Dy Edington was working an IT help desk when her boss asked where she saw herself in five years. She said she wanted to be a subject matter expert in GRC. He printed the company POA&M to show her what she was signing up for, and she called it the most beautiful thing she had ever seen. Within a few years she was Director of Information Security at BlueHalo, carrying a CMMC Level 2 assessment through 21 acquisitions, more than half of which closed between the gap assessment and the final assessment.
In Episode 22 of the IntelliGRC Podcast, Steven Molter sits down with Dy, founder of EAG Defense, to trace the path from classical homeschooling in New Mexico to the C-suite, and why she walked away from a 4,000 person company to work with the smallest contractors in the DIB.
Regulatory compliance started in a homeschool
Dy’s first exposure to regulatory compliance had nothing to do with cybersecurity. Raising five children and supporting cottage schools in New Mexico meant cross mapping federal, state, and local education requirements, and she says it makes the DIB look tame. She describes the pattern she sees in every regulated industry: the government sets a baseline, and within a few generations everyone treats it as the gold standard and forgets it was the minimum. It is one reason she loves CMMC. The framework still leaves room to discuss how a control meets its intent rather than one prescribed way to check the box.
Why a POA&M is beautiful
Dy and Steven make the case that an ugly POA&M is one that does not exist. With a POA&M you know where the sharks are, which ones are minnows, and what bites it will take to clear each one. That is what lets you walk into a budget conversation and explain why the business needs a shark cage. Steven brings back Carter Schoenberg’s advice from an early episode: tie every risk you communicate to dollars, not controls. Dy adds the question that lifted her CISM scores, “What would Matt do?”, modeled on the CIO who taught her how to get to yes.
Building a CMMC program through 21 acquisitions
When BlueHalo stood up its software review process, eight acquisitions had already brought tens of thousands of applications into the environment. Cutting everything off was not an option. Dy explains the approach: temporarily grandfather what was in use on the day of the report, stand up a process for new requests, pull deployed software lists, and talk to the people actually using each tool. She also describes the supplier support stack she built after the C3PAO was done, and why she turned away every vendor who wanted a contract in exchange for being recommended to BlueHalo’s subcontractors.
[Internal link: IntelliGRC MSP consulting or services page]
The authority of a Yorkie
Dy served as interim Director of Information Security for a year without realizing she was already doing the job. She describes the role as getting paid to argue with people who do not report to you, with the authority of a Yorkie: a lot of noise, no real teeth, and total reliance on the CIO, facilities, and physical security leaders to open doors. Steven and Dy dig into what made BlueHalo’s servant leadership culture work, and why the organizations that let someone own a problem without ego are the ones that fix it.
Why she left for the smallest companies in the DIB
Dy started at ATA with about 600 employees. BlueHalo was near 2,400 at its Level 2 assessment, and the AeroVironment acquisition brought the total to roughly 4,000 at a publicly traded company. She stayed a year to help unify policies, then left to find out who needed her. Her first two clients were former BlueHalo colleagues whose new employers were told they needed CMMC help. In New Mexico, 99 percent of businesses are small, and Dy describes the defense startups by the airport that have funding and a good idea but no strategic path to stay viable.
[Internal link: Ep. 21 with Levi Kapilevich on the CMMC pause]
What fractional CISO work looks like
EAG Defense does two things: fractional CISO engagements for companies that need someone embedded with the C-suite as they plan, and readiness work covering gap assessment, governance development, implementation support, and department training for HR, marketing, facilities, and physical security. Dy’s one non-negotiable is direct access to the CEO, because a summary of a synopsis of her recommendations is how good advice dies. Her closing advice for anyone mid effort during the CMMC pause: find out whether anyone in your company knows what your policies say, and whether those policies match how work actually gets done. Do not apologize for where you are today. Today we start.
Connect with Dy Edington on LinkedIn or at eagdefense.us.