Cybersecurity for the space supply chain.

Summary

---

T-Minus Space Daily: Cybersecurity for the Space Supply Chain

Podcast: T-Minus Space Daily by N2K Networks
Episode Air Date: February 14, 2026
Host: Maria Varmazes
Guests: Frank Schementi (Director of Programs, Beyond Gravity), Reagan Edens (Founder & CEO, DTC Global)

---

Episode Overview

This episode centers on the growing urgency of robust cybersecurity practices throughout the space industry’s supply chain. Host Maria Varmazes speaks with Frank Schementi and Reagan Edens—panelists at Commercial Space Week—about why cybersecurity risks increasingly threaten all layers of the space sector, how regulatory standards like CMMC (Cybersecurity Maturity Model Certification) are restructuring the landscape, and what cultural and operational transformations are required to safeguard critical data and ensure global competitiveness.

---

Key Discussion Points & Insights

1. Why Cybersecurity Now Touches Every Department

• Cybersecurity Is No Longer "Just IT":
  • “Cybersecurity used to be the responsibility of the IT department… That is no longer the case.” – Frank Schementi [03:25]
• Data Leaks & Competitive Disadvantage:
  • Government and commercial stakeholders recognize that data leaks result in enormous losses and enable adversaries to shortcut their own R&D, threatening national competitiveness.
• Supply Chain as the Primary Vulnerability:
  • “Our supply chain is our biggest risk. How do we lock down that data?” – Frank Schementi [03:34]
• Three Data Protection Pillars:
  • Focus extends beyond CUI (controlled unclassified information) to also include intellectual property (IP) and employee data.

2. Monumental Cost and Risk

• Staggering Losses to Adversaries:
  • “Estimates are $900 billion a year lost to our adversaries. The entire defense budget, every single year, lost through exploitation, sabotage...” – Reagan Edens [04:48]
• Small Business Challenge:
  • 98% of the U.S. defense industrial base employs fewer than 100 people, meaning many suppliers lack the resources to independently develop robust cybersecurity defenses [05:14].

3. Implementing CMMC: Technology vs. People

• IT Solutions Aren’t the Hardest Part:
  • “It’s never the technology… Now it's the people, making sure they understand that when they bring in new equipment... it doesn't create new threats.” – Frank Schementi [07:18]
• Operational Tech Is a Major Vulnerability:
  • As manufacturing technology becomes interconnected (e.g., networked 3D printers, CNC machines), each device can become a potential entry point for cyberattacks.
• Culture Change Required:
  • “Having everyone aware of that, thinking that way, asking those right questions… It becomes more of a people thing, making sure everyone's on board, than a technology problem.” [08:25]

4. Driving Digital Transformation Through Compliance

• Changing Organizational Behavior:
  • “This idea of operationalizing cybersecurity through the manufacturing process… is a transformation of the organization, from sales all the way through to order fulfillment.” – Reagan Edens [09:19]
• Compliance is a Beginning, Not the End:
  • “The compliance regime usually starts out with, OK, what do I have to do, meet minimum compliance… Fifteen minutes after the assessment, we’re done. That's not this.” – Reagan Edens [10:28]

5. Competitive Advantage: Differentiating on Cybersecurity

• Customer Decisions Drive Cybersecure Suppliers:
  • “Two of them, the data just went out to the cloud and was no good. One of them didn’t… So there was a differentiator.” – Frank Schementi on product selection based on cybersecurity [12:45]
• CMMC as Revenue Opportunity:
  • “Almost every single client that we have has seen a top line revenue growth between 10 and 20%… If you're the only compliant organization, ask for more business.” – Reagan Edens [15:09]

6. Security Culture and Human Factors

• Stewardship, Not Just Compliance:
  • “The message is not, 'we’re doing this for compliance sake.' That’s the most demotivating thing I can think of.” – Reagan Edens [17:17]
  • “Data stewardship is the equivalent to quality. If we don’t meet that stewardship goal… we don’t have a customer anymore.” – Reagan Edens [19:16]
• Leadership’s Pivotal Role:
  • “When leadership realizes that data security is critical for the success of their organization, until that point, they won’t take it as seriously.” – Frank Schementi [20:38]
  • “Leadership is not getting the next sale… Leadership is operationalizing and solving hard problems in the 21st century.” – Reagan Edens [22:51]

7. Unique Challenges in the Space Sector

• Space Supply Chain Complexity:
  • Custom, small-batch manufacturing means suppliers may be unable or unwilling to invest in CMMC due to the small share of business for space contracts [25:12].
  • Companies respond by redesigning components to be more “COTS”-like (commercial off-the-shelf) or vertically integrating production to maintain data security.
• U.S. Industrial Base and Strategic Risk:
  • "American manufacturing has got to decide that America still has to cut and bend metal… If we don’t do that, then who is going to do that?" – Reagan Edens [27:26]
• Ecosystem Evolution:
  • Suppliers that embrace cybersecurity become more valuable as others opt out, leading to market consolidation and opportunity for growth [28:58].

8. Advice and Final Thoughts

• Think About "Why":
  • “When you think of CMMC, consider the why. It’s a huge advantage for your organization. It's a huge risk if you don't do it.” – Frank Schementi [29:04]
• Deliberate Transformation and Education:
  • “It is complex, it is transformational. It is a business decision that you need to make deliberately… There’s a necessity to walk through that seven stages of grief.” – Reagan Edens [29:35]
• Wise Counsel is Essential:
  • “Choosing who you seek wise counsel from… can incorporate into success or not take you to where you need to be. So choose that and choose very, very wisely.” – Reagan Edens [30:37]
• The Spirit of the Space Industry:
  • “The entire cornerstone of space is that we solve hard problems that no one else can do… This is another thing that must be done.” – Reagan Edens [31:23]

---

Notable Quotes & Memorable Moments

• On Competitive Losses:
  • “Estimates are $900B a year lost to our adversaries. The entire defense budget, every single year lost…” – Reagan Edens [04:48]
• On Compliance vs. Stewardship:
  • “Data stewardship is the equivalent to quality… If we don’t meet that stewardship goal, we don’t have a customer anymore.” – Reagan Edens [19:16]
• On the Real Challenge of Cybersecurity:
  • “It's never the technology… It becomes more of a people thing, making sure everyone's on board than a technology problem.” – Frank Schementi [07:18]
• On Market Opportunity:
  • “We have the opportunity for organizations to take the largest market share opportunity in probably the defense industrial base history.” – Reagan Edens [15:54]
• On Leadership in Space:
  • “Why I love space is because they have 22nd century vision to operationalize and solve hard problems in the 21st century.” – Reagan Edens [22:51]

---

Timestamps for Key Segments

• [03:25] – Why cybersecurity matters at every level in the supply chain
• [04:48] – The cost of cyber loss and distinction between small/large suppliers
• [07:18] – Implementing CMMC: technology vs. people challenges
• [09:19] – Digital transformation through compliance: cultural impact
• [12:30] – Cybersecurity as a competitive differentiator
• [14:02] – Building a culture of security and real-world advantage stories
• [19:16] – Data stewardship compared to quality standards
• [22:51] – Space industry and leadership’s unique challenges
• [25:12] – Space industry’s custom supplier challenge (CMMC adoption gap)
• [29:04] – Closing thoughts: “Why” CMMC matters and advice to the sector

---

Takeaways for Listeners

• Cybersecurity is now an operational imperative for all space industry players—not just IT.
• Proactive security offers competitive and revenue advantages, particularly as CMMC spreads.
• Transforming company culture around data stewardship—anchored by leadership—is essential.
• The challenges are complex, especially for small suppliers and multinational operations, but the market opportunity for secure, resilient organizations has never been greater.
• Wise guidance, persistent leadership, and a mindset shift from mere compliance to holistic excellence are critical to success.

---

"We can do hard things... The entire cornerstone of space is that we solve hard problems that no one else can do. And this is another."
– Reagan Edens [31:51]

---

Transcript

[Maria Varmazes]

You're listening to the cyberwire network. Powered by n2k.

[Podcast Host/Announcer]

Identity is a top attack vector. In our interview with Kavitha Mariapan from Rubrik, she breaks down why 90% of security leaders believe that identity based attacks are their biggest threat. Throughout this conversation we explore why recovery times are getting longer, not shorter, and what resiliency will look like in this AI driven world. If you're struggling to get a handle on identity risk, this is something you should tune into. Check out the full [e-mail] Rubrik. Maybe that's an urgent message from your CEO, or maybe it's a deepfake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more Doppel outpacing what's next in social engineering. Learn [e-mail] that's d o p e l.com.

[Maria Varmazes]

When we were looking through the presentation list during Commercial Space Week, one panel really stood out to us. It was about cybersecurity and the space supply chain. Could we finally be seeing a shift in the industry to a better understanding of cybersecurity and how it touches everything, every department in space? Well, we spoke to two of the panelists at that talk to find out more. Hi and welcome to Commercial Space Week here in Orlando, Florida, Maria Varmazes, host of T Minus. And we're going to be talking about cybersecurity in space today, which is honestly my favorite thing to talk about. So I'm really excited for this conversation. Gentlemen, thank you for joining me today. Why don't we start with introductions first? Frank, why don't you start? Tell us a little bit about yourself.

[Frank Schementi]

Hi, I'm Frank Schementi. I'm the Director of Programs at the Titus Hill facility for Beyond Gravity, basically the site leader.

[Reagan Edens]

And my name is Reagan Edens and I am the founder and CEO, de facto CEO, I suppose, of DTC Global and we provide highly specialized consulting for supply chain security, CUI compliance and cmmc.

[Maria Varmazes]

Wonderful gentlemen, thank you so much for joining me. So you're going to be on a panel here at spacecom talking about your areas of expertise and I imagine there was a lot of conversation before the panel was sort of proposed about the need for what you're discussing. Can you give me a little behind the scenes on what went into the idea behind this panel? Why Is this so important now?

[Frank Schementi]

Yeah, I'll start. So cybersecurity used to be the responsibility of the IT department. So it's back room, everyone was like, okay, as long as they're dealing with it, we don't have to. That is no longer the case. You have. The government has realized that they're a competitive disadvantage because cybersecurity data leaks. We've lost tons of data and our competition, our international competition is taking advantage of that. So they realized, okay, we need to lock this down. Our supply chain is our biggest risk. How do we lock down that data? So they came up with cmmc. I believe that leadership needs to take a responsibility and own that and push that responsibility down to the teams so that everyone is thinking the same way about cybersecurity, how to prevent the data leaks. Because it's not just the CUI or the controlled unclassified information, but it's your ip.

[Maria Varmazes]

Yes. Right.

[Frank Schementi]

Your money, your time that you've invested to come up with new products, new services for your customers. You don't want that taken. But you also have the data of your employees yet, that sensitive data, their personal information, you don't want that leaked out. So I believe that all corporations now have to think about, you know, not just the cui, not just your ip. All three of those are very important to me. It's as important as safety and quality. All three of those are critical for your organization to be successful.

[Maria Varmazes]

Absolutely.

[Reagan Edens]

And the remarkable thing is that we have to do this.

[Maria Varmazes]

Yeah.

[Reagan Edens]

As Frank points out, the estimates are $900 billion a year lost to our adversaries. The entire defense budget, every single year lost through exploitation, sabotage, and the opportunity to really. For adversaries to gain advancements, not only in extracting that technical information, but making it better.

[Maria Varmazes]

Right.

[Reagan Edens]

Developing, developing and shortcutting and compressing their advancements in technology and in decreasing their overall investment and also minimizing their risk because they can build on top of and improve their systems and capabilities. The challenge for us is that how does, how does the defense industrial base, the defense supply chain navigate, really bringing and standardizing their cybersecurity, their data security, when that has not been a priority? And you have this enormous disparity between manufacturing organizations and small ones and big ones and little ones. 98% of the defense industrial base has employees less than 100. Right. So you can't think of it in terms of Lockheed Martin or Raytheon. These companies are. They have enormous resources and fabulous capabilities to defend themselves. So now how do we navigate this from really managing real people and real organizations who have to figure out how do I implement these requirements, how do I determine what is the controlled and classified information that I need to protect versus my own IP or IP that's not controlled. And then how are we a good steward of that trust to ensure that these systems that we're developing are not compromised, that we are delivering them uncompromised? So we have this tension. And the tension is we must secure the data, we must secure the supply chain. And the other side of the tension is just the confusion and difficulty of how do we do this, how do we make it efficient.

[Maria Varmazes]

Yeah.

[Reagan Edens]

And how do we manage those costs to be able to navigate this? Because it is difficult, it is complex and it is not easy.

[Maria Varmazes]

Yeah. Frank, I feel like that you would be a great person to kind of tell me a bit about what is it like, you know, implementing cmmc? I mean, compliance is never easy. It is never easy. I mean, so it's saying, yeah, it's hard, yes, but what has it been like for you all?

[Frank Schementi]

Well, it's never the technology. Right. There's always solutions. Right. We have a really good IT team. We had some complications trying to figure out different solutions because we're an international company. So our it's are connected to, let's say Switzerland. That's where our headquarters is.

[Maria Varmazes]

Yes.

[Frank Schementi]

So we had to find a way to kind of break that link so we could have a secure place to store our data. So that part was a little tricky, but we came up with ways around that. It's now the people making sure they understand that when they bring in new equipment or we create new processes that interface with our manufacturing resource planning tools that it doesn't create new threats. So for example, we had a very simple 3D printer. It was a great idea and the operations loves it. They bring it in, they can make cool little tools and you buy it, you drop it in, you connect it to the network. All of a sudden we can communicate, program things on day one actually goes out to the outside world and gives you new tools to make like little mini software things to improve the programming of it. We started looking at it from a security point of view and realized, oh yeah, we just created a huge hole. And so the operational technology, the equipment on your, you know, your production floor in my head is probably the biggest risk to an organization. Yeah, it's not so much the emails, it's bringing all of this technology, our CNC machines, you could have spectrum analyzers in the past, you could sit at A bench to program these things and work on them. Now you got to, you could do it all remotely because it's all networked. Each one of those pieces of equipment are a threat, a possibility of being attacked. So I think having everyone aware of that, thinking that way, asking those right questions to the IT department so that before you bring in this, this new piece of equipment, they're ready to actually put in the safeguards and to monitor to make sure that it doesn't happen. So I think it becomes more of a people thing, making sure everyone's on board than a technology problem.

[Maria Varmazes]

Yeah, go ahead.

[Reagan Edens]

Yeah. Well, for many years now, I've sort of said that necessity to safeguard CUI and CMMC really is driving digital transformation through compliance.

[Podcast Host/Announcer]

Right.

[Reagan Edens]

And so this idea of, of operationalizing cybersecurity through, through the, the manufacturing process. Right. Is a behavior switch, is a transformation of the organization from sales all the way through to order fulfillment. And so this is that moment where people tell me, well, this is an IT thing. I mean, that's always the very first.

[Maria Varmazes]

Reaction, knee jerk reaction.

[Reagan Edens]

And then when, when Frank and I met and we had our first interaction, I'm like, okay, I've got good news and I've got bad news. The good news is, is the IT thing we can figure out, the bad news is, is that this is the preponderance of the burden is carried by the people who receive that, that technical information, the cui.

[Maria Varmazes]

Yeah.

[Reagan Edens]

And also handle it and also develop it every day in the performance of the work. So that's where you partner with your senior management and you say, okay, how are we going to do this for real? Right. And it's different from a compliance regime. Yes, because the compliance regime usually starts out with, okay, what do I have to do? Meet minimum compliance. And then 15 minutes after the assessment, we're done.

[Maria Varmazes]

Yeah, yeah, yeah.

[Reagan Edens]

And, and so this is a completely different thing because now we're working with clients like Frank and saying, okay, Frank, how do we make this real every single day? How do we navigate the challenges between, okay, we work on this one system doing this and then we work on this system doing that. Right. How do we bring in things like 3D printing and innovation and drive his ability to deliver effectively and faster? But how do we assimilate those things and do them in a way that is compliant and sustainable? Right. So these are the challenges that it really have to really be thought through that our initial reaction is, okay, well, what do I got to do to implement the technical controls, be compliant and then get back to what I do. Well, that's not. This.

[Maria Varmazes]

Yeah.

[Reagan Edens]

This is really a generational shift to standardizing the defense industrial supply chain on a global sense. Right. Because it's not just Florida, it's not Maryland or Dallas Fort Worth. It's really Europe. Right. It's European suppliers. It's folks in the UK and Canada. So the reality is that we get the opportunity to sort of proselytize the gospel, if you will, about how we need to protect. Protect the data.

[Maria Varmazes]

Yes.

[Reagan Edens]

How we need to meet the requirements. And then the really heavy lift is embracing that very, very in the trenches detail about how do you make it work? For real?

[Maria Varmazes]

Yeah, right. Yes. Yeah.

[Reagan Edens]

And then, and then how do you, how do you think about cost and, and, and then doing this from Frank's supply chain down.

[Maria Varmazes]

Yeah, right.

[Reagan Edens]

Because Frank, Frank's, you know, thinking, okay, well, we have to get compliant. And then first thing he said, well, Reagan, what about everybody else?

[Maria Varmazes]

Yeah, yeah, yep, yep.

[Reagan Edens]

So this is the. This is the. It is transformational. Yeah, it is transformational.

[Maria Varmazes]

Now, I want to ask a question that probably sounds silly. Could it potentially be like a competitive differentiator? I know people need to be. But is it? Is it.

[Reagan Edens]

I mean, yeah, absolutely.

[Frank Schementi]

I mean it just very simply, because I give you two examples. We wanted to buy a visitor management system. We had a check, just a checkbox. Somebody come in, they fill out the form of who came in. It's really annoying. So I wanted to go digital.

[Maria Varmazes]

Yeah.

[Frank Schementi]

We found three different places. Very simple software, really, same features. Two of them, the data just went out to the cloud and was no good. One of them didn't. So there was a differentiator with just our supply. Okay, let's get this one. Because it's protected. Same thing the other way around. So if you have a prime contractor that has a CMMC requirement and there's two or three we'll call machine shops. We're sort of a machine shop of what we do in Titusville for beyond gravity. And two of them may not. And if we do so, they're going to want to protect that data. So to me, it already means that they understand that we take the responsibility of taking their information, building that product, working with our suppliers and making sure they don't leak that information and deliver hardware to them. So I think it absolutely is a differentiator with our competition. And when we go out to our supply base and picking who we want to select.

[Maria Varmazes]

Yeah, yeah. I'd love to hear you both. Tell me a bit about. You mentioned Sort of the human equation. And when it comes to compliance and infosecurity, that's always the challenge. And I'm really curious to hear your thoughts on what has worked in sort of building that security culture around cmmc. What has worked and what hasn't and maybe preaching the gospel a little bit on that. Yeah, I'd love to hear your thoughts.

[Reagan Edens]

Well, so do you mind if I tell a story about, about competitive advantage first? Because it is, it is. So I discovered this by accident, right, in 2019. My very first client, large client, was the only company, their site within 500 miles of Airjet Rocketdyne driving distance that was compliant back when Airjet Rocketdyne came up for the Federal False Claims act. And, and they did. I got the call that hey, airjet's coming over for, for, you know, an inspection assessment. I'm like, oh great. Yeah, that's fantastic. Hey, when are we going to schedule this? They're like I said, well, I don't know, they sounded. Well, let me call you back. So they called me, he called me back at like 10 minutes. He's like, they're actually on their way.

[Maria Varmazes]

Oh cool.

[Reagan Edens]

And I'm like, wow, okay, well, yeah, something must be going on. So sure enough, you know, the, the issue came down with, with Aerojet, but the reality was is that that made me realize because my first reaction was, well, did you ask him for more business if you're the only compliant organization? Right. And so that has Transformed into since 2019, almost every single client that we have has seen a top line revenue growth between 10 and 20%. That's enormous for companies. Because what I advocate for is look, we're going to do this, we're going to do it right. And then you turn back, right back to your buyer, your supplier, your contracting officer or your prime contractor program and saying, look, we have secured your data, we will show you how we do it. And we want our competitors business, right? Because you don't have to worry about us. And so in that regard I see it as an extraordinary leap forward. Ironically, even after five years of the CMMC rollout. Now even in phase one, we have the opportunity for organizations to take the, what I call the largest market share opportunity and probably the defense industrial base history because there are going to be companies and Frank does this. Companies that don't do it, they don't want to do it, that are late to doing it. And then now folks like Frank or others are forced to make a choice. Do I choose between compliant supplier A or non compliant Supplier B. Yep.

[Maria Varmazes]

Right.

[Reagan Edens]

And now it's just a matter of, okay, well, we're going to work with, with this organization and then navigate the path forward. And then now I have an investment in them. I have to re qualify them sometimes and go through all of the supply chain dependencies. But at the end of the day, there's a trusted relationship because they've done what they needed to do, which reflects the way that we approach our business and our stewardship of government's data.

[Maria Varmazes]

Right. Data stewardship. I always love that phrase. That's an important one. Yeah, that's right.

[Reagan Edens]

And when you internalize inside of a company, it's that cultural shift.

[Maria Varmazes]

Yes, yes.

[Reagan Edens]

And then so when you bridge that over to your initial question, which is, you know, what are the challenges that you face? One is that you, you have to realize that the message is not, we're doing this for compliance sake. Because I, I was actually.

[Maria Varmazes]

That's the most demotivating thing I can think of.

[Reagan Edens]

Right, Absolutely.

[Maria Varmazes]

Let me get right on that. We'll be right back.

[Podcast Host/Announcer]

The world moves fast. Your workday even faster. Pitching products, drafting reports, analyzing data. Microsoft 365 Copilot is your AI assistant for work built into Word, Excel, PowerPoint and other Microsoft 365 apps you use, helping you quickly write, analyze, create, and summarize so you can cut through clutter and clear a path to your best work. Learn [e-mail] M365 Copilot this episode is.

[Maria Varmazes]

Brought to you by Indeed. Stop waiting around for the perfect candidate. Instead, use Indeed sponsored jobs to find the right people with the right skills fast. It's a simple way to make sure your listing is the first candidate. C. According to Indeed data, sponsored jobs have four times more applicants than non sponsored jobs. So go build your dream team today with Indeed. Get a $75 sponsored job credit@ Indeed.com podcast. Terms and conditions apply.

[Reagan Edens]

Yesterday, I had a fantastic conversation with a VP of Quality, and I said, you know why I love quality people? And she's like, you know, she's like, no. I'm like, it's because, yes, I come from Oberal Compliance. Although I'm not a compliance person, I actually pride myself on that because compliance is the house of no, no, you can't do this. No, you can't do that. No, you can't do this. But Quality recognizes that there's a standard that our customer expects us to meet. We have to meet that standard, and we have to do it in a way that's efficient and that's profitable. But if we don't meet the customer's expectations in that standard, we don't have a customer anymore.

[Maria Varmazes]

That's right.

[Reagan Edens]

Right, Yep. So that is an awesome opportunity for people to realize that data stewardship is the equivalent to quality. If we don't meet that stewardship goal and we don't meet our quality standard, we do not have a customer anymore and you don't have a job. And it impacts real people and in their lives and their opportunities. And if we do this and do this well, just like quality, now we have the opportunity to actually do more for our clients and more for our customers. So for me, when the very first. The very first failure, usually organizationally out of the gate, is, okay, we're being forced to do this. This is a compliance thing. Everybody buckled down, we're just going to do this and then get it done. That's right. We're just going to muscle our way through it. And that attitude doesn't really capture the tremendous market opportunity that you pointed out. And so if you combine those two things, what I always say when I first talk to people in organizations is we have to have a relationship. And the relationship is that you allow me, you give me permission to tell you the things that you don't want to hear, to tell you the hard things that you have to do. And then you have to trust me that we absolutely can do this. I promise you. And then when we do it and we do it well, there's a glorious outcome. Right?

[Maria Varmazes]

Yeah.

[Frank Schementi]

I think with leadership, when they realize that the data security is critical for the success of their organization, until that point, they won't take it as seriously. It's a compliance thing. And I'll be honest, at the very beginning, I'm like, oh, okay, we're going to have to.

[Maria Varmazes]

I mean, it's an understandable.

[Frank Schementi]

It's just like, oh, my gosh, there's so much more work now I got to do.

[Maria Varmazes]

Yeah.

[Frank Schementi]

But when you. All of a sudden, there was a few things that happened. One was this 3D printer. We have other big equipment that is just as connected. But I was like, oh, wow, you know, makes you think the visitor management system. But another one was, it was so simple. Is one of the questions is, okay, who has access to the different drives in your network? All of a sudden we started looking and there was people from four years ago. I'm like, oh, my, no, they couldn't get in. But the fact is, there was people that had access to these networks that no longer belong in the company. Or they changed fields so they no longer need just engineering, they needed sales.

[Maria Varmazes]

It's a remarkably common thing too.

[Reagan Edens]

Yeah.

[Frank Schementi]

And you start to realize like, oh wow, we're messy. This is not, you know, this is not good. And you know, as 9100 is a similar thing where it forces you to think about why is operations and quality so important. It creates these standards so it becomes part of everyday life. And the CMMC I think is going to, is going well. It is for us and it will hopefully for other people when they start doing it, do the same for them where they create this. It's just part of your everyday life.

[Maria Varmazes]

Yeah.

[Frank Schementi]

It has to be across the board all the different functions. Right. Sales people and culture. And I always like we call people culture is really human resources. And why it's so important for human resources to also be included again goes back to that your employee data. And we have to, we have to respect that data as much as we respect the CUI or ip. And so I think that once you under, once leadership understands that and creates that culture of cyber security throughout the company.

[Maria Varmazes]

Yes.

[Frank Schementi]

It's just as important I said before as safety. You don't want your employees, so the buck stops. Leadership, you got to make sure everyone is safe, that you're being successful. The quality. And now I think cybersecurity is among, is one of those three pillars.

[Reagan Edens]

You know, the key to what Frank just said is leadership.

[Maria Varmazes]

Yes, right. Yes.

[Reagan Edens]

Leadership is not getting the next sale. Right. Leadership. You know why I love space? I love space because they have 22nd century vision to operationalize and solve hard problems in the 21st century. Right now, how do I make it? How do we get to these amazing goals? To these amazingly difficult and sometimes austere and hostile environments? Right. And am I really going to do that using 20th century industrialization and 20th century security? And the reality is when you align that 22nd century vision with solving hard problems right now, to make this, to meet the goal, meet the expectation, deliver to the customer on time and to solve these very difficult problem that we need to do what we need to do right now and align that with that understanding that this is the stewardship of the data is our future. Because we cannot have our peers out distance us and we can't out compete us and we can't give alternatives because we have these goals, these incredible goals that we need to do and we need to do them right now. And if we don't do them, somebody else will.

[Maria Varmazes]

Yes, that's right. You mentioned something that you were Bringing it back to space specifically. Which I also wanted. Thank you for doing that. Because I was thinking a question that I had three years ago when I started doing this job, coming from pure cybersecurity and now thinking about space and cyber was basically yet another cultural question of. I was noticing a lot of friction within the space world about Infosac stuff. The stuff that I consider sort of table stakes. And my reaction was, what's up with this? For lack of better terminology. Why? I mean, I understand nobody really likes hearing a lot of this stuff. I understand that. But I just, I had felt so much friction and I said I would not have expected that from such a forward thinking sector. So that's just my read on it. I'm curious what you all think and I'm curious if you have any thoughts on why that might be or if it's changing or am I off base.

[Frank Schementi]

I would think one of the hardest things for space and CMMC is our supply base. Everything we do is custom.

[Maria Varmazes]

Yeah, right.

[Frank Schementi]

I would think that as, as what we do, we build the structures, the panels for the satellite is. We almost, okay, it's aluminum, aluminum facial, aluminum core. But there are parts that we have to get them custom made and the suppliers that we buy from space for them is a small portion of their entire business. So they don't, they're not interested. They may not be and they may not do any military work. So they're not interested in cmc. So now all of a sudden you got to work, okay, how do I make, how do I design something that is a COTS type part that's not custom? And maybe you have to vertically integrate and bring it into your house. And that's what we're doing in some of our parts. We can't buy a custom part because they're not going to become CMMC certified. So it's like, all right, we have to design our parts different so that we can make something that's cots, bring it in and then modify it for what we need and then that's how we can protect the CUI data part of it. So I think that to me is one of the challenges. It's hard, sorry.

[Reagan Edens]

Yeah, I would think that. So, you know, Frank, as an engineer has really helped me see things differently. Right. So you learn from your clients and one of those was his innovations in. Okay, if we in house this portion of our manufacturing process, right, and we do the design a little bit differently, then now we obviously can protect the data. That's the goal. But what we've done is alleviated a high pressure burden on a supplier that's not ready yet. Right. And in the end there will be this massive migration. It will be the people who choose space and defense and dual use technologies because that is a portion of their business that they want to grow. It's a, it. They can increase their margins. It's not a commodity thing. Right. They, and they can, they will recognize that there is opportunity in this space. Just like my very first client in 2019, they decided to go from commodity sort of surface coating parts to highly specialized. Why? Because yes, the risk is larger, but there's also a much larger margin in these custom and unique parts and underneath these, these really difficult specifications. But here's the, here's the interesting part is that this tension in navigating this is really about vision. It's about the American supply. American manufacturing has got to decide that America still has to cut and bend metal and that is our path to success. And if we don't do that, then who is going to do that? It is in fact not the people who sell us things very cheaply at the dollar store because those are our adversaries. They do not want America to succeed because their, their codependency on us is coming to an end. Right. So the reality is, is that we will pour steel, we will cut and bend metal and we will make things or we are in a very deep trouble and that has got to return to America. And so what I see is that again there's this tension between practical reality.

[Maria Varmazes]

Yes, always.

[Reagan Edens]

It's only a portion of my supply, you know, beyond gravity. We do, you know, 1 to 2 million a year. And you know, that's not enough for us to make this switch because we do 30 million in oil and gas. Right. And so, you know, these choices are real choices that companies have to make. But that goes back to opportunity. If there, if, if we have a, if we have an ecosystem filled with CNC companies that decide opt out. Well, I'm not going to do this then that creates opportunity for compression consolidation into companies that say, you know what, I'm going to, I'm going to fill that space.

[Maria Varmazes]

Yep, absolutely. Thank you. I want to give you both a chance to give any wrap up thoughts for our audience. So Frank, you want to go first?

[Frank Schementi]

Yeah. I would say when you think of cmmc, consider the why. Why it's important. And of course it's the cui, the data for our government to make sure that they're successful. It is our IP as a business you want to make sure what you've invested and the money that you spent over the years is protected. And of course, your employees, it's incredibly important that their data is protected. It's a huge advantage for your organization. It's a huge risk if you don't do it.

[Reagan Edens]

For me, it really boils down to training, education of the ecosystem, which is cmmc. The hard truths, right? The hard truths are it is complex, it is transformational. It is a business decision that you need to make deliberately in understanding those risks and the necessity to transform largely the operational and business side, the manufacturing side of the house, which is, you know, prone to resist. Right? And I call that the seven stages of grief, you know, and there's a necessity to walk through that seven stages of grief. In the end, what you have to do is you have to be confident. Everyone goes through it. And I tell them, I've started telling them this up front. And the reality is, though, that you need to go into this with eyes wide open. There have been 58 different revisions of key and critical documents and 3,683 pages.

[Maria Varmazes]

Light reading of updates.

[Reagan Edens]

Right? This is not easy. It is not complex. And choosing who you seek wise counsel from and who you get advice and guidance from can. Can incorporate into success or investments that are made that will not take you to where you need to be. So choose that and choose very, very wisely. Because with opportunity comes every Joe and Jane that wants to throw their hat in the ring and say, hi, I'm an expert at this. And then the reality is that you can spend a lot of time and a lot of effort and not achieve the outcome. So be wise, be deliberate. Understand that the risk that this is expensive, it is hard. But the entire cornerstone of space is that we solve hard problems that no one else can do. And this is another thing that must be done to incorporate business opportunity. And you can do this. And you just need great guidance, accurate and consistent with the requirements. And you need that tenacity and that leadership that takes you there just like every other hard problem. Right?

[Maria Varmazes]

Amen to that.

[Reagan Edens]

And we can do this.

[Maria Varmazes]

We can do hard things. I love it.

[Reagan Edens]

We love it.

[Maria Varmazes]

I love it. Reagan, Frank, thank you so, so much. Really enjoyed this chat. Two amazing perspectives on this. So really, I thank you. This was really great.

[Reagan Edens]

Thank you so much.

[Frank Schementi]

Thank you.

[Reagan Edens]

No, thank you for having us.

[Maria Varmazes]

Yes. Foreign. That is T minus deep space. Brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing space industry. If you like our show, please share a rating and review in your podcast app or you can send an email to [e-mail] we are proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K helps space and cybersecurity professionals grow, learn and stay informed. As the nexus for discovery and connection, we bring you the people, the technology and the ideas shaping the future of secure innovation. Learn [e-mail] N2K's senior producer is Alice Carouse. Our producer is Liz Stokes. We are mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ivan. Peter Kilpe is our publisher and I am your host, Maria Varmazes. Thank you for listening. We'll see you next time. SA.

[Frank Schementi]

Foreign.

[Podcast Host/Announcer]

If you only attend one cybersecurity conference this year, make it RSAC 2026. It's happening March 23rd through the 26th in San Francisco, bringing together the global security community for four four days of expert insights, hands on learning and real innovation. I'll say this plainly, I never miss this conference. The ideas and conversations stay with me all year. Join thousands of practitioners and leaders tackling today's toughest challenges and shaping what comes next. Register [e-mail] cyberwire26 I'll see you in San Francisco.

[Reagan Edens]

Well, the holidays have come and gone once again, but if you've forgotten to get that special someone in your life a gift, well, Mint Mobile is extending their holiday offer of half off unlimited wireless.

[Maria Varmazes]

So here's the idea.

[Reagan Edens]

You get it now, you call it an early present for next year. What do you have to lose? Give it a [e-mail] Switch limited time.

[Maria Varmazes]

50% off regular price for new customers. Upfront payment required $45 for 3 months, $90 for 6 month or $180 for 12 month plan. 10 taxes and fees extra speeds may slow after 50 gigabytes per month when network is busy, see terms.