2025 CMMC Summit Recap: A Must-Know Briefing for Cybersecurity Professionals

The 2025 CMMC Summit gathered the brightest minds in cybersecurity for a full day dedicated to the Cybersecurity Maturity Model Certification (CMMC) 2.0, evolving compliance requirements, and the future of cyber defense in the public sector.

Whether you're a cybersecurity professional supporting a prime contractor or managing internal risk for a defense-focused organization, the Summit offered practical insights to help you stay ahead of the curve.

Hosted by the Cybersecurity Association, the event served as a strategic touchpoint for cybersecurity leaders including government contractors.

Understanding What’s New in CMMC 2.0

The first sessions of the day tackled the foundation: what has changed and what hasn’t with CMMC 2.0. Key updates covered:

• Streamlined compliance levels

• Closer alignment with NIST 800-171

• Self-assessment guidance for Level 1 organizations

• Emphasis on third-party certification for higher levels

CUI Protection: From Concept to Control

Protecting Controlled Unclassified Information (CUI) remains a central responsibility for cybersecurity professionals working in or around the federal space. The Summit highlighted:

• Best practices for identifying, categorizing, and protecting CUI

• Legal and regulatory implications of mishandling CUI

• Case studies of recent data leakage events and lessons learned

How to Evaluate and Prepare for the Right CMMC Level

Ben Tchoubineh (Phoenix TS), guided cybersecurity professionals through:

• How to determine your organization’s required CMMC level

• Building a compliance plan with realistic timelines and budgets

• Internal team roles and responsibilities in the certification journey

Attendees walked away with practical checklists and tools for internal gap analysis and readiness planning.

When (and Why) to Pursue a CMMC Assessment

For many attendees, the question was not “What is CMMC?” but rather, “Do we need to be assessed now or later?” CMMC speakers addressed:

• The criteria for mandatory third-party assessments

• Documentation and audit trail requirements

• What assessors are really looking for

Their advice? Start gathering artifacts now, even if your formal assessment is a year away.

FedRAMP ≠ CMMC: What Cybersecurity Pros Need to Know

For those managing cloud environments or advising government contractors, understanding the distinction between FedRAMP and CMMC is critical.

• FedRAMP is for cloud service providers; CMMC applies to defense contractors

• The two frameworks have different control sets and audit structures

• Cybersecurity pros often need to manage both simultaneously

Featured Speakers Who Shaped the Day

The success of the Summit was due in large part to our expert lineup of speakers, including:

• Matt Travis – CyberAB

• Ben Tchoubineh – Phoenix TS

• James Goepel – Fathom Cyber

• Michael Snyder – CAICO

• Timothy Schilbach, PhD, CISSP, CCSP, OSCP, OSCE – Penacity, LLC

• Daryouche Behboudi, CISM, Lead CMMC-CCA – CohnReznick

• Aaron Christmas – Ronathan.AI / ESR, Inc.

• Jacqui Magnes – CISPOINT, Inc.

• Jay Ethridge – TBS LLC

• Tobias Musser – MNS Group

• Evan Neufeld – Edwards Performance Solutions

• Srikant Rachakonda – SMPL-C

• Claude L. Williams, CISSP, CASP, CBCI, CHFI, CSA, ECIH, EDRP – CyNtell

• Jermaine Ross – Summit Business Technologies

Their contributions created a high-value learning experience tailored for today’s cybersecurity professionals, especially those working with or advising government contractors.

Keep the Momentum Going with the Cybersecurity Association

The 2025 CMMC Summit may have wrapped, but your learning doesn’t have to. As a cybersecurity professional, staying ahead of federal compliance trends and threat intelligence is more important than ever.

Join the Cybersecurity Association

Stay plugged into critical updates, CMMC 2.0 developments, and professional education throughout the year. Become a member today to access exclusive content, training events, webinars, and tools tailored for the cyber workforce.