Jason Sproesser

Whatever the acronym—NIST, DFARS or CMMC—the struggle is the same.

• Organizations that asked the government for help were sent to the same assistance programs, leaving contractors no closer to implementing controls.
• Sproesser writes that control implementation across the defense industrial base “sputtered, at best” and that calls for help seemed to fall on deaf ears.

The post names the usual destinations—the DoD Office of Small Business Programs, a local MEP or APEX Accelerator, and Project Spectrum—and illustrates the pattern with a running joke that gets louder with each recommendation: “With each recommendation the saxophones only got louder.”

• The hoped-for change is the Cybersecurity for Small Businesses Act, introduced by Representatives Tony Wied of Wisconsin's 8th District and Beth Van Duyne of Texas's 24th District.
• The post says the show will examine the bill on its substance.
• The legislators are named as bill sponsors, not guests.

Read original

NIST SP 800-171 is now treated as “table stakes,” not the finish line.

• On top of it comes a push toward what DoD calls “Brilliant at the Basics,” illustrated by phishing-resistant multi-factor authentication and expanded operational technology security.
• Sproesser calls the pattern “directional parenting”—setting rules and then changing them.
• The pause looks like relief, but the required work expands.

The closing line makes the redirection concrete: after contractors were told CMMC assessments are paused, they are told to pursue phishing-resistant MFA instead. The post frames this week's show as an explanation of DoD's rationale for the “Brilliant at the Basics” campaign.

Read original

The post cites a CIO describing implementation of 800-171 as “table stakes” and says the FAR controlled unclassified information rule is closer than ever to taking effect and requires revision 3.

• A class deviation is currently the only thing stopping revision 3 from becoming the buy-in for DFARS requirements, while an in-effect rule is the only thing stopping revision 3 from applying more widely.
• If the class deviation survives the task force review of CMMC, DFARS would require revision 2 while FAR requires revision 3, potentially requiring some contractors to meet both at once.
• Sproesser's practical conclusion: pausing revision 2 implementation is a mistake, because exposure does not disappear while the versions are debated.
• The CIO reference is someone else's characterization, as quoted by Sproesser.

The post pairs each observation with a takeaway. The warning attached to the first pair is that pausing revision 2 work could put organizations “back into the same implementation buzzsaw they thought was dull forever.”

Read original

That's explicit in the post on the Cybersecurity for Small Businesses Act: the episode aims to read what the legislation actually says. Sproesser also admits to having been misled by a promising title before, which motivates the approach.

The post says the show does the work so the audience isn't “fooled by the song title (like I did!),” and each post repeats the call to like, subscribe and tell friends. In the NIST version post, that approach appears in quotes from policy, such as “table stakes,” and in a plain-language warning about the class deviation and overlapping FAR and DFARS obligations.

Read original · Original 2

The post opens with the frustration directly: small businesses in the defense industrial base struggle with cybersecurity requirements, whether the acronym is NIST, DFARS or CMMC.

• It lists the resources contractors are usually pointed toward—the DoD Office of Small Business Programs, a local MEP or APEX Accelerator, and Project Spectrum—and argues that none brings them closer to implementing controls.
• Jason Sproesser announces that Representatives Tony Wied (Wisconsin’s 8th District) and Beth Van Duyne (Texas’s 24th District) introduced the Cybersecurity for Small Businesses Act.
• They say the show will examine the bill’s substance rather than judge it by its promising title.
• The post makes the method explicit: read what the legislation actually says.
• Sproesser also acknowledges having been misled by a hopeful title before.

For brands planning a campaign

For a compliance consultancy expanding into the defense industrial base, this post captures the moment a prospect starts looking for help: after being routed through public assistance programs and still not knowing what to do next. Its bill coverage also offers a timely subject for co-authored commentary, while the show’s practice of testing policy language against a bill’s title gives an advisory engagement a clear editorial angle.

The post lays out three paired points, each with an observation and a practical takeaway.

• First, a CIO has repeatedly called implementation of NIST SP 800-171 “table stakes,” while the FAR controlled unclassified information rule is described as closer than ever to taking effect—and requiring 800-171 revision 3.
• The takeaway: pausing revision 2 work risks putting an organization back into the implementation grind it thought it had escaped.
• Second, no one knows which revision will become the required baseline.
• A class deviation is currently the only thing stopping revision 3 from becoming the buy-in for DFARS requirements, while an in-effect rule is the only thing stopping it from applying more widely.
• The takeaway: if the class deviation survives the task force review of CMMC, DFARS will require revision 2 while FAR requires revision 3, potentially leaving some contractors to meet both at once.

For brands planning a campaign

This version-ambiguity explanation gives a consultancy a clear response when a prospect asks whether to continue or wait. It also identifies a specific, checkable risk—dual r2 and r3 obligations for the same contractor—that can anchor a scoping call or audit offer.

The post says DoD suspended CMMC Phase 2 because of the burden it placed on small businesses, but argues that the suspension redirected that burden into expectations that could be broader, more complex and more expensive.

• The defense industrial base was already struggling to implement NIST SP 800-171, which is now treated as “table stakes” rather than the finish line.
• The post also points to a push toward what DoD calls “Brilliant at the Basics,” citing phishing-resistant multi-factor authentication and expanded operational technology security.
• The show breaks down DoD’s explanation of the campaign and discusses its “directional parenting”—setting rules and then changing them.
• The closing line is pointed: contractors are told to chase phishing-resistant MFA after being told CMMC assessments are paused.

For brands planning a campaign

The post captures contractors’ frustration when requirements shift mid-implementation. A consultancy can turn that frustration into an offer: translate each policy change into a sequenced, budget-aware roadmap rather than another one-off mandate.

NIST, DFARS and CMMC stand in for that struggle.

• The post says organizations were directed to resources such as the DoD Office of Small Business Programs, APEX Accelerator and Project Spectrum, but the implementation problem persisted.
• Sproesser describes control implementation as having “sputtered, at best” and says calls for help seemed to fall on deaf ears.

Direct address to contractors, an extended saxophone-and-song metaphor, and a legislative hook about a small-business cybersecurity bill.

The post criticizes referrals alone for failing to solve the implementation problem; it does not dismiss the resource programs outright.

For brands planning a campaign

A compliance consultancy could use Sproesser to explain why small DIB contractors need implementation support beyond referrals, and build content around the gap between available guidance and completed controls.

Examples: Source 1

The post cites the CIO calling 800-171 implementation “table stakes,” says the FAR CUI rule is the closest it has been to going live and requires 800-171 r3, and argues that pausing r2 could push organizations back into the same implementation problems.

A scenario-based warning followed by a point-by-point comparison of current rule status.

For brands planning a campaign

The consultancy can position Sproesser for an advisory or content engagement on why compliance timetables keep running beneath policy pauses and what contractors should keep doing while CMMC phases are debated.

Examples: Source 1

A class deviation currently stops r3 from being the buy-in for DFARS requirements, while an in-effect rule is the only thing stopping r3 from applying more broadly. If the class deviation remains after the CMMC task force review, DFARS could require r2 while FAR requires r3, leaving some contractors to face both at once.

A rule-status breakdown that uses quoted policy phrases to turn a class deviation and overlapping FAR/DFARS obligations into a practical warning.

For brands planning a campaign

A compliance consultancy could commission a plain-language decision guide or webinar from Sproesser on tracking versions and managing dual DFARS/FAR obligations, for contractors that cannot afford to guess wrong.

Examples: Source 1

NIST SP 800-171 is now described as table stakes, alongside a push for “Brilliant at the Basics” that includes phishing-resistant MFA and expanded OT security. The show breaks down DoD’s explanation for that campaign and what Sproesser calls directional parenting.

Satirical framing about being told to chase a shiny new thing makes a serious point about shifting requirements.

The post frames the CMMC pause as a redirection of burden, not a reduction in cybersecurity expectations.

For brands planning a campaign

The consultancy could use Sproesser to help contractors understand the shift from CMMC phase pauses to basic controls such as MFA and OT security, and create practical readiness content around those priorities.

Examples: Source 1

They use stylized Unicode lettering, emojis, direct questions, music and parody, along with repeated calls to like, subscribe and tell friends.

• Each takes a policy development, names the acronyms and briefly explains why the change matters to defense contractors.
• The conversational analysis does the work so the audience is not fooled by the song title.

A recurring “this week’s show” structure opens with humor or a sharp warning, then offers a compressed explanation of the rule or bill and its practical effect.

For brands planning a campaign

A brand should expect an editorial or commentary collaboration, not a dry compliance training module. Sproesser’s format suits short show segments, newsletter explainers or social video that translate regulatory shifts for small DIB contractors.

Examples: Source 1 · Source 2 · Source 3

Sproesser's posts announce programs and products, including their company's selection for the Army's NCODE pilot for companies with 2 to 10 employees and a low-cost offering for suppliers under 25 employees. They also explain what policy changes mean for contractors.

Read original · Original 2

Ward is a practising fractional CISO who attaches a booking link to a strategy call and writes about leadership and running a nonprofit; Sproesser focuses on policy analysis and the show.

Read original · Original 2

McLaughlin builds an explicit case with data and takes on agencies by name. His other posts range into AI training-data provenance and supply-chain security; Sproesser focuses on compliance requirements for small contractors.

Read original · Original 2

Both posts are company news: Summit 7 joining the Army’s NCODE program to help companies with roughly 2 to 10 employees clear the CMMC cost barrier, and a supply-chain readiness reception at AUSA where Summit 7 soft-launched a low-cost product for suppliers under 25 employees and made the case to primes that their subcontractors need to be compliant before the next contract.

• The message is about channels: primes need compliant subs, and here is the tooling and event to open the conversation.
• The NCODE post gives a concrete schedule—the pilot begins May 15, with the wider program expected within six months—that a consultancy can build a campaign timeline around.

Both posts announce a position, program or product; neither explains what a rule requires or which version applies.

• That leaves the consultancy without the interpretive hook that makes the r2/r3 question a natural front door.
• The offer also sits on top of a vendor’s own product for small contractors, making the consultancy a partner or competitor depending on how the engagement is framed—not the party answering the question.

Examples: Source 1 · Source 2

The CMMC Phase II post answers the questions contractors actually ask: should we stop preparing, cancel the assessment, or keep working on NIST 800-171?

• It lists the work worth continuing: implement and mature controls, identify and fix gaps, write policies that hold up in day-to-day operations, prepare for future assessments, and reduce risk rather than chase an audit.
• It closes with a complimentary one-hour strategy call and names gap assessments, SSP and POA&M development, and fractional CISO work, so the conversion path is already built.
• The subject matches the consultancy’s brief, approached from the practitioner’s side.

Ward sells what the consultancy sells.

• The relationship is more likely a subcontract or a competitor than a channel, and the audience is being directed to book a service rather than read the consultancy’s guide or watch its sponsored segment.
• The content is mostly replies to client questions and a service list, with one post on the pause and none on revision-level analysis.
• The other post is about interim nonprofit leadership, so ask for more defense-compliance content before buying against this thin topical record.

Examples: Source 1 · Source 2

The CMMC pause post draws on Cyber AB town-hall figures from November 2025 to June 2026: monthly Level 2 certifications rose from 123 to 279, unused assessor capacity exceeded 1,200 certifications, and rollout ran about five to one ahead of the department’s own projection.

• It separates the cost of implementing DFARS 252.204-7012, which contractors have owed since 2017, from the cost of the assessment that verifies the work, and argues that suspending the assessment removes the check without removing the obligation.
• A consultancy seeking a sharper, evidence-dense voice gets more force here.
• The AI training-data post also shows reach into national-security and AI-provenance audiences if that adjacency is useful.

The posture is adversarial.

• The post names the DoW CIO and the Small Business Administration, says the stated assessor shortage is not what the data shows, and closes by calling China the only real winner.
• A consultancy that wants to remain the neutral party answering revision questions may not want its content placed next to that framing.
• The post diagnoses the problem but offers no instructions: contractors learn why the pause rationale does not hold, not what to do next quarter.
• The second post is about Chinese state content in AI training corpora, outside a defense-compliance practice’s brief.

Examples: Source 1 · Source 2