Cyb-Her: Transitioning Your MSP to CMMC Compliance

[00:00:00] Hello Climbers and welcome back to another episode of Climbing Mount CMMC the podcast. I am your co- or I guess I'm your host today, Julia Adams, joined by our wonderful guest and host normally, Kaylee. I pushed her to be on here today and I said I'm going to interview you and you're gonna have to deal with it. I feel very weird about this. Listening to somebody do the intro that's not my voice is weird.

[00:00:27] I feel weird doing it, honestly. Because I'm usually on the production side. Yeah, you are. This is weird for me. This is weird for both of us. It's a new experience. Yeah. And Bobby's not here. And so when Bobby does the intros, you know, we had to do it a couple times. Sorry to say that. I thought I was gonna have to do it a couple times. I kind of nailed it there. Not gonna lie. Okay, so for those of you that don't know, Kaylee has worked at Axiom for almost 10 years, nine years now officially. She started when she was

[00:00:56] young and probably shouldn't have been working, but she's been working there for nine years. She started out as the call coordinator and kind of moved into marketing and then to business development and now her new title COO. And I forced her to be on here because I think that she's amazing in this industry and she would never ask to be on this podcast herself for Cyper. So I made her do it because I think she has a lot of amazing insights to share and a lot of experience.

[00:01:26] So let's start off Kaylee. Tell us a little bit about yourself. So most people, you know, know me as either just a voice that's on climbing Mount Seam of Seam of Seam of Seam of Seam of Seam or Bobby's daughter, right? So I think it would be wrong of me to not start there by saying I've been a part of the MSP space for a long time because of my dad. And so for those of you guys who are not aware, Bobby Guerra, who is the CEO of Axiom is also my dad,

[00:01:55] happens to be when I was, oh, but a weak child. He would bring me along to site trips. We used to have an office back in the day close to our house and I would go and do work days with him in the office. And so I was always partly involved when I was a kid. Then my dad told me that I was a kid. I wasn't able to get a phone unless I worked for it. And there you go.

[00:02:24] And there you go. And that's how it started at all. That's how it started. So I became the call coordinator for Axiom. It was not called Axiom actually back then though. Yeah, it was before the name change and before the orange. It was black and white back then. Oh, interesting. Yeah, we were called innovative technology team. Oh, what a mouthful. A little bit more than Axiom. Yeah, a little bit more. I did the call coordinating so I had to answer the phone calls and direct the

[00:02:53] tickets that were coming in. And I did that as a job for a little bit of time until I had to go back to high school. And then once I was out of high school, I was like, you know what, I think I'm going to try doing this thing again. And so that's really when I started as the call coordinator in the service department and the help desk space. I just so happened to get roped in. And I really liked the client. It really does. You told you.

[00:03:18] Yeah, I liked connecting with the clients and caring for them. I didn't love getting yelled at over the phone, but I liked being able to help them solve their problems. So I guess you could say that that was like, you know, the hook into this space. And that's how I, I guess, started off. Yeah, that's really cool. And how did you kind of grow into your role of what became like three different roles after that? Like starting off as the client coordinator. I mean, like you said,

[00:03:45] you're dealing with service team issues and client projects and items like that. So what made you look at the marketing department and say, that's kind of where I want to go? I would say that's my, I would say that's my dad's fault because it was like, look, you're young. You know, surely you've picked up a phone before, social media, you can do marketing. That's what got you here, really. He's like, put it to use. Yeah, he's like that phone that I made you work for. Yeah, you're still paying for it.

[00:04:15] You're still, you've filled up my marketing department. Yeah. Good news. I still have a phone. He's, he's still allowed me to have a phone. He's let you have one. Yeah, he, he kind of, he was like, try it out. And so I said, okay. And I was still doing the call coordinating and then also doing the marketing. And I, I really enjoyed it so much so that I ended up doing the marketing full time, which, you know, I'd started off as me not really

[00:04:40] knowing a lot about it, but then I got some certifications, learned more about the marketing space. And then I could do that really for a full-time job rather than splitting my time. Then I went more towards marketing and sales and it was great, but it's very, very hard to sell an MSP and in the MSP marketplace because everybody acts like they're exactly the same. And I mean, I have

[00:05:07] to, I mean, I hate to pat ourselves on the back here, but I would say our service team is amazing. Like how fast they get response times with the clients and they close tickets. It's really, really incredible. But to, to sell that when everybody's saying that they have something like that is hard. So I was not the biggest fan of doing it. It was definitely very difficult. And I think anybody who's trying to market an MSP knows exactly what I'm talking about. And

[00:05:32] especially when Bobby said we only wanted to service Florida. So we were only servicing Florida at that time. So not only did we have to market for an MSP marketplace, which is hard to market for already. Also, Florida is hard in itself. So that's like a whole nother challenge. It was definitely difficult, but you know, I started figuring it out until he threw a wrench in my plans and gave me something brand new, which we know as CMMC.

[00:06:01] What was that brand new thing, Kaylee, that transitions to our next topic of CMMC? Because that's kind of like what defines those two roles as well as your call coordinator, marketing person, as just an MSP. And then while you were still marketing person, you transitioned to this completely, I mean, not different, but a new world of IT and cybersecurity. And it must have been

[00:06:25] kind of a culture shock for you and Bobby and the MSP as Axiom as a whole. So how was that introduced to you, I guess? Yeah. So I think it was four years ago now because I had just told my dad that I was pregnant with my daughter and I was like, hey, dad, you're gonna have your first grandbaby. And we were so excited. And he's like, that's awesome. I've got a new project for you. I want to tell you about this

[00:06:54] thing called CMMC. So he said, I also have a baby. I also have a baby. Here's my baby. This is it. Yeah. Oh my gosh. His baby's way harder than mine. Yeah. Like way more difficult. Yeah. And so I started researching about it and he wanted me to make marketing content on this. And so I started looking up like what an assessment is. I was trying to do things internally

[00:07:23] that would give us a leg up when we were going to start taking clients for CMMC because we didn't take them right away. We were trying to get ourselves prepared and get ourselves CMMC level two certified. So while my dad was trying to tackle the hurdles of like figuring out how to write our SSP and how to make those things happen, I was also trying to think like, okay, what is he doing? How are we going to do it? And how can I market that? Because for those who are not aware of how

[00:07:51] marketing works, you have to be the months ahead of when you actually want to see the growth happen. So you can't just post a few things tomorrow and then expect to start getting clients. You have to really, you know, start it super early and then prepare into the future to be getting potentially leads coming in through those things. So I was really trying my best to set us up for success.

[00:08:15] That's when I decided to attempt things like a podcast about our journey and stuff like that. And it ended up thankfully paying off. But then at the same time, we were trying to do this, the sales leads that were coming in and Bobby was doing them. We're not like a massive company that has tons of employees. We're a small business, just like many people that are listening to this. And so we didn't have one person that did sales. It was really Bobby that did it. I started learning from him

[00:08:42] how to do it so that he wouldn't have to do it forever. And then I started wearing that hat as well. So not only was I having to learn through the podcast and through having guests on and being able to ask them questions as well as trying to market it. And then I also was in the sales calls trying to sell it. So there was multiple different aspects that I was learning CMMC from. And then all of a sudden I started learning the acronyms.

[00:09:08] And it was the hardest part, really. So you talk about how you handled CMMC front-facing, like with the podcast and with the marketing as well. But what a lot of people don't know is you also worked internally on building CMMC and scaling it for Axiom as a company and within and how hard that must have been just as much as marketing it and Axiom as a MSP that now does CMMC. So

[00:09:35] how was that process internally? Well, it's interesting because when your dad is the CEO and you are very connected with him, how his brain works, a lot of the times you are intertwined in many different aspects of the company and just what he's doing and understanding it, even though you're not doing that job full-time. And so I was very much involved with all the things that he was

[00:10:03] doing because he would teach me. He also knew that one day he wanted me to be the role that I am right now. And so with that perspective, he always was a really great teacher and would take the time to teach me each of the aspects of it. And it was very helpful that I came from the service department, you know, and I started there. And I did that for many years before switching over to

[00:10:26] the marketing department. So I knew our customers. I know our service team. I know how we operate. I know our project team because I worked with them for a while before my transitioning to marketing. You know, when I started, there was only five of us and I was the only girl. I was the only woman. And now we have multiple amazing women, you included, and Shelby, who's sitting in the background

[00:10:50] so you don't hear, but she's listening. But, you know, it's definitely very interesting to be a part of a company when they were so small and be a part of that history. And so you just, you know a lot about how it functions, how the gears turn. And then with Bobby sharing his knowledge and wisdom that he brought in through CMMC and then learning from people way smarter than me in the government space,

[00:11:16] like Joy Beeland, Corinne Wise, you know, Fernando Machado. Oh my gosh, literally Kiri. You think about all the amazing people that some of them are not even in the space anymore. Oh, Amira. That's Amira Armand. All of those people that because my dad just put me in the room with them, I was able to learn a lot from them. And so I'm very, very grateful for how they continue to pour in to me and

[00:11:43] what I do. And as well as what they did when I was just little infant, Kaylee in the CMMC space. But yeah, I would say. It's amazing the things that you were able to learn in such a short period of time and what you were able to learn and then teach me because I've learned so much of what I know from listening to you talk about it. Yeah. Which is crazy. You talk about how you're like a baby,

[00:12:09] but then I'm just a little baby. Because I've learned pretty much everything that I know from you and Adam and Bobby as well. So it's been a really great experience to get you guys having all of those outlets to learn from and then pouring into me all of that stuff as well. That's a testament though to when you put your mind to something, when you really choose,

[00:12:32] hey, I'm going to commit to learning about this ecosystem, how it operates, NIST 800-171. I want to take people through it. I want to do my job well. When you really commit to it, you can learn a lot in a short period of time and you can truly help in the ecosystem in whatever way you prefer to do. For example, when I learned about it, my direction was different than when we were

[00:12:59] teaching you about it. Now you're in the GRC world and writing a bunch of documentation and you started in marketing too. And so I feel like that is a huge, huge testament to when you really are listening to and learning and choosing for it to go in one ear and out the other, but really applying it. It's really cool what people can do. Anybody can do that.

[00:13:23] You and Bobby say, when I was in the podcast on the producing side, it's like I would have to try not to learn CMMC. I'd really have to turn you guys out because I'd be on every single episode listening to every single guest and you guys in conversation about a million different kinds of CMMC topics. So yeah, I'd have to try not to learn anything, but it's been great being immersed in CMMC that way and listening to you guys. It's really rewarding. I went from writing CMMC

[00:13:53] CMMC memes to writing CMMC documentation. So I love that for you. You all start somewhere. I love it. I love it. I wish you still wrote some memes sometimes and put them in the SSPs so that it's like just a fun little joke for the assessors as they go through it. Like while you're scrolling through 200 page document, you just see this little meme. That's kind of fun. I should do that. Okay. Well, that comes into, we took the CCP course together. When was that? Like last year? November. November of last year.

[00:14:23] You know exactly when it was because if some of you may not know this, but while we were about, was it with a week before that we were about to take the CSU together? Kaylee actually went into labor with her second child. And so she's crazy because she went into, she was my boss at the time. So she messaged me when like the night she had already gone into labor and was like, Hey, I went into labor, but just message me. I'll be, I'll be available.

[00:14:51] And I'm like, you're, you're crazy. So that just tells you Kaylee's dedication to her role as well. Psychopath. Absolutely freaking lunatic. That goes into talking about the CCP course because she did the same thing. I would be logged in listening to Corinne teach. And I look at Kaylee's icon is there and I'm like, girl, what are you doing here? But yeah, she's just dedicated CMMC life. The grind never stops.

[00:15:17] Listen, when Corinne speaks, you listen. Sorry. Sorry about my little baby that was in the NICU. But I mean, he was, he, he just was sitting there all perfect and beautiful. And I just had happened to have the CCP courses in the background. Might as well. But in your ears. I was sitting there. Yeah. Sometimes you need a little bit of a distraction during those times. That's true. And in that, yeah, I can imagine, but that just shows just how dedicated you are. So what do you

[00:15:43] think taking the CCP course would do for someone kind of in our position? Yeah. CMMC and maybe more of a beginner or maybe they are a contractor that's just trying to learn. Yeah. What do you think it did for you and how do you think it would be beneficial for others to do it as well? I mean, I truly think that anybody who's going to be in this space, it's going to be handling CMMC, whether they are in a

[00:16:12] company, you know, they're an OSC and they're implementing it in the company, or they are a service provider of some kind that wants to help companies implement this. Any of those types of people, 100% needs to do the CCP course. I could not imagine trying to, I don't know why you'd not want to do it truly, because I've only heard positive feedback when people go through it. It's not like

[00:16:39] they go through it and they go, frick, we didn't need that. We didn't need that knowledge. You know, it's like, that doesn't make any sense. And so, I mean, there's a lot of transitioning happening right now in the ecosystem with ISACA taking over, like, the Keiko position. And they are adapting. And probably at the end of this year, they'll be adapting to Rev3 version of the CCP, which I'm going to be honest

[00:17:04] with you, we don't know exactly what's happening there. So, I can't really speak to all that. But one thing that is for certain is the CCP courses are still happening with amazing providers right now. And so, there's no reason to wait. You definitely should still go and take the course and take the test. I'm a little bit weird because I sat in some of Bobby's CCA course when he did it before

[00:17:30] the CCP. I snuck in sometimes and I was just listening out. And I wouldn't recommend doing that because doing it flipped. There's a reason why they tell you to do the CCP before a CCA. You have to, like, unlearn some stuff. Yeah. I was like, yeah, they were talking about the nuances of how you can interpret controls. And they're not ready for that yet. Yeah. You're not ready for that yet. You need to take the CCP course first, then go to CCA. But I would even recommend for at least one person, like, if you're

[00:18:00] an OSC listening to this and you're trying to implement it in your organization, I think at least one person in their staff needs to at least take the CCA course. Definitely take the CCP, but you could even take the CCA because to know what an assessor is thinking and how they're going to attack the controls and how they're going to ask you the questions. You want to know some of those things. The CCP course does teach you some of that stuff, too. It teaches you about the CAP. So, that is really

[00:18:28] nice. I definitely got a newer perspective on it. But I also hope that some people get a lot of knowledge from this podcast, too, because I truly did, even starting with season one and season two, if you go back and listen, like, I never talked. I was just listening because I didn't really know. I didn't know anything, so I couldn't talk. And I still am continuously learning.

[00:18:54] And I think that hopefully we will continue to give that knowledge that we know and will continue to learn down the path to people like me coming in that didn't know anything, you know. So, with that type of knowledge and with, you know, CCPs, like, those types of trainings, I think it'll be, I think it would be really awesome. Yeah. And I would recommend everybody do it. I feel like there's never going to be where it's just stagnant and nothing's changing.

[00:19:23] Right. I think so. It's keeping track of everything that's changing and staying up to date on it, too, is really important. And I think that this podcast does a really good job of doing that because we've talked about it before. If you go back to season one, you're probably, you would hear things be like, oh, that's not necessarily true anymore. Or, oh, that's changed. So, maybe. Oh, my gosh. Maybe use another video. No way I'm going back and listening to season one. I hope you know that. And everybody listening, don't freaking do that. Don't do that. Sorry. I didn't say that.

[00:19:52] Yeah, I would just give an example. Don't actually go back and listen to season one. Yeah, don't do that. Don't do that. I mean, you can for fun, but maybe listen to the more recent ones. Yeah. Okay. And going back to something that you mentioned previously about how you started Axiom being the only woman among a bunch of IT dudes and kind of the point of this podcast of Cyper, what is it like being a woman in a male-dominated industry for you? Because it's

[00:20:19] a personal experience for everyone. Some people may haven't felt the effects or they felt it in just different ways. But it's a little more nuanced for you as well because you're a woman, you're young, and you're also the daughter of Bobby, who's the CEO, who's a pretty prominent figure. In this industry. So explain your experience with that. Yeah. Those are all a little bit different of like, I mean, everybody says don't judge a book

[00:20:49] by its cover, but let's be real. We all literally judge books immediately by their covers. I do. Yeah. Oh, I do. Actually, not full. Not full. No, no, no. Both. I do both. Yeah. No, actually, I do both. But it's like, I mean, I understand it. It's not necessarily something that people always do with a negative intent. You know, it's just part of, I think, how our brains work as people. And so

[00:21:16] it definitely is interesting stepping into a space that is male dominated. But I feel like the CMMC ecosystem, I would say the IT space and the MSP space, I definitely don't see a lot of female representation. It's starting to become more, which is really, really cool. But definitely when I started, I didn't even know that there were women who did this at first. In the CMMC space, though,

[00:21:43] even some of the people that I mentioned earlier that poured into me, like those women, you know, were already in this space and had been for a while. And it's kind of crazy how there's so many powerful women in CMMC that are doing crazy, amazing things. And so it really, really inspired me to just be like, okay, yeah, I'm meant to be here. I can be here too. It's fine. But definitely

[00:22:09] being young, I would say that that's probably something that is honestly more shocking to people. Even they definitely don't assume that I've been a part of Axiom for nine years or, you know, or longer because it makes sense. I'm young. So I just decided to, I decided to go in and do what my dad does, which not everybody does. And so that gave me a little bit of a leg up to have a lot more

[00:22:36] experience with being still being young. And then I think the other piece of it, like how you said, um, being Bobby's daughter, there is an interesting perspective too, that, that you hear people are saying, oh, oh, this is your daughter. And then Bobby goes, yes, but also she runs this stuff. Like, like they'll ask Bobby a question when Bobby turns and he goes, she'll know the answer to that. I've heard that firsthand of just being like, I don't know.

[00:23:05] I'm guessing Bailey would know a little bit more about that. Yeah. And I think, I think though, when it comes to, I'm going to try, oh gosh, I better not do an analogy and just be in a great, a great example of how I am his daughter through and through. And do it. And do an analogy. Um, but like talking about judging a book by its cover, you know, I kind of love the opportunity to be a little bit of a different weird cover. You start reading it and

[00:23:34] then you realize, wow, this book is super interesting. You know, I will admit being a 26 year old woman who is a COO that is a part of the CMMC ecosystem. I haven't met a lot of them. And if you are one comment down below. I'd love to be your friend. Love to be your friend. Would love it. But I have not met a lot of them. And so I'm grateful for the

[00:23:59] opportunity, but it is a little bit of a weird cover, you know, but I think my goal is no matter who talks to me, like I definitely don't, I'm not going to act like I know everything about the CMMC ecosystem in the government space, because we're still learning as an MSP, but I definitely know Axiom and I know what we do and I know how we operate and I'm proud of what we do. We have a really, really awesome team. And so I love talking about it. And my hope is that when people start hearing

[00:24:28] what I'm saying, maybe the weird cover doesn't seem so weird, you know, and it's just, it's just who I am. And that, and that is what it is. And I think that honestly, that goes for anybody. Like if anybody has, you know, something that they feel like is setting them back in a certain way, no matter what that may be, you, you should stand your ground on what, you know, stand your ground on who you are,

[00:24:53] what you know, and don't act like you know everything because we don't all know everything, but you know what, you know, and be proud of that. And, and, and so I think that, that, that was something that I had to accept too, where it's totally fine if somebody says, oh, you're Bobby Starr. Sure. I sure am. And, you know, soon you'll learn a few other titles that I also have. I'm also a mom and a wife and a COO and, and that's okay. And then they'll figure that out. I think as they

[00:25:22] get to know me or if I don't like them, they won't know me enough to know those things and it doesn't matter. I think they'll see it too. And I think you've told me that before. It's more rewarding where you're just like, yeah, I'm his daughter or let them think how they think. And then they see you kind conferences, doing your own speaking engagements and rivaling, rivaling all these CMMC experts, you know, you're right there. And then they'll see you and be like, oh, I chat GPT'd at all. I

[00:25:51] don't freaking know a single thing. I'm just kidding. I've forgotten here day one. Thanks, Pat. Yeah. Okay. Well, this has been such a great conversation, Kaylee. I'm so glad that I'm having imposter syndrome. I'm like, I'm so curious on how many people actually got to the end of this episode. And actually listen to what I'm going to say. I'm going to make everyone watch this and listen to everyone. If you, if you listen to this point, how about this? We'll do something fun. Let's do

[00:26:16] something fun. If you listened to the end of this and you're, and you're hearing me now, give me the best Bobby analogy that you can in the comments or something like that so that I know that you're actually listening. I think that you're actually listening. Yeah. There's so many. Pick one. And if nobody, if nobody says anything, I absolutely quit. We quit the podcast. The podcast ends. Guys, please call me to, I'm done. We need her. Okay, guys. Thank you so much for watching. Don't forget to like and subscribe and comment

[00:26:44] down below if you have any questions or your favorite Bobby analogy so Kaylee doesn't quit. And as always, guys, keep on calling. Bye.