From IT To CMMC: Implementing A Practical Approach to Cybersecurity

When organizations earn their Cybersecurity Maturity Model Certification (CMMC) certification, they feel secure and accomplished. But for Aaron Liebensfeld, SteelCloud’s Director of IT, CMMC isn’t where the journey ends. Getting certified isn’t the same as staying secure.

“If you treat CMMC like a checkbox, you’ll drift immediately,” he states. “An organization can invest significant time and resources preparing for an assessment, but if you don’t continue those practices afterward, the security posture gradually deteriorates.”

That perspective comes from a career that has taken Aaron from a childhood fascination with computers to specializing in IT infrastructure, compliance, cybersecurity and, ultimately, leading SteelCloud’s own CMMC journey.

A Career Path That Led to Compliance Excellence

Aaron’s interest in technology started early. His first exposure to computers came in 1991 through an older household computer running Windows 3.1. By the time he graduated high school, he’d earned his CompTIA and Cisco networking certifications. In college, he immediately found purpose in the IT department, working alongside infrastructure and security professionals. In the summers, he was consistently getting technology work.

Once he began his professional career, Aaron followed opportunities that increasingly brought him into HIPAA, SOC, NIST, PCI DSS, SOX, ISO, CMMI and, most recently, CMMC. Each experience added another piece to Aaron’s understanding of how organizations translate compliance requirements into actual operational practices.

At his previous employer, a government contracting organization, Aaron became responsible for helping the company prepare for NIST and later CMMC requirements. That’s where he realized that achieving compliance was only half the battle. The real test comes after the certification.

“I don’t think organizations struggle most with defining or implementing requirements,” he states. “I think the main challenge organizations face is sustaining compliant practices over time.”

With his first CMMC journey behind him, Aaron was ready for new challenges. “I had run the program from start to finish; from the original NIST requirements through the current CMMC version 2 ones” he says. “The government accepted our assessment score and report. We passed. That gave me the confidence to feel like I could take this show on the road and lead these kinds of programs elsewhere.”

A Practical Approach to Leading SteelCloud’s CMMC Program

At SteelCloud, Aaron found an immediate opportunity to apply all the experience he’d amassed over the years. He had seen firsthand how the cost and complexity of compliance can affect small businesses. The requirements, third-party assessments, security products and documentation can create a significant burden.

“When CMMC version 1 first came out, there was a lot of ambiguity surrounding it,” Aaron notes. “There’s a bit of a cottage industry built around determining what’s actually required to meet some of these standards.”

For SteelCloud, that has meant carefully examining contracts, scoping and defining security boundaries and controls, and building the evidence needed to demonstrate compliance.

“We wanted to determine whether we really needed to spend an arm and a leg getting every aspect of the company compliant, or whether it made more sense for our own maturity to separate some of these things,” Aaron says.

The objective wasn’t simply to make everything compliant at any cost. It was to understand what was actually needed to stay inside the boundary of all of CMMC’s requirements. That distinction matters particularly for a smaller organization where budget, manpower and time may be lacking.

Aaron’s Most Important Cybersecurity Advice

In addition to taking a prudent approach to certification and maintaining the Company’s security baseline, Aaron also notes that when cybersecurity fails, it’s not always the fault of technology. Sometimes it’s because users are busy and frazzled. Maybe they click on a link too quickly. Or reuse a password. Or respond to an urgent email without stopping to check who it’s from.

Aaron believes that human element is key to keeping systems secure. “At the root of most cybersecurity challenges is really just getting people to slow down and read things over twice,” he observes.

His advice is straightforward – adopt a few simple habits that make it harder for attackers to catch you off guard like the following:

• Check the sender’s email address instead of trusting the displayed name.

• Double-check unexpected requests.

• Don’t reuse passwords because it’s convenient.

• Ask for help when something doesn’t look right.

• And be skeptical of urgency. Attackers intentionally create urgency because urgency makes people stop thinking critically.

For Aaron, cybersecurity awareness isn’t primarily about turning every employee into a security expert. It’s about developing good habits. And those habits don’t happen in a vacuum.

“Every aspect of cybersecurity and organizational culture begins with leadership,” he observes. “Leadership has to reinforce the idea that security matters even when there isn’t an immediate payoff. Otherwise, employees naturally gravitate toward whatever makes their jobs easiest.”

Once You Build It, Sustain It

To sum up the advice he offers for Cybersecurity best practices, Aaron says, “Slow down.” Users need to stop and think before clicking. Teams need to take the time to get the right buy-in and set the right expectations. And then you need to put in the time to sustain your baseline after the audit is over. Simply put, Aaron states, “As an organization, you improve your security posture by maintaining it.”

Aaron is fully invested in his role at SteelCloud. His experience across IT, compliance, cybersecurity, contracts, sales engineering and operations gives him a broad perspective. And SteelCloud gives him an opportunity to exercise all those muscles.

But if he could choose another career path tomorrow, he’d be a music composer. Aaron plays piano and synthesizers and has spent years doing music and audio production. He also has experience in video game development and enjoys creating in general. However, Aaron is happy to put those hobbies aside to spend time playing with playing make-believe, telling stories, riding bikes and exploring the things his preschool daughter is excited about.

For Aaron, it’s not just what you build in your life, it’s about sustaining it.