CS5 East 2026

Most CMMC scoping conversations focus on networks, servers, and managed endpoints, but few account for the mobile devices employees actually use to access Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). While CMMC requirements continue to evolve, the obligation to protect CUI and FCI under NIST SP 800-171 and DFARS 252.204-7012 remains. That leaves government contractors with a common challenge: how do you enable a mobile workforce without quietly expanding assessment scope, increasing compliance risk, or creating productivity-killing workarounds? This isn't theoretical. From the U.S. Army's transition from its legacy DMUC mobile program to the Army Mobility Program (AMP), to mergers and acquisitions, globally distributed workforces, and complex contractor ecosystems, government contractors and subcontractors of every size are navigating the same tradeoff - providing secure mobile access without giving up control of sensitive data. This interactive three-hour workshop explores why mobile devices quietly expand assessment scope, examines today's mobile threat landscape (including unmanaged devices, BYOD, Shadow IT, and AI-driven threats) and draws on real-world government and industry examples to illustrate practical approaches organizations are using today. Attendees will also work through a practical five-part framework for evaluating mobile access that can be applied whether preparing for a C3PAO, government-led assessment, or a self-assessment. WORKSHOP AGENDA The Problem → Use Cases → Mobile Threat Landscape → Applying the Framework → Assessment Readiness → Open Discussion ATTENDEES WILL LEARN HOW TO • Identify where mobile devices quietly expand CMMC assessment scope and compliance risk. • Apply lessons learned from real-world government and Defense Industrial Base mobile modernization initiatives. • Recognize how today's mobile threat landscape (including BYOD, Shadow IT, and AI-enabled attacks) targets unmanaged endpoints. • Apply a practical five-part framework to evaluate mobile access within their own environment. • Secure access to CUI and FCI without unnecessarily increasing compliance scope or operational burden. • Document mobile access strategies within the System Security Plan (SSP) and understand how a Shared Responsibility Matrix supports inherited controls. • Leave with a practical mobile assessment checklist that can be used immediately to evaluate their organization's environment.

This interactive executive workshop provides a practical roadmap for scaling AI and agents with measurable business impact. Through business-focused examples, selected demonstrations, implementation guidance, and governance strategies, attendees will learn how to prioritize high-value use cases, build scalable AI-enabled solutions, measure ROI, manage costs, and govern AI responsibly across the enterprise. Format: Three integrated workstreams (45 minutes each) plus discussion and Q&A. WORKSTREAM 1 (45 MINUTES) Transform: Identifying High-Value AI Opportunities and Measuring Impact AI success starts with business outcomes, not technology. This session explores how leading organizations identify, prioritize, and scale the use cases that generate the greatest value. Attendees will learn practical approaches for linking AI initiatives to strategic objectives, defining measurable KPIs, establishing ROI frameworks, and tracking business impact. Real-world examples and case studies will highlight how organizations are accelerating productivity, improving decision-making, and transforming business processes through AI. Key Topics • Prioritizing high-value AI use cases • Aligning AI initiatives to business strategy • Defining and measuring ROI • Establishing KPIs and value realization frameworks • Real-world transformation examples and lessons learned WORKSTREAM 2 (45 MINUTES) Implement: Building Agents, Automating Work, and Scaling Responsibly Moving from ideas to production requires a scalable implementation strategy. This session explores the foundational principles behind agent development, workflow orchestration, and enterprise automation. Through practical examples and interactive demonstrations, attendees will learn how agents can work alongside employees, how automation accelerates business processes, and how organizations can manage consumption through AI FinOps practices. The discussion will focus on building sustainable architectures that balance innovation, operational efficiency, and cost management. Key Topics • Agent architecture and design principles • Agent-to-agent and human-to-agent collaboration • Automation and workflow orchestration • AI FinOps and consumption management • Cost optimization and responsible scaling WORKSTREAM 3 (45 MINUTES) Secure: Governing AI with Confidence As AI becomes integrated into business-critical processes, governance becomes a business enabler rather than a constraint. This session explores the security, risk, compliance, and governance capabilities organizations need to scale AI responsibly. Attendees will learn how to establish governance frameworks, manage access and identity, protect sensitive data, monitor agent behavior, and create sustainable operating models that enable innovation while maintaining trust. Key Topics • AI governance operating models • Data security and information protection • Identity, access, and agent governance • Compliance, risk, and regulatory considerations • Monitoring, observability, and control frameworks • Scaling AI securely across the enterprise

CMMC is no longer a planning exercise. DFARS 252.204-7021 has been showing up in Department of Defense solicitations since November 2025, and on November 10, 2026 (the odds are non-zero), third-party certification (crystal ball is buffering) becomes the expectation for most Level 2 contracts involving CUI. For aerospace and defense companies, that turns a compliance project into a bid eligibility problem, and it doesn't leave much runway to spend on bad information. That's the other problem worth naming. Search for CMMC guidance and you'll find a hundred confident answers, a fair number of which are wrong. Some of it is honest confusion. Some of it is fear being sold as urgency. This session is about separating the parts that are genuinely hard from the parts someone made up. We walk the full path to a passing Level 2 assessment, told by people who have actually been through it. Advisory first: policies and procedures that hold up under scrutiny, a System Security Plan that matches how your business actually operates, and using a POA&M correctly instead of as a place to park problems. Then technical remediation: enclave versus taking the whole environment in, what FIPS-validated and FedRAMP actually requires and why assessors care so much, and the requirements that quietly sink assessments: scoping calls, external service providers, security protection assets, and evidence nobody generated until someone asked for it. Then management: the shared responsibility matrix with your cloud and service providers, and what IT and leadership have to do every day to keep a certification valid once you have one. We close on the assessment itself: prep, the days in the room with a C3PAO, and what actually goes wrong. Come with questions. Clients who have passed Level 2 will be here, along with Certified CMMC Assessors and Certified CMMC Professionals. If you've heard something about CMMC and thought "that sounds made up," this is the room to find out. Bring the question you've been sitting on. Asking "for a friend" is completely acceptable.

If you aren't CMMC certified yet, your time is almost out before enforcement cracks down. Join a comprehensive CMMC readiness bootcamp to learn from experts at top assessor A-LIGN, MSP partner Summit 7, and Microsoft for real-world lessons during CMMC assessments and how to get your organization ramped up for assessment as soon as possible. We'll cover: • Lessons from more than 100 CMMC assessments • Ensuring your assessment is properly scoped • How to prepare your team for your CMMC assessment

Since July, the deadline moved, the program went under review, and new funding started reshaping who’s buying compliance. Your clients’ obligations under DFARS 7012 and NIST 800-171 stayed put, and so did the environment those obligations rest on. HERE’S WHAT WE’LL COVER Who’s paying for this now? A fireside chat with Golden Dome for America’s Sean Redman on the funded pathways covering first-year compliance costs. In his first public discussion on the topic, we’ll dive into who qualifies, what’s covered, and what changes for providers when a program is paying for your client’s first year. Bring your questions - we’ll have plenty of time for Q&A. A clear line between what you own and what they owe. We’ll get specific about the shared responsibility matrix: which controls your clients inherit from you and which ones they still handle themselves. That matrix is what your client is leaning on when they sign their SPRS affirmation, so it needs to be right. What I always wanted to know about ITAR but was afraid to ask. CMMC is rarely the only rule your clients’ data falls under, and ITAR raises questions CMMC never asks. Katie Sweeten, Partner at Scale LLP, will take the ones MSPs ask most, like whether a non-U.S. person on your team can have admin access to a client’s tenant, or when an MSP needs its own DDTC registration. You’ll leave knowing which of these apply to you and what to fix first.

You may know what requirements your suppliers have. Do you know what you actually need to know about them, how much confidence you should have in the answers, and whether your supply chain can still deliver when something changes? HOUR 1 Everyone Is Somebody's Supplier: What Do You Need to Know? Supply chain risk starts with visibility. What do we actually need to know about our suppliers, sub-tiers, products, data, dependencies, and exposures? The answer is probably different depending on where you sit in the supply chain. HOUR 2 Requirements vs. Assurance: How Much Confidence Is Enough? A requirement creates an obligation. It does not automatically create assurance. What should a customer ask a supplier to demonstrate? When is an attestation enough? When do we need evidence? When is independent verification justified? And at what point are we simply adding cost without meaningfully reducing risk? HOUR 3 Every Supplier Meets the Requirement. Are You Resilient? A supplier can meet every applicable requirement and we can still have a serious resilience problem. Single-source dependencies. Obsolescence. Counterfeit parts. Critical materials. Cyber risk. Provenance. Geopolitical exposure. Fragile sub-tiers. The question that ultimately matters is much simpler: Can we still deliver when conditions change?