RHTG @RightHandTech

“They’re going after the hospitals, not us.” Actually… they’re going after you because you don’t have the same defenses. Small ≠ safe. #Cybersecurity #MSPPanel hs.rhtg.net/msp-panel

Verizon’s 2026 DBIR found the human element in 62% of breaches—build a recurring, role-based security awareness program to cut the odds. righthandtechnologygroup.com/blog/cybersecu… #Cybersecurity #MSP

A lot of shops think their SPRS score only matters for direct government bids. Primes and higher-tier customers are already checking it during supplier reviews. Missing, low, or outdated scores make it look like cybersecurity isn’t being managed. Most of those scores were self-assessed — nobody verified the controls. Even with Phase II suspended, the questions haven’t disappeared. Know what your score is saying about your shop before a customer decides for you. Book a free consultation meetings.hubspot.com/jason-vanzin/w…

IC3 reports tech support + government impersonation call fraud drove 80,000+ complaints and $2.9B in losses in 2025—train your team to hang up and verify. righthandtechnologygroup.com/blog/cybersecu… #Cybersecurity #ITSupport

Here’s the hidden problem with saying “our IT provider handles most of CMMC.” Most is where the gaps usually live. Regular IT can keep systems running and handle day-to-day issues. CMMC asks different questions — scope, CUI movement, access, evidence, and documented processes. Those pieces aren’t always part of a normal support agreement. IT can operate controls. Someone still has to own defining, documenting, testing, and proving them. Without that, “mostly covered” turns into “not ready” fast. Schedule a free consultation with our cmmc experts meetings.hubspot.com/jason-vanzin/w…

A user gave up credentials—but reported it fast. We locked it down in minutes. Blame-free culture saves systems. #Phishing #IncidentResponse hs.rhtg.net/msp-panel

The day you realize you’re already handling CUI, your business doesn’t change all at once. But a lot of smaller things start changing together. Tighter rules on who can open drawings. Where files can live. Remote access. Which vendors can touch the data. Stronger subcontractor agreements. Better logging and access reviews. You may also find systems you thought were outside the problem are already in the CUI workflow. That’s why scoping matters. Map where CUI enters, where it goes, and who’s touching it. Once that map is accurate, the work becomes manageable. Without it, the small changes pile up fast.

“I don’t want my name in the paper if we get hacked.” That’s not fear—it’s foresight. You will be named. Just ask the HVAC vendor from the Target breach. #ReputationRisk hs.rhtg.net/msp-panel

DFARS 252.204-7012 requires DoD contractors to implement the 110 security controls in NIST SP 800-171 to protect CUI. righthandtechnologygroup.com/blog/complianc… #Cybersecurity #CMMC

Two machine shops can look almost identical and still face completely different CMMC timelines. The difference is usually the customer sitting directly above them. If you sit under a major prime or a Tier 1 under heavy pressure, the requirement can show up sooner — in questionnaires, portals, flow-downs, or bid packages. Another shop doing similar work may hear nothing for months. That doesn’t mean they’re exempt. Pressure just moves down the chain at different speeds. Even with Phase Two suspended, the variation is still there. Customers can still ask about CUI protection, SPRS scores, and future requirements. Build your timeline around your customers and contracts — not the shop down the road.

IBM reports vulnerability exploitation caused 40% of observed attacks in 2025—shrink your time-to-fix with continuous vulnerability management. righthandtechnologygroup.com/blog/cybersecu… #Cybersecurity #MSP

Full-network CMMC isn’t always the answer. An enclave can isolate just the CUI work so the rest of the shop stays out of scope. Depends on size, data flow, and what your customers are actually demanding. If you need help answering the question of full network vs enclave for your business, start by booking a free consultation here: meetings.hubspot.com/jason-vanzin/w…

Start with what you can’t lose. That’s how you prioritize protection, detection, recovery. Miss that? By the time you see a ransom note, it’s too late. #CyberResilience hs.rhtg.net/msp-panel

Old CNC machines can still work under CMMC — if you isolate them properly. Separate network + tight access controls. Assessors care about containment, not whether the machine is new. If you need help making sure an old machine is isolated properly, we've got you covered. Start by booking a free consultation here: meetings.hubspot.com/jason-vanzin/w…

“Cybersecurity is planning for the inevitable. Resilience is planning for the probable.” Budget for both. Recovery isn’t optional. #CyberBudgeting #Resilience hs.rhtg.net/msp-panel

If a pen test gets in and nobody notices for 3 days, that insight is often more valuable than the vulnerability itself. righthandtechnologygroup.com/blog/cybersecu… #Cybersecurity #MSP

CMMC isn’t only about the network. Visitor logs, locked CUI areas, and controlled access still get checked. Soft physical security can sink the rest of the program. Get started by booking a free consultation here: meetings.hubspot.com/jason-vanzin/w…

A strong vCISO engagement can surface around 20 distinct security priorities—enough to drive change without burying your team in noise. righthandtechnologygroup.com/blog/cybersecu… #Cybersecurity #MSP

External connections can pose threats to CMMC compliance. 🔍 CMMC Assessor Matt Gilbert stresses the importance of secured networks. Hear more at our next RHTG Office Hours 📢 𝐑𝐞𝐠𝐢𝐬𝐭𝐞𝐫 𝐧𝐨𝐰: righthandtechnologygroup.com/officehours?ut… #CMMC #CyberSecurity #Compliance

It’s harder to get buy-in right now. But waiting to “buy the lock” after the door’s kicked in isn’t a plan. Phased cyber resilience beats inaction. #CyberResilience #PhasedSecurity hs.rhtg.net/msp-panel