--- title: Agenda --- [Go Back Up ](https://cs2.cloud/agenda#top) # Agenda All times are in Eastern Time (ET). - Welcome Reception | May 5 - Day One | May 6 - Day Two | May 7 Welcome Reception | May 5 ## Welcome Reception: May 5 1. 17:00 - 18:30 PM ### CS2 Welcome Reception – Sponsored by AvePoint & Summit 7 Kick off CS2 with an evening of networking, great food, and drinks at the CS2 Welcome Reception, sponsored by AvePoint and Summit 7. Mingle with fellow attendees, get a head start on conversations, and take advantage of early check-in to pick up your badge and avoid the registration lines on May 6. Don’t miss this opportunity to connect before the main event! Day One | May 6 ## Day One: May 6 1. 08:00 - 09:00AM Check-In Open ### Networking Breakfast 2. 09:00 - 10:00AM Main Session One ### The Risks of Playing Through the Whistle: Whistleblowers, the False Claims Act, and the DOJ’s Expanding Civil Cyber-Fraud Initiative. In March 2025, DOJ announced the first FCA settlement with a Defense Contractor/Member of the DIB for failing to implement cybersecurity requirements – specifically the controls in NIST SP 800-171 – as required by its contracts with the Department of the Army and the Department of the Air Force. That settlement marks a milestone in the multi-year effort by DoD to mandate and achieve baseline cybersecurity controls for companies in the DIB supply chain. Additional FCA settlements for failing to implement required DFARS and NIST SP 800-171 cybersecurity controls are expected to follow in 2025 and beyond. The presentation will address common issues in recent DOJ enforcement actions, trends in investigative efforts by DoD, NASA, and other federal agencies, and steps DIB members can take to reduce and avoid exposure to possible FCA suits and other whistleblower claims. Bruce Judge is a Member of the Whistleblower Law Collaborative (WLC) based in Boston, Massachusetts. Prior to helping launch WLC, Bruce spent 23 years as prosecutor with the Department of Justice, investigating, charging, trying, and convicting individuals and companies for financial crimes, obstruction of justice, public corruption, and other federal offenses. Read More - ![Bruce Judge](https://cs2.cloud/hs-fs/hubfs/Bruce%20Judge.jpg?width=400&height=400&name=Bruce%20Judge.jpg) #### Bruce Judge Member, Whistleblower Law Collaborative 3. 10:15 - 11:15AM Main Session Two ### State of CMMC Preparedness in the DIB: Report Results The biggest open secret in the defense industrial base: contractors overestimate their preparedness for CMMC assessment. A recent survey of 209 defense contractors made this clear yet again: the companies most likely to engage external CMMC experts are those who have completed a full gap analysis. This session will explore the strategic takeaways and compliance challenges for contractors in 2025. Read More - ![Amy Williams](https://cs2.cloud/hs-fs/hubfs/Amy%20Williams.jpg?width=360&height=450&name=Amy%20Williams.jpg) #### Amy Williams VP of CMMC, Coalfire Federal 4. 11:30 - 12:30PM Main Session Three ### CUI Hotline LIVE - Unfiltered. Unscripted. Every Friday, the CUI Hotline goes live to answer the toughest questions about CMMC, DFARS, NIST, and CUI—the acronyms everyone loves to hate. This time, instead of answering questions from behind a screen, we are bringing the conversation to CS2 for a live, in-person session. No scripts, no canned responses—just real discussions about the compliance and security challenges facing the Defense Industrial Base. Whether you're dealing with regulations, struggling with implementation, or just looking for clarity, this is your chance to ask questions and get straight answers from industry experts. Bring your questions and join the conversation—the CUI Hotline is live at CS2. Read More - ![Jacob Horne 2025](https://cs2.cloud/hs-fs/hubfs/Jacob%20Horne%202025.jpg?width=784&height=800&name=Jacob%20Horne%202025.jpg) #### Jacob Horne Chief Cybersecurity Evangelist, Summit 7 - ![Ryan-Bonner](https://cs2.cloud/hs-fs/hubfs/Ryan-Bonner.jpeg?width=698&height=698&name=Ryan-Bonner.jpeg) #### Ryan Bonner CEO, DEFCERT - ![DanielAkridge2023](https://cs2.cloud/hs-fs/hubfs/DanielAkridge2023.jpg?width=600&height=600&name=DanielAkridge2023.jpg) #### Daniel Akridge Director of Engagement, Summit 7 - ![ScottEdwards2023](https://cs2.cloud/hs-fs/hubfs/ScottEdwards2023.jpg?width=570&height=570&name=ScottEdwards2023.jpg) #### Scott Edwards CEO, Summit 7 - ![Conor Dean Head Shot](https://cs2.cloud/hs-fs/hubfs/Conor%20Dean%20Head%20Shot.jpg?width=587&height=587&name=Conor%20Dean%20Head%20Shot.jpg) #### Conor Dean Regional Manager - Channel Solution Engineering, AvePoint 5. 12:30PM ### Networking and Lunch 6. 14:00 - 15:00PM Executive Breakout One ### Staying Competitive: What Prime Contractors Expect from Their Supply Chain As the defense industry transforms under CMMC, large prime contractors are setting the pace for early adoption and supply chain security. Their decisions on Controlled Unclassified Information (CUI) flow, certification timelines, and subcontractor expectations will define the path forward for thousands of suppliers. In this panel, key leaders from aerospace, defense, and critical infrastructure sectors share their perspectives on the compliance landscape, the real-world challenges of securing the supply chain, and what they expect from subcontractors moving forward. Whether you're a small business or a mid-tier supplier, understanding how primes are approaching CMMC is crucial to staying competitive in the defense ecosystem. Read More - ![ScottEdwards2023](https://cs2.cloud/hs-fs/hubfs/ScottEdwards2023.jpg?width=570&height=570&name=ScottEdwards2023.jpg) #### Scott Edwards CEO, Summit 7 - ![Matt_Ramsey_1X1](https://cs2.cloud/hs-fs/hubfs/Imported%20sitepage%20images/Matt_Ramsey_1X1.jpg?width=480&height=480&name=Matt_Ramsey_1X1.jpg) #### Matthew Ramsey CIO, BlueHalo - ![John Kronick 2](https://cs2.cloud/hs-fs/hubfs/John%20Kronick%202.jpg?width=356&height=356&name=John%20Kronick%202.jpg) #### John Kronick Chief Information Security Officer, Tutor Perini - ![matt_reynolds_bio_photo (002)](https://cs2.cloud/hs-fs/hubfs/matt_reynolds_bio_photo%20(002).jpg?width=700&height=700&name=matt_reynolds_bio_photo%20(002).jpg) #### Matt Reynolds Chief Information Officer, The Marvin Group 7. 14:00 - 15:00PM Technical Breakout One ### Pentest Diaries: The Most Common Configuration Baseline Mistakes That Are Exposing the DIB The penetration testing team at PKF O’Connor Davies has years of experience conducting offensive security operations in cooperation with the defense industrial base. During these tests, we find ourselves abusing the same security weaknesses across over and over again, many of which stem from weak security configurations rather than vulnerable software. During this talk, PKFOD’s red team lead will outline the top 5 configuration weaknesses that are putting your organization at risk. We will be diving deep into a subset of NIST SP 800-171 configuration management security controls to outline ways the defense industrial base can prevent the most common hacker tactics, techniques, and procedures, while also demonstrating compliance with NIST and CMMC requirements. Read More - ![ScottGoodwin_Small](https://cs2.cloud/hs-fs/hubfs/ScottGoodwin_Small.jpg?width=396&height=396&name=ScottGoodwin_Small.jpg) #### Scott Goodwin Principal – Cybersecurity & Privacy Advisor, PKF O’Conner Davies Advisory, LLC 8. 15:15 - 16:15PM Executive Breakout Two ### CMMC Enclaves by Industry Creating a CMMC enclave is a proven strategy for achieving compliance while minimizing disruption to an organization’s broader IT environment. However, the best approach to designing and managing an enclave depends heavily on the industry. A solution that works seamlessly for a manufacturing company may pose significant challenges for a university conducting regulated research or an AEC firm handling controlled design data. With varying needs in security, accessibility, and cost, how can organizations determine the right approach? This session will explore the unique enclave considerations for manufacturing, regulated research (higher education), and architectural, engineering, and construction (AEC) industries. We’ll discuss the pros and cons of different deployment models, share lessons learned from real-world implementations, and provide actionable insights to help organizations make informed decisions about their compliance strategy. Read More - ![DanielAkridge2023](https://cs2.cloud/hs-fs/hubfs/DanielAkridge2023.jpg?width=600&height=600&name=DanielAkridge2023.jpg) #### Daniel Akridge Director of Engagement, Summit 7 9. 15:15 - 16:15PM Technical Breakout Two ### How to Eliminate CUI From Your Supply Chain CMMC creates certification requirements that flow down to your suppliers. But many subcontractors are nowhere close to achieving a CMMC Level 2 certification. How can defense contractors continue to perform in a reality where critical suppliers won't be certified in time to receive future awards? We'll discuss a multidisciplinary approach that will reduce or eliminate Controlled Unclassified Information (CUI) from supplier relationships, reclaim indirect costs, and preserve supply chains during this period of consolidation in the defense industrial base. Read More - ![Ryan-Bonner](https://cs2.cloud/hs-fs/hubfs/Ryan-Bonner.jpeg?width=698&height=698&name=Ryan-Bonner.jpeg) #### Ryan Bonner CEO, DEFCERT 10. 16:30 - 17:30 Happy Hour ### CS2 Happy Hour - Sponsored by Carahsoft Wrap up Day 1 of CS2 with a drink and networking at the CS2 Happy Hour, sponsored by Carahsoft. Join us to connect with sponsors, engage with fellow attendees, and unwind after a day of insightful sessions. This is the perfect opportunity to continue discussions, build relationships, and gear up for Day 2! Read More Day Two | May 7 ## Day Two: May 7 1. 08:00 - 09:00AM Check-In Open ### Networking Breakfast 2. 09:00 - 10:00AM Main Session One ### The Past, Present, and Future of the CMMC Ecosystem Join Matt Travis (The Cyber AB), James Gillooley (Department of Defense), and Jacob Horne (Summit 7) for a fireside chat discussing the rapid growth of the CMMC ecosystem and what to expect moving forward as CMMC becomes a permanent fixture in defense contracting and beyond. Read More - ![MatthewTravisSquare](https://cs2.cloud/hs-fs/hubfs/MatthewTravisSquare.jpg?width=571&height=571&name=MatthewTravisSquare.jpg) #### Matt Travis CEO, The Cyber AB - ![Jacob Horne 2025](https://cs2.cloud/hs-fs/hubfs/Jacob%20Horne%202025.jpg?width=784&height=800&name=Jacob%20Horne%202025.jpg) #### Jacob Horne Chief Cybersecurity Evangelist, Summit 7 - ![James Gillooley](https://cs2.cloud/hs-fs/hubfs/James%20Gillooley.jpg?width=640&height=800&name=James%20Gillooley.jpg) #### James Gillooley IT Management Specialist, Department of Defense 3. 10:15 - 11:15AM Main Session Two ### I've Got a GAP in my CAP If you were privy to the original version 1.0 of the “draft” CMMC Assessment Process (CAP) document, then you likely agree that version 2.0 released by the Cyber AB in December 2024 is a huge improvement.  After all, the CAP is the authoritative document followed by all C3PAOs in conducting a CMMC Assessment for OSAs, and success (or failure) can be found in the detailed guidance. There’s a few areas that were left open to interpretation, however … and those gaps in guidance have been tricky for the C3PAO assessors to navigate.  In this session, we will sit down with three of the leading C3PAO firms to talk through how they have been addressing things like: •    Assessing ESPs (External Service Providers) who by and large do not process, store or transmit CUI, but provide the capability to do so on behalf of their customers •    What a “lower burden of proof” looks like when reviewing evidence from an OSA who is using a CMMC L2 Assessment Certified ESP for some portion of their control implementation •    What type of Not Met control implementation would be considered unacceptable for the OSA to fix the 10-day window following the active assessment period, if any? •    How difficult is the review of FedRAMP Moderate Equivalent evidence packages? Are all C3PAOs doing the same thing?  Is there a common understanding and expectation, or is each assessment team doing it their own way?  Let’s find out in this lively and informative discussion between our panel of experts. Read More - ![Leadership_JoyBeland_499x499](https://cs2.cloud/hs-fs/hubfs/Leadership_JoyBeland_499x499.jpg?width=499&height=499&name=Leadership_JoyBeland_499x499.jpg) #### Joy Beland VP of Cybersecurity Compliance, Summit 7 - ![Fernando Machado](https://cs2.cloud/hs-fs/hubfs/Fernando%20Machado.png?width=500&height=500&name=Fernando%20Machado.png) #### Fernando Machado Managing Principal and Chief Information Security Officer, Cybersec Investments - ![Matt Bruggerman](https://cs2.cloud/hs-fs/hubfs/Matt%20Bruggerman.jpg?width=200&height=200&name=Matt%20Bruggerman.jpg) #### Matt Bruggeman Director of Federal Sales, A-LIGN - ![LoganTherrien](https://cs2.cloud/hs-fs/hubfs/LoganTherrien.jpg?width=200&height=200&name=LoganTherrien.jpg) #### Logan Therrien Operations Manager, Kieri Solutions 4. 11:30 - 12:30PM Main Session Three ### Certified: Real Stories from Defense Contractors Who Achieved Compliance Defense contractors across the industry are working toward CMMC compliance to secure their place in the Defense Industrial Base. But passing an assessment isn’t always straightforward. Organizations face challenges in understanding requirements, implementing the right security measures, and navigating the assessment process. With impending DoD requirements and urgent expectations from prime contractors, how can businesses ensure they are on the right track? Hear directly from defense contractors who have successfully met compliance standards, passed assessments, and strengthened their cybersecurity posture. Panelists will share their real-world experiences, key challenges, and lessons learned to help others on the same journey. This discussion will offer a candid look at what worked, what didn’t, and what companies wish they had known before starting the process. Attendees will gain practical takeaways to apply in their own compliance efforts. Read More - ![Jana_Abbott_500](https://cs2.cloud/hs-fs/hubfs/Jana_Abbott_500.jpg?width=500&height=500&name=Jana_Abbott_500.jpg) #### Jana Abbott Director of Sales, Summit 7 - ![Craig Hartburg](https://cs2.cloud/hs-fs/hubfs/Craig%20Hartburg.jpg?width=200&height=200&name=Craig%20Hartburg.jpg) #### Craig Hartburg Managing Director, Cayuse Government Operations, LLC - ![Suzanne Moltzen](https://cs2.cloud/hs-fs/hubfs/Suzanne%20Moltzen.jpg?width=400&height=400&name=Suzanne%20Moltzen.jpg) #### Suzanne Moltzen CEO, RIB U.S. Cost - ![Langston Keith](https://cs2.cloud/hs-fs/hubfs/Langston%20Keith.jpg?width=450&height=450&name=Langston%20Keith.jpg) #### Langston Keith Microsoft 365 GCCH Administrator, J&J Worldwide Services 5. 12:30PM ### Networking and Lunch 6. 14:00 - 15:00PM Executive Breakout One ### Evolving ESPs: Like Buccee’s but for CMMC To meet the growing demands of defense contractors facing CMMC, External Service Providers (ESPs) have transformed significantly. As clients become more aware of CMMC requirements, their needs have grown, prompting ESPs to evolve their service offerings to eliminate deficiencies. Each phase of this transformation represents a shift in compliance roles and responsibilities, increasing the shared responsibility in achieving and maintaining certification. This presentation will explore Summit 7's evolution in supporting clients from contract to compliance and what's next in our journey. Read More - ![JasonSproesser2](https://cs2.cloud/hs-fs/hubfs/JasonSproesser2.jpg?width=599&height=599&name=JasonSproesser2.jpg) #### Jason Sproesser Director of Product Management, Compliance Services, Summit 7 7. 14:00 - 15:00PM Technical Breakout One ### Unveiling Azure Government Secret – A Secure Cloud Solution for Classified Workloads The DIB is under increasing pressure to modernize IT infrastructure while maintaining the highest levels of security and compliance for classified workloads. Traditional on-premises solutions and SCIF-based data storage come with high costs, scalability challenges, and complex maintenance requirements. At the same time, shifting classified workloads to the cloud raises questions about security, compliance, and seamless access while meeting DoD Impact Level 6 (IL6) standards. This session will break down Azure Government Secret, Microsoft’s secure cloud platform built to handle classified workloads at IL6. The discussion will cover what Azure Government Secret is, how organizations can gain access, key integration considerations, available services, and real-world applications. Deployment timelines and best practices will also be explored, providing a clear picture of how defense contractors and government partners can take advantage of this secure cloud environment while staying ahead of evolving cybersecurity requirements. Read More - ![Troy Arwine](https://cs2.cloud/hs-fs/hubfs/Troy%20Arwine.jpg?width=400&height=400&name=Troy%20Arwine.jpg) #### Troy Arwine Principal Tech Specialist, Microsoft - Aerospace & Commercial Defense - ![Shane Shipley](https://cs2.cloud/hs-fs/hubfs/Shane%20Shipley.jpg?width=200&height=200&name=Shane%20Shipley.jpg) #### Shane Shipley Director of Cleared Cloud, Summit 7 8. 15:15 - 15:45PM Closing Session ### The Future of the CMMC Conference Circuit After 5 years and 14 events there are big changes in store for CS2. Hear from Summit 7 CEO Scott Edwards on what's in store and the impact it will have on the CMMC ecosystem. Read More - ![ScottEdwards2023](https://cs2.cloud/hs-fs/hubfs/ScottEdwards2023.jpg?width=570&height=570&name=ScottEdwards2023.jpg) #### Scott Edwards CEO, Summit 7