President & CEO, eTrepid Inc.
Tom Blandford is President & Chief Executive Officer of eTrepid Inc., where he leads the company’s work across artificial intelligence, security governance, risk, and compliance (SGRC), IT operations, cybersecurity engineering, and operational resilience. His experience spans governed AI adoption, secure infrastructure, defense IT, compliance readiness, and the design of resilient technology environments for organizations operating in demanding and regulated environments. He directs eTrepid’s engineering practice and the ThreatKrusher Cyber Defense Ecosystem, with a focus on practical governance, disciplined operations, and technology that supports business and mission objectives.
Showing all 18 authoritative defense IT, compliance, and governed AI guides.
An asset beside, connected to, administered with, or used by the same people as a CUI asset is not automatically in or out of CMMC scope because of proximity. The organization needs to understand...
Backups preserve data, restoration recovers files, disaster recovery restores systems, and business continuity sustains operations. Understanding these four distinct tiers separates true operational resilience from unverified data copies.
A policy, screenshot, ticket, report, configuration, or attestation may help support a claim, but none tells the whole story by itself. A reviewer needs to know which system or information boundary...
Whether CMMC applies is not a question a website can answer for every organization. The answer depends on the actual solicitation, contract, task or delivery order, the work being performed, the...
Determining whether an MSP or MSSP requires independent CMMC certification depends on what the provider does, which assets it uses, and whether it handles Controlled Unclassified Information or Security Protection Data.
An automation can follow a defined rule. An AI-enabled workflow may interpret context, generate content, recommend an action, or interact with systems in ways that are less predictable. The label matters less than what the workflow can access, what it can do, who relies on the result, and what happens when it is wrong.
A GSA Multiple Award Schedule (MAS) contract establishes pre-negotiated commercial ceiling rates and baseline terms. It does not award a task order, endorse a contractor, or establish that every requirement fits the vehicle.
Multi-factor authentication protects sign-in, but it does not govern identity. Comprehensive identity governance requires continuous lifecycle management, least privilege, privileged access governance, and zero-trust controls.
A cybersecurity capability statement is a summary for discovery—not proof of compliance or suitability. Government and enterprise buyers should systematically validate claims against primary source records.
In CMMC Level 2 scoping, a Security Protection Asset, often shortened to SPA, provides a security function or capability within the organization seeking assessment's CMMC Assessment Scope. It may be...
An External Service Provider (ESP) under CMMC 32 CFR Part 170 is an outside party used for comprehensive IT or cybersecurity services. Scoping depends on data handling, system connections, and security functions.
An MSP manages technology; a CSP delivers cloud computing. In CMMC and DFARS 252.204-7012 compliance, understanding whether your provider is an MSP, a CSP, or both determines applicable FedRAMP and scoping rules.
Approve a bounded business use—not “AI” in general. Before anyone connects data, invites users, or automates an action, create one decision record that names the purpose, accountable owner, allowed data, technology boundary, tests, human controls, monitoring, incident route, and shutdown conditions.
A rule effective date does not answer whether your company needs a particular CMMC status for a particular opportunity. The Government solicitation, prime contract, subcontract,...
A DFARS 252.204-7020 Basic Assessment is self-generated, but it still requires a methodology-based assessment, an adequate System Security Plan, a defined CUI environment, and a score the contractor...
The strongest preparation is not a last-minute document collection. It is a scoped, operating security program whose people, technology, records, and System Security Plan tell the same story.
GCC High can provide an appropriate Microsoft 365 service boundary for sensitive defense workloads. It does not define your CUI scope, configure your tenant, protect every connected asset, write an accurate SSP, or prove compliance alone.
Most failures do not begin on assessment day. They begin months earlier, when an assumption is recorded as a fact, a tool is mistaken for an implemented requirement, or evidence is collected without...