider's authorization cited as the basis, and anything on the customer's side documented.
• Many controls are hybrid rather than cleanly owned by either side: the provider may encrypt storage while the customer manages the keys and access policies.
• The practical starting point is the provider's shared responsibility matrix, which shows where the line is drawn.

For brands planning a campaign

A vendor selling FedRAMP-adjacent tooling, key management, or compliance automation can use this as a content or demo hook for practitioners who need help reading a shared responsibility matrix and populating hybrid controls in their authorization packages.

Useful for anyone deciding whether the material matches their environment.

David M. describes building RMF Pro scenarios covering five actual STIGs: RHEL 8, Windows Server 2025, Mozilla Firefox, Cisco IOS network device, and IBM z/OS RACF.

• The post notes that mainframe computing continues in both public and private sectors and that DISA publishes STIGs for some of it, making the z/OS RACF scenario a deliberate inclusion rather than a novelty.
• The stated aim is to challenge people who work with STIG material through scenarios they can walk through.
• The tone is that of a practitioner addressing other practitioners.

For brands planning a campaign

Training and assessment vendors get a concrete read on which platforms this audience cares about and its appetite for scenario-based practice over reference material. The mainframe coverage signals that this reader does not treat legacy infrastructure as out of scope.

Start here for David M.'s view of the field's main skills gap.

The post begins where many careers in federal GRC begin: with certifications and the studying and exams that go with them.

• What comes next is the point.
• In David M.'s account, people usually learn to make judgement calls on the job and on a live system; knowing the rules and seeing them through actual configurations are different skills.
• RMF Pro is presented as a way to close that gap by putting what someone studied into simulated, real-world scenarios.
• They argue that the judgement gained there sets a person apart when conducting a system audit or defending an implementation in front of an authorizing official.
• The post asks people who have used the simulator what is helping them now and what is missing.

For brands planning a campaign

Assessment and GRC platform vendors can address a specific buyer pain: practitioners who can pass an exam but have not yet developed audit judgement. They can frame product value as rehearsal for defending implementations, not as another study aid.

Start here for the framing rather than the technical detail.

David M. describes palpable tension between auditors and administrators in many shops.

• Assessors want documentation, traceability, and defensible positions; administrators and system owners want things to work, deadlines met, and the supported mission to keep moving.
• The argument is that they want the same outcomes, but see the work from different chairs: the friction comes from vantage points, not goals.
• The suggested move is to step out of your own seat and stand behind someone else's, asking, 'show me what you are trying to accomplish here.' Understanding an assessor, ISSO, or ISSM, they write, can bring greater clarity to your own vision, and a little empathy can prevent unnecessary conflict.
• The post asks readers what has helped them see other views.

For brands planning a campaign

Vendors selling into federal GRC teams can test messaging that bridges assessor and operator roles rather than taking one side. The post also identifies the ISSO/ISSM community as a group David M. addresses directly and expects to respond.

A short read on how David M. views membership bodies.

David M. opens by saying this is not a typical LinkedIn post.

• When you earn an industry certification and pay annual dues to the issuing body, such as ISACA, you get more than a credential to use on the job: you have a voice in how the body does business.
• They say they exercised that voice in ISACA's proposed bylaw changes and encourage readers to remember it the next time they pay dues or join for the first time.
• The point is that you earn more than a badge demonstrating knowledge in a particular area.
• The post closes with a plain 'Happy Friday.'

For brands planning a campaign

For certification bodies and vendors courting credentialed professionals, this signals that David M. engages with association governance rather than treating dues as a transaction. It also confirms that the audience here is credential-holding, dues-paying members, not students.

A certified cloud service provider supplies many controls, including personnel, physical security, and environmental protections, but those controls still belong in the customer's authorization package, labeled as inherited or shared.

• Many fall in between: a provider may encrypt storage while the customer manages the keys and access policies.
• Each provider's shared responsibility matrix is the place to start to see where the line falls and what work remains on the customer's side.

Names the misconception, then works through a concrete split-control example (encryption versus keys and access policies) and points readers to the document that resolves the question.

For brands planning a campaign

This is practical, decision-shaped material for teams assembling authorization packages. A cloud security or compliance tooling brand could reach that audience by supporting a walkthrough of how a shared responsibility matrix works in a real package, building on the posts’ discussion of where teams get stuck.

Examples: Source 1

They argue that both sides want the same outcomes and differ only in vantage point, not goals.

• They suggest stepping out of your own seat and asking an assessor, ISSO, or ISSM what they are trying to accomplish.
• The post closes by asking readers who have held those roles what helped them see another view.

Reflective posts reframe a conflict as a difference in perspective, then end with an open question inviting practitioners to draw on their own experience.

For brands planning a campaign

The question-led format invites comment threads from government cyber practitioners. A brand selling to that audience could sponsor a moderated exchange between assessors and system owners, or a discussion series built around the same prompt.

Examples: Source 1

They describe the problem it addresses as the step between knowing the material and making a judgment call, a skill they say is usually learned on the job on a live system: recognizing rules in configurations differs from studying them.

• RMF Pro tests that judgment in simulated scenarios, which they say prepares people for system audits and for defending implementations to an authorizing official.
• A separate post lists scenarios covering five STIGs: RHEL 8, Windows Server 2025, Mozilla Firefox, Cisco IOS network devices, and IBM z/OS RACF.
• It notes that mainframe computing remains widespread in public and private sectors and has DISA STIGs.

Product announcements paired with questions to learners about what is helping them and what is missing; scenario coverage deliberately mixes mainstream and mainframe platforms.

For brands planning a campaign

Training, lab-environment, and mainframe-adjacent vendors overlap naturally with content David M. is already producing.

• Co-created scenario material is the most natural collaboration.
• Ask them directly about third-party offers; their posts show them promoting their own product.

Examples: Source 1 · Source 2

They say studying for and passing exams matters, but the harder step is applying the rules to real configurations.

• In a separate post, they remind readers that paying annual dues to a certifying body buys more than a credential: members can influence how the body operates.
• They describe using that voice by voting on ISACA's proposed bylaw changes and urge readers to remember it the next time they pay dues or join.

Career-advice posts reframe a routine task—studying or paying dues—as an opportunity the reader may be overlooking.

The ISACA post is personal and membership-focused, and sits further from the technical risk-management material than the other posts reviewed.

For brands planning a campaign

Certification bodies, professional associations, and training providers could support member-engagement or career-development campaigns around this theme. The dues-and-voting angle differs from the technical content and suits a campaign about practitioner influence rather than tooling.

Examples: Source 1 · Source 2

It targets the gap between studying for certifications and making judgement calls on a live system. The posts promote it directly and send readers to a link in the comments.

Original disclosure

Helping people navigate challenging and ambiguous situations is something I rather enjoy. I built RMF Pro to be something of value for ISSO and GRC people at all phases of their journey!

View example

The post describes membership and participation, not sponsorship or client work.

View example

Mayfield focuses on how FedRAMP sits alongside CMMC for cloud companies in the DoD supply chain and what authorization does for a vendor's standing; David M. focuses on what happens inside an authorization package once a provider is certified. Both use short LinkedIn posts to explain specific federal requirements and their practical consequences.

Mayfield writes from the vendor's commercial position, framing FedRAMP as a competitive advantage and a gate that keeps rivals out of the room, and closes posts with an invitation to get in touch. David M. focuses on practitioners' day-to-day work, explaining how to document inherited and shared controls and where the judgment to defend an implementation comes from.

Read original · Original 2

David Meece's networking post lays out a three-step routine for using LinkedIn to find work, the same short, actionable format David M. uses to point readers to certification study or scenario practice.

David Meece writes mainly about entering the industry and building community: opening their network to job seekers, naming people to follow, and curating the book Stronger Together: Women in Cybersecurity. David M. focuses on narrower, more technical subjects, including federal risk management, Federal GRC careers, and training scenarios.

Read original · Original 2

Both take an advisory posture, telling readers what to do next and offering to help.

Ward's compliance posts respond to a program announcement and the pause of CMMC Phase II, and pair that analysis with fractional CISO and gap-assessment services.

• Ward also writes about nonprofit leadership.
• David M. focuses on the mechanics of an authorization package and training for the judgment assessments require.

Read original · Original 2

Mayfield's posts frame authorization as a market-access and revenue decision: FedRAMP Moderate or Moderate Equivalency is a requirement for cloud companies serving the DoD supply chain, the authorization process can run 12–18 months against a November 2026 CMMC enforcement deadline, and holding an authorization disqualifies competitors before an RFP drops. That eligibility-and-pipeline framing suits a vendor whose offer is the business case for authorization and the path to it, rather than the control-level work inside the package.

Mayfield stays at the level of the decision and its commercial consequences.

• Their two posts do not walk through control mechanics, so a vendor that needs teaching content on inherited, shared, or hybrid controls, and on the shared responsibility matrix as a working artifact, gets less to anchor a campaign on than David M.'s most detailed post provides.
• Mayfield's posts also close with a direct contact call to action, so a vendor campaign may read as adjacent to the author's own services.

Examples: Source 1 · Source 2

Ward's post on the CMMC Phase II pause argues that NIST SP 800-171 obligations continue regardless of the certification timeline, and lists the work to keep doing: implementing and maturing controls, remediating gaps, writing policies that hold up in daily operations, preparing for future assessments in whatever form they take, and reducing risk instead of chasing an audit pass. A vendor selling fractional CISO services, gap assessments, SSP and POA&M development, or program-level compliance advisory can reach that buyer through Ward's framing.

Ward's posts read as an offer of their own advisory services — a strategy call, fractional CISO work, gap assessments — so a vendor campaign sits beside a competing service rather than neutral teaching.

• Their posts are also wider than FedRAMP: they cover CMMC and NIST 800-171 program-building, and the second post describes interim executive leadership of a nonprofit, which is off-topic for an authorization campaign.
• A vendor that needs the shared responsibility matrix and hybrid-control detail still gets more from David M.

Examples: Source 1 · Source 2

Meece's posts introduce Stronger Together: Women in Cybersecurity, a book of more than 100 women's stories in IT and cybersecurity whose proceeds go to WiCyS scholarships, and open their network to people looking for cybersecurity jobs with a three-step routine for introductions, commenting, and repetition. A vendor selling training, certification preparation, recruiting tools, or community programs can pair with that audience.

Meece's posts do not address FedRAMP, RMF, or authorization packages, so they are the wrong basis for a campaign aimed at federal GRC teams assembling or reviewing an ATO package. The switch trades David M.'s control-level content for reach into job seekers, career changers, and a broad cybersecurity community, rather than federal GRC teams assembling or reviewing an ATO package.

Examples: Source 1 · Source 2