Barry
Morgan

Pioneering and operationalizing a custom method to lead CMMC 2.0 readiness assessments and NIST SP 800-171 compliance validations of Defense Industrial Base (DIB) contractors. We verify control implementation and test DFARS 252.204-7012 systems boundaries.

• Accelerated SSP Development: Used localized RAG models and iterative prompting to compile System Security Plans (SSPs) from client evidence repositories, shortening drafting time from weeks to hours.
• Enhanced Audit Readiness & Gap Analysis: Drafted assessor-ready SSPs with precise in-line citations mapping control implementations to source documentation. Guided analysis to perform rapid gap analysis and generate preliminary POA&Ms.
• Deep-Dive Control Verification: Conducted targeted analysis on complex controls including FIPS 140-2 validation and log retention, ensuring a detailed and defensible compliance posture for DIB contractors.
• Thorough Assessment & Reporting: Synthesized diverse technical evidence to identify critical compliance gaps. Authored executive summaries and detailed assessment reports across 19 separate contractor audits.
• Methodology Evangelism: Developed and delivered executive-level presentations on the AI-Augmented Assessment methodology to internal stakeholders and clients.
• Joint Surveillance Program (JSP) Assessor: Evaluated C3PAO assessment activities to ensure consistency and adherence to DoD standards. (2 JSP assessments)
• DIB Assessment Leadership: Coordinated pre-assessment activities, briefings, and documentation across enterprise-level engagements. (3 leadership assessments)
• Physical & Environmental Controls: Evaluated contractor implementation and reporting of physical and environmental controls. (3 assessments)

Building a multi-vertical portfolio of digital ventures spanning the Bears brand ecosystem, fractional CISO leadership, AI tooling, EV technology, and specialty automotive. Managing 35+ domain assets across strategic niches.

• Portfolio Architecture: Designed and deployed a 37-domain portfolio spanning cybersecurity consulting, luxury goods sourcing, EV technology, specialty automotive maintenance, property inspection, and creative services. Each site operates as an independent authority hub with its own lead capture, content strategy, and monetization pathway.
• Fractional CISO Operations: Delivering embedded Chief Information Security Officer services to Pacific Northwest defense contractors. Building compliance programs from initial gap analysis through full CMMC 2.0 certification readiness, including SSP authoring, POA&M tracking, and evidence repository management.
• AI Workflow Automation: Developing air-gapped retrieval-augmented generation (RAG) systems for sensitive environments. Building a process that works the same way every time so defense contractors can adopt frontier AI capabilities without exposing controlled unclassified information (CUI) to external cloud services.

20+ years of hands-on enterprise technology experience: maintaining, repairing, securing, and transforming infrastructure across industries, from commercial fitness equipment to mission-critical enterprise systems.

• Infrastructure Transformation: Led multi-site network overhauls including server migrations, firewall rule consolidation, and endpoint protection rollouts. Managed transitions from legacy on-premises infrastructure to hybrid cloud environments while maintaining uptime requirements for 24/7 operations.
• Security Program Development: Built information security programs from the ground up for organizations with no prior formal security posture. Implemented access controls, incident response procedures, vulnerability scanning schedules, and employee security awareness training across organizations ranging from 50 to 500 employees.

Served in the weapons department of U.S. Navy ballistic missile submarines USS Casimir Pulaski (SSBN 633) and USS Ohio (SSBN 726), maintaining Trident C-4 missile and weapons systems. Developed the discipline and systems thinking required for absolute reliability under pressure.