Becoming an Authorized C3PAO with Koren Wise (Women in CMMC)

[00:00:01] Climbing Mount CMMC presents Cyber Women in CMMC. Today I am joined by Koren Wise, Chief Executive Officer at Wise Technical Innovations. Wise Technical Innovations is one of the first authorized C3PAOs and I'm so excited to sit down with Koren and talk about this and more today.

[00:00:23] Hello climbers and welcome to Cyber Her Women in CMMC. This is a podcast that we are going to start that is a section of Climbing Mount CMMC and I am so excited to be joined by Koren Wise for this first ever podcast episode. So Koren, thank you so much for stepping in here and taking the time.

[00:00:48] I'm so excited. We saw each other at Seek East and we were both there and I was like, oh man, I really want to talk to you. But we were busy. You were mostly busy speaking and talking to people and stuff like that. So we now finally have the opportunity to sit down and talk to each other, which I'm really excited about.

[00:01:05] But just to open the floor with why we're deciding to start this specific podcast series on Climbing Mount CMMC is, if you guys don't know, there are a lot of incredible women in CMMC doing some amazing things, whether that's C3PAOs, whether that's CMMC assessors, whether that is consultants or tons of opportunities inside the CMMC ecosystem and women are crushing it.

[00:01:34] And I'm so excited to highlight some of those women, what they do, what they bring to the table, their journey of how they started in CMMC. And yeah, so a little bit to my background, my title is marketing director for Axiom, but I also am the producer of Climbing Mount CMMC. I've had the opportunity to watch some incredible women step into that platform and speak of what they're doing.

[00:02:02] And I was like, OK, hold on. I need to learn more from these people and these women in CMMC. And so I'm here learning. I am excited to honestly, hopefully get my CCP sometime this year. So I'm just now stepping into this space and I hope that this inspires other women like me that are stepping into this space to learn more, find opportunities and yeah, just crush it.

[00:02:28] So, Corinne, why don't you share what you do, who you are, what your company is and yeah, a little bit about yourself. OK, well, I'll start with what you just said. So we are a licensed training provider for the CyberAVN DoD program. I just got in teaching CCP this week and we had 27 students in there. It sold out. Wow. Yeah. And that's really great since the rule passed.

[00:02:53] I mean, no more, no extra advertising or anything, just everyone's really down for getting into this now and learning more about CMMC. And I always say that CCP is like, man, it's it's the way to go. If you are trying to either get ready as an OSC or an MSP or a want to be an assessor, it's the first step. So it's just a great, great full of content type class. Everyone's ready to, you know, die on Friday afternoon because they've just ingested so much information.

[00:03:22] But yes, super helpful. So that's one thing that we do. And then right as I was teaching, we had our final authorization call with the AAB and became the 40th or actually that day five more popped onto the marketplace. But now we're an authorized C3 PAO. That was a huge, huge journey and not an easy one for sure. And so I'm very proud of that. And then I, you know, by trade, I'm just a network and systems engineer.

[00:03:49] So I'm very nerdy and technical by by trade. I, you know, used to be a Cisco instructor and a Microsoft instructor and a security architect for most of my my life.

[00:04:03] And I've been in IT for 25 years. So probably about 10 years ago, most of the work started gravitating towards very specialized security engagements and investigations or tightening things up, you know, all types of stuff. And so we got on GSA hacks, which is a GSA schedule for penetration testing, vulnerability scanning and threat hunt and things like that.

[00:04:28] And then right around that time, right as I got on that schedule, I found out about CMMC and we were, you know, interested in work in a different assessment regime, which was more internal to the government that had to do with the Department of Homeland Security. And I was like, whoa, this is this is awesome. What is this? And that was all she wrote. So I immediately it's so funny. My best friend who's not technical at all came home from work one day and she's like, every day we have to talk about this thing.

[00:04:58] CMMC, it seems like what you do. And I'm like, I've never heard of that before. And this is, you know, five or six years ago, five years ago, I guess. And I just, you know, just off of her saying that I went and researched all I could in the second. I mean, it couldn't have been more than a few weeks before I was completely enrolled in the PIPA program, which was the initial way they that they they kind of, you know, got the initial assessors into the ecosystem.

[00:05:25] And oh, man, it's just been one out of all the things I've ever done in my career. It's just been the most awesome way to tie everything together and meet amazing people and be part of something super special. Yeah, I want to dive into that because you have some experience. You have a lot of experience with CMMC assessments and other types of assessments. Right. You were talking about like vulnerability assessments, like things like that. You did penetration testing in the past and that that's your experience.

[00:05:54] And coming from that, can I ask what the difference is? Like if there are big differences between those two types of assessments and what that might be, the things that really stood out to you when researching, you know, CMMC versus what you came from. So what is like a big difference?

[00:06:13] So the biggest difference is that CMMC is very rigid and very hard to accomplish this amazing set of controls that truly secure an environment. So it's the most effective thing I've ever seen because it is not letting people just say, oh, I don't want to do that. Can I get excused from that? It just it doesn't have so much of that involved in it.

[00:06:38] It's hey, you must do these things unless it truly, truly doesn't apply, which is rare. And you or the DOD says that there's which will hardly ever happen, you know, if they were to excuse you from something. But I think what's different in RMF or some of the other types of assessments that are closely related is that you have the data owner there with you. They are capable of accepting risk on behalf of themselves.

[00:07:07] And so we don't have that in CMMC. We're out there alone without the data owner. The DOD is not with us. We are a third party assessment company. And so we can't just turn around and say, is that good enough for you? Do you accept that? There is none of that. There is no the data owner doing control selection or, you know, accepting a certain level of risk. You know, we just don't get a whole lot of that in CMMC.

[00:07:32] So that's what makes it so different and can also make it so difficult for OSCs or OSAs now to to try to to meet these standards. So I think they're surprised by how much how the lack of flexibility, although we did get some more flexibility with the new rule, which was a pleasant middle ground, I guess, where, you know, we have to give and take a little bit.

[00:07:55] And we got some things that can make this a little more realistic for OSCs and give them some options as far as getting there. So, you know, you said that, like, it was a lot more rigid specifically as an assessor for that. Has it been more difficult in that perspective when assessing, you know, OSCs or OSAs?

[00:08:22] Is it is it harder in that sense? Have you noticed something that is, you know, maybe easier or more difficult in that perspective? Well, I'm going to tell you that answer, but not from an assessor's point of view. So I have definitely assessed on JSVA's large primes and things like that. But I spent most of my time being assessed. So we brought our MVP enclave.

[00:08:47] We over the past 13 months, for example, it's been in front of 20 different DIPCAC assessors and all of the OSCs started from nothing. They had barely anything going on as far as CMMC goes. And it took about eight months or so with each one to build that culture, to make that drastic change, to get some history and some evidence going is just a lot of work.

[00:09:11] And I've never lost so much sleep or done such hard work before under any other program that I've tried to ready people for or, you know, accomplish. So I will just say that when I'm getting them ready, in my head, I'm thinking there's 600 or 700 different things this assessor could ask about, but they're only going to ask about probably 150 or 200 things. And I just don't know what those are.

[00:09:41] And it's a scary feeling to, with the lack of, you know, if you miss a three-pointer or a five-pointer that you're now kind of maybe not, you know, what's going to happen here is a bad feeling. And then just the objectives alone, the 320 objectives, that is a long list, you know, and really understand them.

[00:10:07] And so technically and culturally, it is a lot, but it's also very cool to see where people start and where they end up and how much they buy into it. And those are the ones that are successful. So we're pretty picky about who we take on. And it's not, it's okay for them to have nothing, but they have to come with a good attitude and buy in, you know, so. Right. It makes it a thousand times easier. Yeah.

[00:10:32] So culturally, you were talking about the difference after going through and preparing as a company. Can I ask too specifically about the culture? What did you notice coming out of preparing for an assessment and going through all 320 of those assessment objectives and preparing your company,

[00:10:56] not only for an assessment, but also gathering that evidence, you know, taking those eight to 12 months or whatever to prepare? What did you notice was big differences on the other side? Well, it's just so funny because they get so strict. Like they are like little tattletales after that, you know, in the company, they know what the rules are and they don't want to break them. And they love like, they're kind of proud of it.

[00:11:24] You know, there's a pride and there's a pride in the process. I would say there's a relief on their part. It actually does make things a little easier and they're not feeling that burden of like, man, you know, they know nothing's going to get compromised and they're going to get blamed for it. They feel pretty confident that they're doing all the right things and that they're being really careful with the data. So I guess I sense relief and pride and they're ready to go out there and win contracts and brag about it is what I noticed.

[00:11:53] I love that. So I want to switch to another side of this is your training. You talked about that at the beginning. What made you step into that training world? Because you didn't necessarily have to do that. You know, you could have kept to yourself maybe a little bit over there. But like what made you choose to step into that world? So I've always been a teacher. So I started out as a high school chemistry teacher. Really? I didn't know that. Yeah. Okay. And I loved that.

[00:12:23] And my father was like, hey, you need to come over to this DoD contract. He was vice president of a DoD contracting company. And he was like, this Internet thing is going to be huge. And I was like, oh, what is that? I remember going to Barnes and Nobles in 1999 and looking for Network Plus, like network essential type. Barnes and Nobles. Yeah. Yeah. Okay. That's awesome. Really dating myself.

[00:12:50] And just, you know, immediately after this is like when you're not going to know this because this was a long, long time ago. But NT4O and some of these really old, even Nortel and all types of really old operating systems were around at that time and networking equipment. And so anyway, I worked for his company and I got under the wings of some really talented architects that were building.

[00:13:18] Back then it was called ATM on military bases all over the world. So I got to travel all over the world. I lucked out with these super talented cutting edge network builders. And I mean, Italy, you know, Signala, Spain, all types of places. And when I left, I was a paper MCSE. So a paper Microsoft certified. I knew nothing about networking whatsoever. I just knew how to pass the test. I was really good at finding this.

[00:13:46] But by coming back, I was excellent at understanding a lot more. I wasn't excellent at building networks yet. That would come over time. But I found out that you could teach that stuff. And so I was like, oh, wait a second. There's a teaching world to this. And so I quickly went to a place where I could be both a network engineer and systems engineer, but teach. So I began teaching Cisco and Microsoft. And I became like a pretty high end Cisco instructor in the routing and switching world.

[00:14:16] They have a pretty difficult instructor exam and just went down that route for many, many years. And so I've always, always been in the classroom to some degree. And our company was started in 2004. And I'd say a quarter of our revenue has always been in special training engagements. Wow. That is so cool. I had no idea that you started in teaching. That's amazing. It kind of carried through to CMMC where there's a space that you could do both. Yeah. And I thought I was done. I thought I had graduated from system architecture and building networks and being in the weeds.

[00:14:45] But I am more in the weeds now than I've ever, ever been in my career with GCC High and building networks up there and building architecture up there. Yeah. Wow. I also didn't realize that we had the same thing in common where it comes to our dads telling us about how Internet and IT was going to be the thing. So that's kind of cool. Yeah. And we have a lot in common because we're moms trying to juggle being a mom in this very technical world.

[00:15:13] And so that's a huge element that has shaped my entire career is trying to be a mom and spend maximum amount of time with my kids. I'm religious about being the one who drops them off. I'm religious about being the one who picks them up. And despite any awesome contract or whatever I was doing, I didn't care if I lost it if I wasn't going to be able to do that.

[00:15:33] So it has shaped the things I've, you know, like even me getting into CMMC, I'm always thinking, how can I shape this so that I will still have the time that I need with the kids? And I'm a single mom, so there's no one else who's going to drop them off or pick them up. No one else is going to fold laundry. No one else is going to cook dinner. No one else will ever take them to another doctor appointment. I am 100% on my own.

[00:16:01] And I have a super soft spot for single moms who are tackling that. It's very difficult to explain to anyone what it's like to know that there is no one else that when the school calls and somebody's sick, you have to leave work. You've got to stop what you're doing and you've got to go. Yeah. So I wanted to, you know, mention that since this is about women. And I know there's single dads out there, too. And same, same thing. It's just you can do it.

[00:16:30] Like, I know people think that they can't, but there are so many ways to participate in CMMC part-time or in the evenings. And that's what I did for a long time. I was a weekend night worker so that I could spend those days with my young children and all that stuff. So I just encourage people to think outside the box. You can still keep growing and studying. And it is hard at times.

[00:16:58] But this is a great field to be in if you've got those kind of challenges, you know. And so, yeah. I'm so glad that you brought that up because it's just like it is really difficult to be full-time employee, full-time mom, you know, trying to be involved fully in the ecosystem while also being a mom, which literally never stops.

[00:17:26] And so it's just – it is something that I – my daughter is – she's two and a half. And so I am a new mom as well as new in the ecosystem. So I guess I'm doubling both at the same time. But it is something that has been so difficult for me in the sense of compartmentalizing my brain to be prepared to be fully present, you know, when going out.

[00:17:51] And also, like, why does the – why do all these organizations like to post their drafts and their final, you know, whatever on, like, Christmas vacation, Thanksgiving? I'm like, I've got to be with my family. Hold on. But you know what? Yeah, well, that's what I say. I'm like, I know I could read that later. And it's not going to give me a leg up to read it before the next person. I'm very logical about stuff like that. I'm very confident about nobody can take this from me.

[00:18:16] And me spending an hour with my kids or two hours with them, you know, so be it. If I lose a little opportunity, it's not what people think. You're not going to lose everything because you, you know, enjoyed Thanksgiving and didn't read the new rule or you weren't the first person to post a comment on LinkedIn. Right. It's just it doesn't matter. It matters how good you are at what you do and who needs what you do. That's what matters. Exactly. Hey, we're raising little world changers, you know? That's right.

[00:18:46] You never know what your kiddos are going to accomplish. I don't know about you, but my kids, they know all the CMMC lingo. They know everything. They're going to be way more prepared than they even need to. That's crazy. They're going to step in and they're just going to run, take off. That's awesome. I want to ask you two specifically while we're in this space.

[00:19:08] Is there something that being a mom while also working full time in CMMC, is there something that you feel like has, like being a mom has taught you and prepared you for in the business world? Like something mentally that going through being a mom has helped you in your business world? Yes. I mean, there's nothing like trying to survive and what it can prompt you to do, right?

[00:19:34] When you are desperate to make it, it will pull things out of you that you never even knew you had. So, I mean, I think all of us face times during COVID. And I know many friends in CMMC who risked it all for this day to come and to be a part of the program.

[00:19:51] And I was definitely one of those people where, I mean, I was like, there was a point where I was like, am I being irresponsible with my kids by taking this level of risk in my business and putting it all, put it all on this? But I'm glad I did, you know, and I don't know if I would have taken those chances if I wasn't so desperate to survive is the best way I can put it. Like, I've got to figure this out. I'm the one sending three people to college.

[00:20:20] I'm the one sending, you know, like, I've got to figure out a way to make this happen. And you're capable of things you don't even know you're capable of. And being a mom or a dad just pulls a power out of you that is really amazing. And I'm so thankful for that drive that it gives you. Like, I remember, you know, times where I've felt a little bit, you know, just that tad of sorriness for yourself. Why does everyone else not have to have it this way? And I have to have it this way.

[00:20:51] And I remember listening to David Goggins and he's like, you can keep on crying. Nobody's watching. Nobody cares. And or you can just take all of it and do something with it, you know, and make it into something pretty awesome. And so I'm like, that's how I am. I love that. Yeah, I remember when I brought my daughter home for the first time, like becoming a parent and you look at the kid and you're like, holy crap, this kid relies fully on me.

[00:21:18] And if I don't deserve them, they are going to die. Like, I'm like, oh, my gosh. Like, that is like a awakening. Like, it's like it is survival of like, how do I do this? What do I do? Because this baby is relying on me kind of thing.

[00:22:01] We're involved in this because we are figuring it out together. And we're working together to make this ecosystem thrive. And it's very, very cool to see. So I'm so glad that we were able to connect those two things because I really I cannot agree more with both of those. So something you just said that's kind of funny is all those other times in my IT career, there were no women around.

[00:22:28] So I've never been around women until now in CMMC ever. I've never sat at a table because I don't know if it was just the tables I was sitting at and the type of work I was doing, which was pretty deep. Level network and systems engineering. There just was not ever another woman around that I could talk to about. They were around in the building, you know, in other jobs, other places. And I love they were my friends.

[00:22:55] But I'm just saying in work, doing the exact same thing that I'm doing and being my peer and all that. But I IT has and it's also the change of the times where now women really are embracing cyber and IT and we're really, really good at it. But I mean, having all my girlfriends and this has been the absolute best and most awesome thing about it.

[00:23:19] And I've never had such great friends that were women, that were peers, that are amazing, that I look up to more than anyone I've ever looked up to. You know, there's just, you know, Joy Beeland, Carly Salmon. And I mean, Carly Logan, you know, all of the Amy Williams, all of these mentors that and then I mean, I could go on and on with just so many amazing women in the ecosystem.

[00:23:48] Right. Yeah. I mean, I definitely when I started in because I am a marketing director for an IT company, but I have learned IT throughout my whole life from my dad. And then going into high school, we had opportunities to go to certain academies, depending on what you wanted to learn. And like high school or college. Yeah. In high school. In high school, we had academies and you were like, you could do digital media.

[00:24:17] You could do accounting. You could do, you know, there's different types of them. And there was an IT and security one. And I was like, yes, I want to do that. Like, I want to learn more of even what my dad is doing. So I sat into that and there was like 35 boys in the class. I was the only girl. See, that's for me. Yeah. I was the only girl in the whole class. And for the rest of high school, I stayed through it all, even though it got difficult with some of those guys.

[00:24:46] I'm not going to lie. I was like, can I please have a table by myself? I'm begging you. But, you know, top scoring in the class. I stayed up there with them, you know, and I got certifications in Microsoft and whatnot through that class. Which has been really cool. But definitely no women in that class. So it was, that was my first, you know, experience with IT and whatnot.

[00:25:08] So I was so pleasantly surprised when stepping into the CMMC world three years ago of like the amazing women that are already in this and stepping in it constantly. So it is super cool to see for sure. Yes, I want to ask you about specifically difficulties.

[00:25:30] So when you stepped into the CMMC world, was there something that was, I guess you could even say, you could speak like five years ago to Corinne stepping into CMMC, like what you wish you would have known going into it that has been difficult. Is there something that you would have said to her five years ago or warned about? Oh, that's a hard one.

[00:25:59] I've had just such an amazing experience. And I guess I, you know, just didn't understand how much people will move and shift. It's not good or bad. But you think of people as like, I know them here at this company, that's where they're going to be. And there's a lot of movement going on because this is very immature program that hasn't had a chance to mature. And companies are trying to adapt very quickly.

[00:26:29] And so people are moving around a lot as well. And so, you know, just I think I would have just been a little bit quieter and listened more. It would be the only thing I would do different is. I've been frustrated at times because of certain things.

[00:26:54] And now I don't get frustrated as much anymore because I've learned how this program is just trying so hard. All of us are trying so hard to make it better. And, oh, even with the AB, you know, I was slightly impatient, not really understanding if that would be what I could change. Not understanding how this monumental task that they're up against and what a great job they're doing for what they have in the situation that they've been put in.

[00:27:24] It would just be to kind of take a step back. And, you know, I wish I had kind of understood that from the beginning. And any time that I was frustrated, just offered, you know, some type of help or positive. You know, I've been I've been for the most part positive, but I could have saved myself some frustration by just realizing that everybody was waiting. Everybody was kind of frustrated.

[00:27:49] And you just needed to kind of give it some grace while it went through its iterations. And now we're here, you know. I think that that's really that's really great to think about because it's so true. And you can see it even on social media platforms, you know, LinkedIn, like people are mad about that. I don't think I've ever done that.

[00:28:09] Yeah, but if I have or even slightly been argumentative or whatever, that is just something I've completely stopped, probably stopped that like two years ago where I was like, we need to not be, you know, debating to the point where it sounds like arguing and more. Or just making sure you frame it correctly and that you teach in a nice, respectful way.

[00:28:34] And that that part of things we've really got to get under control is the these people don't know like I know or, you know, all that stuff. Right. So just, you know. Yeah, I totally agree. Yeah. And OK, I have one last question for you before we close. And I just I just am curious for and for people listening, maybe they can, you know, look forward to this in your journey as you continue with CMMC and as it's evolving this.

[00:29:04] I feel like this year is going to be wild, you know. So I want to know, do you have like a goal that you want to share on here for your 2025 that you're looking forward to as a company or as a person, just yourself? Yes. So I've been sprinting now for three years trying to do huge things very, very quickly. And I am exhausted from that. So I'm looking forward now that it's all done. There's nothing else to achieve. I mean, we are at the end of that road.

[00:29:33] There's going to be things to achieve like ISO compliance and other things. But I want to take a step back and really organize, automate and get efficient. I can't wait to take it to the next level. So I was climbing before. Now I'm here and I'd like to optimize. So I just can't wait to have a chance to optimize.

[00:29:57] And I'm a big, you know, content development, content management system developer and things like that. And so I can't wait to try to get some power automate, share points and all together to. So you're speaking my language right now. I like it. Yeah, that is great. I love that. I love that analogy too, that like you've climbed it. But now it's like time to make yourself efficient, make that process efficient now that you've created it.

[00:30:25] And, you know, congratulations as a company, the C3PAO. That's so exciting. And I'm so glad that you're able to share that on here. And thank you for sharing just even a little bit about your journey and where you are right now. And I'm excited to hopefully have you on again and hear how your 2025 went. Honestly, that would be so much fun.

[00:30:47] But I hope that many of you guys listening, whether you are a man or a woman, I hope you enjoyed this and are inspired to step into this ecosystem if you haven't already. Or if you're in it to continue and learn from other people, educate yourself and also grow. And, yeah, I'm excited to continue this podcast episode series with many other amazing women. But thank you, Corinne, for joining us.

[00:31:15] Please make sure to follow her on LinkedIn and other platforms to continue to be inspired and learn from what she is doing over there. But until next time, guys, just keep on climbing. See ya. Make sure to follow us on LinkedIn and YouTube to stay up to date on the latest CMMC news. We hope you guys enjoyed today's episode and listen out for the next one. But until then, keep on climbing.