As featured on MassMEP’s Manufacturing Podcast — Episode 109

If you’ve ever wondered how cybersecurity, government contracts, and strawberry ice cream intersect—you’re in luck. Our own John and Pete were recently welcomed back by Hayley and Kevin at MassMEP to talk all things CMMC, cybersecurity, smishing scams, and how to build a better risk posture for 2025 (with a few laughs along the way).

You can listen to the full episode here:🎧 Ep. 109 – New Episode, Same Certification Process

🍦 Cyber Ice Cream Flavors of the Day

The crew kicked off the episode with a fun question— What ice cream flavor sums up your day?

Here's how the team answered:

  • Pete— Coffee Coffee BuzzBuzzBuzz ☕, acknowledging his well-caffeinated state.
  • John— Strawberry 🍓 because it was simply all he could think about (and yes, he went to get some right after the call)...
  • Kevin— Rocky Road, it was looking like a tough day.
  • Hayley— Tutti Frutti—because you just never know what you're going to get.

📱 Smishing, Phishing, and "USPS" Texts That Steal Your Life

A big topic in the first half of the episode: Smishing, or phishing attacks via text message.

John shared a real story from the holidays, where a friend-of-a-friend fell for a fake USPS text. Her phone number was hijacked, her MFA codes were intercepted, and 15+ accounts were compromised.

“You really do have to stay vigilant. These phishing emails look more real than ever—always double check where it’s coming from.” –Pete

The takeaway? Slow down. Be skeptical. And no, the Post Office didn’t magically get your cell number.

🔐 CMMC in 2025: What’s New?

The second half of the episode dove into CMMC (Cybersecurity Maturity Model Certification) and what’s changing:

  • CMMC is back to three levels instead of five.
  • Level 1 covers Federal Contract Info (self-assessed).
  • Level 2 covers Controlled Unclassified Info (CUI) and requires a third-party audit.
  • Level 3 is the highest tier—reserved for prime contractors and R&D—audited by the DoD directly.

And while your MSP doesn’t need to be certified under CMMC, John made the case for why they should:

“You can buy 150 different security tools, but only a few meet the right compliance requirements. It’s hard for manufacturers to know who to trust if the MSPs aren’t fluent in this.”

🛠️ Compliance ≠ Plug-and-Play

One of the biggest myths in cybersecurity? That you can just buy a tool and be compliant.

“You can’t just plug something in because the white paper says it’s good. .. You need a trusted partnership—someone who doesn’t just throw a menu of tools at you, but guides you through what actually meets compliance.”

Pete added a solid tip: When in doubt, look for FedRAMP-certified tools. The FedRAMP Marketplace is a great place to start when evaluating providers or platforms.

As threats grow more complex—especially with the rise of AI—the mindset around cybersecurity must shift too. For businesses, this means budgeting for cybersecurity like any other strategic priority—measuring ROI not just in tools, but in resilience and readiness.

“There’s no ‘fence in a box.’ You’re never done. It’s about ongoing investment and growing smarter each year.” – John

💸 How Synagex + MassMEP Can Help

CMMC compliance isn’t easy, and manufacturers shouldn’t go it alone.

That’s why Synagex and MassMEP partner to deliver value-packed gap assessments—not just to check a box, but to clarify the path forward, cost it out, and help you get started. And in Massachusetts, state funds and assistance programs make this more attainable than ever.

“We’ve done this work in other states, and we can confidently say Massachusetts is one of the best. When you combine our cybersecurity focus with MassMEP’s deep manufacturing network, it’s powerful stuff.” –John

🧠 Final Thoughts: Be Paranoid. Ask Questions.

The group closed with a reminder: You don’t need a ton of sensitive data to be a target. Even basic information—names, birthdays, email access—can be leveraged by attackers.

“Any business collecting data, in any industry, needs to take security seriously. You might think you’re small or simple, but you’re still a risk if the wrong person gets in.”–Hayley

Ready to understand your risk—and do something about it?

Let’s talk. Synagex and MassMEP are here to help guide you through the chaos and toward calm, compliant, modern IT.

🔗 Listen to the full episode
📩 Reach out to Synagex
CMMC is Here—Are You Ready? Synagex Joins MassMEP for Another Readiness Webinar