New Cybersecurity Maturity Model Certification requirements create surge in demand for auditor training

With the highly anticipated Cybersecurity Maturity Model Certification (CMMC) regulations just beginning to be implemented, there’s a soon-to-be booming market for cybersecurity auditors with the skills to meet the new requirements. 

What is the Cybersecurity Maturity Model Certification (CMMC)?

The CMMC regulations being rolled out by the Department of Defense are designed to help protect important information from cyber incidents. Under the new rules, Pentagon contractors and suppliers will be required to adhere to certain standards of security and to be certified by third-party auditors. Organizations will be required to meet different levels of security requirements depending on the type of work they do.

That’s why LX Labs author and senior instructor Ken Magee said the timing couldn’t be better for auditors to assess their current skills — and get a jump on preparing for the changes occurring because of the new regulations.

He should know. Ken is the president and owner of Data Security Consultation and Training and has been involved with cybersecurity auditing for more than 14 years. He’s also the author of the new Cybersecurity Auditing Fundamentals Learning Path in Infosec Skills.

Cybersecurity Auditing Fundamentals

Build your cybersecurity auditing skills

The new learning path includes four courses to help master the controls needed to mitigate your organization's risks to confidentiality, integrity and availability. You’ll learn about:

• An auditor’s role in reviewing cybersecurity controls and understanding defense-in-depth
• Why security governance is critical to maintaining confidentiality, integrity and availability
• The different components of cybersecurity operations
• The different types of digital assets and the controls to protect them

“There is a great level of technical detail that's required to be able to audit network and network components, databases and database controls, and the operating systems and controls built into them,” Ken said. “We are the subject matter experts when it comes to controls, because we'll look at an environment and find the weaknesses.”

“Once you find a weakness, the client is going to want to know how to fix it. So we also need to communicate intelligently and explain to them what controls will work given the problem the organization is experiencing.”

In addition to authoring the Cybersecurity Auditing Fundamentals Learning Path, Ken is developing Infosec Skills’ new DoD CMMC Preparation Boot Camp. The five-day boot camp provides a comprehensive overview of the CMMC requirements as well as practical recommendations and tools to help DoD contractors achieve CMMC certification.

What does a cybersecurity auditor do?

Ken said the problems and issues auditors regularly see can vary, but it helps to be able to detect patterns and anomalies. 

“You might see a server in the DMZ that has the system administrator account locked out,” Ken said. “On one particular day that’s no big deal. Maybe the person forgot their password. But if that's a repeated pattern over time, it could be an indication there's been a brute-force attack.”

Other common red flags for auditors include watching for unauthorized access or the breaking of acceptable use policies, such as people using their work computers to browse the internet for things they shouldn't be doing.

“All organizations have to manage their own people, and that's one of the big issues we have in security,” Ken said. “That's the insider threat. There’s also other countries trying to find out what we're doing through economic espionage or stealing intellectual data. Everybody wants to know what everybody else is doing so they can mimic product or data knowledge without having to actually develop it themselves.”

The changing role of the auditor

Ken is encouraged about the expanding role auditors are now shouldering. The increased responsibility reflects on the trust being placed in the profession to help keep organizations secure.

“We’re not just auditors anymore,” Ken said. “The federal government now has security control assessors. They're auditing, but they’re really providing an assessment of the existing controls as to whether they're working or not. So in a way, we go from being simply IT auditors to being risk assessors. We've become spokespeople for the organization in terms of where the organization has risk, and that's vitally important.”

Get your free course catalog

Download the Infosec Skills course catalog to learn more about these courses — and hundreds more.

Download Now

See Kens' courses

About J Kenneth (Ken) Magee

Ken is President and owner of Data Security Consultation and Training, LLC. He holds a bachelor’s degree from Robert Morris College in PA and a master’s degree from Fairleigh Dickinson University in NJ. He has taught cybersecurity at many different venues, including the JAG school at the University of Virginia, KPMG Advisory University, Microsoft and several major federal financial institutions and government agencies. Ken has also taught cybersecurity classes in the UK, Ireland, Germany, Canada and Mexico.

As Chief Information Security Officer for the Virginia Community College System, Ken’s focus was standardization of security around the ISO 27000 series framework. Writing is one of his passions and he has authored and/or co-authored several courses, including CISSP, CISA, CISM, CGEIT, CRISC, DoD Cloud Computing SRG and a course for training Security Control Assessors using NIST SP 800-53A. In addition to many years in IT, Ken has achieved a number of certifications in the cyber security/information security field, including CISSP, SSCP, CCSP, CAP, ISSMP, ISSAP, ISSEP, CISM, CISA, CAC (Cybersecurity Audit Certificate), CEH, ISO9000LA, ISO14001LA, ISO27001PA, Security+, CySA+, CASP, CTT+, CPT, GSEC, GSNA, GWAPT, CIA, CGAP, CFE, MCP, MCSA, MCSE and MCT

When not teaching, writing or consulting, Ken devotes his spare time to animal rescue, (dogs and cats from no-kill shelters), being a student of language (French) and music (Banjo), and doing research about his Scottish heritage, the Knights Templar and British Navy sailing ships from the late 1700s.