# Jason Sproesser

Jason Sproesser covers cybersecurity compliance for small businesses in the defense industrial base, explaining requirements such as NIST SP 800-171, DFARS and CMMC through commentary and show discussions.

- Profile: https://b2binfluencer.marketing/creators/jason-sproesser/
- LinkedIn: https://www.linkedin.com/in/jsproesser
- Topics: cybersecurity, defense-industrial-base
- Based on 10 dated posts, latest 2026-10-09

## Summary

Most useful for explaining NIST SP 800-171, DFARS and CMMC compliance for small defense contractors.

- Best for: Content or advisory engagement for a cybersecurity compliance consultancy serving defense contractors.
- Not for: A high-volume sponsored lead generation campaign for IT and security buyers across industries.
- Check first: Ask whether they sell sponsorships and for audience evidence before committing budget.

### Takeaways

- Referrals to assistance programs have not helped small defense contractors implement controls.
- Pausing CMMC Phase 2 shifted the compliance burden rather than removing it.
- The practical risk is version uncertainty: 800-171 revisions 2 and 3, and the class deviation.

## Main ideas

- **Referrals to assistance programs have not helped small defense contractors implement controls**: Sproesser's starting observation is that small businesses in the defense industrial base can accept that cybersecurity requirements exist without knowing how to turn them into working controls. Whatever the acronym—NIST, DFARS or CMMC—the struggle is the same. Organizations that asked the government for help were sent to the same assistance programs, leaving contractors no closer to implementing controls. Sproesser writes that control implementation across the defense industrial base “sputtered, at best” and that calls for help seemed to fall on deaf ears.
- **Pausing CMMC Phase 2 shifted the compliance burden rather than removing it**: Sproesser argues that when DoD suspended CMMC Phase 2 over its burden on small businesses, the burden shifted to expectations that could be broader, more complex and more expensive. NIST SP 800-171 is now treated as “table stakes,” not the finish line. On top of it comes a push toward what DoD calls “Brilliant at the Basics,” illustrated by phishing-resistant multi-factor authentication and expanded operational technology security. Sproesser calls the pattern “directional parenting”—setting rules and then changing them. The pause looks like relief, but the required work expands.
- **The practical risk is version uncertainty: 800-171 revisions 2 and 3, and the class deviation**: Sproesser argues that nobody knows which revision of NIST SP 800-171 will become the required baseline, so contractors cannot safely stand still. The post cites a CIO describing implementation of 800-171 as “table stakes” and says the FAR controlled unclassified information rule is closer than ever to taking effect and requires revision 3. A class deviation is currently the only thing stopping revision 3 from becoming the buy-in for DFARS requirements, while an in-effect rule is the only thing stopping revision 3 from applying more widely. If the class deviation survives the task force review of CMMC, DFARS would require revision 2 while FAR requires revision 3, potentially requiring some contractors to meet both at once. Sproesser's practical conclusion: pausing revision 2 implementation is a mistake, because exposure does not disappear while the versions are debated. The CIO reference is someone else's characterization, as quoted by Sproesser.
- **Judge a policy by its text, not its title**: Across the posts, Sproesser's method is to read the underlying rule or bill and explain what it requires, rather than judge it by its name. That's explicit in the post on the Cybersecurity for Small Businesses Act: the episode aims to read what the legislation actually says. Sproesser also admits to having been misled by a promising title before, which motivates the approach.

## Work to read

- [On the Cybersecurity for Small Businesses Act](https://www.linkedin.com/posts/jsproesser_it-is-no-secret-that-when-it-comes-to-cybersecurity-activity-7511476095695745024-g7kU)
- [NIST 800-171 revision 2 versus revision 3: the cost of pausing implementation](https://www.linkedin.com/posts/jsproesser_%F0%9D%97%9C%F0%9D%97%B3-%F0%9D%98%81%F0%9D%97%B5%F0%9D%97%B2-%F0%9D%97%97%F0%9D%97%BC%F0%9D%97%97-%F0%9D%97%B6%F0%9D%98%80-%F0%9D%98%86%F0%9D%97%BC%F0%9D%98%82%F0%9D%97%BF-%F0%9D%97%B0%F0%9D%98%82%F0%9D%98%80%F0%9D%98%81-activity-7501372193352749057-gSuL)
- [DoD paused CMMC Phase 2 and shifted to “Brilliant at the Basics”](https://www.linkedin.com/posts/jsproesser_%F0%9D%97%97%F0%9D%97%BC%F0%9D%97%97-%F0%9D%98%80%F0%9D%98%82%F0%9D%98%80%F0%9D%97%BD%F0%9D%97%B2%F0%9D%97%BB%F0%9D%97%B1%F0%9D%97%B2%F0%9D%97%B1-%F0%9D%97%96%F0%9D%97%A0%F0%9D%97%A0%F0%9D%97%96-%F0%9D%97%A3%F0%9D%97%B5%F0%9D%97%AE-activity-7499113746691346432-QjHM)

## Partnerships

Across three LinkedIn posts, Jason Sproesser promotes a recurring show about Defense Department cybersecurity policy, including the NIST SP 800-171 revision debate, the FAR CUI rule, and the DoD's "Brilliant at the Basics" campaign. Each post closes by asking readers to like, subscribe, tell friends, and comment. For a buyer considering a sponsored segment, co-produced episode, or paid advisory engagement, the posts offer no sponsorship details, deliverables, pricing, or inquiry page. Ask directly whether the show accepts sponsorships and, if so, on what terms.

## Alternatives

- Darron Makrokanis: Choose Makrokanis when the consultancy wants to reach small contractors through a program or product that already carries the implementation work, or wants a co-selling partner for the smallest suppliers. Both posts are company news: Summit 7 joining the Army’s NCODE program to help companies with roughly 2 to 10 employees clear the CMMC cost barrier, and a supply-chain readiness reception at AUSA where Summit 7 soft-launched a low-cost product for suppliers under 25 employees and made the case to primes that their subcontractors need to be compliant before the next contract. The message is about channels: primes need compliant subs, and here is the tooling and event to open the conversation. The NCODE post gives a concrete schedule—the pilot begins May 15, with the wider program expected within six months—that a consultancy can build a campaign timeline around.
- Thomas Ward: Choose Ward when the consultancy needs someone to deliver compliance work or wants content that ends in a booked call with contractors deciding whether to keep preparing during the CMMC pause. The CMMC Phase II post answers the questions contractors actually ask: should we stop preparing, cancel the assessment, or keep working on NIST 800-171? It lists the work worth continuing: implement and mature controls, identify and fix gaps, write policies that hold up in day-to-day operations, prepare for future assessments, and reduce risk rather than chase an audit. It closes with a complimentary one-hour strategy call and names gap assessments, SSP and POA&M development, and fractional CISO work, so the conversion path is already built. The subject matches the consultancy’s brief, approached from the practitioner’s side.
- Michael McLaughlin: Choose McLaughlin when the consultancy needs to win an argument rather than explain a rule—for example, by rebutting claims that CMMC is unaffordable or assessors are the bottleneck. The CMMC pause post draws on Cyber AB town-hall figures from November 2025 to June 2026: monthly Level 2 certifications rose from 123 to 279, unused assessor capacity exceeded 1,200 certifications, and rollout ran about five to one ahead of the department’s own projection. It separates the cost of implementing DFARS 252.204-7012, which contractors have owed since 2017, from the cost of the assessment that verifies the work, and argues that suspending the assessment removes the check without removing the obligation. A consultancy seeking a sharper, evidence-dense voice gets more force here. The AI training-data post also shows reach into national-security and AI-provenance audiences if that adjacency is useful.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/