Bate Shaddy

Diligent Security Control Assessor with over 5 years of experience in risk management and information security. Proficient in evaluating, quantifying, and enhancing control effectiveness using frameworks such as RMF. Skilled at collaborating with cross-functional teams to identify risks, drive compliance, and communicate insights to senior stakeholders.

Sr. Cybersecurity SME at C-Consulting LLC (2022-01 – Present)

• Supported Cybersecurity Assessment and Authorization process for Amphibious Warfare Systems platforms, ensuring comprehensive risk identification, assessment, and adherence to RMF guidelines.
• Managed and tracked RMF and ATO packages for PMS 377/317 systems across NAVSEA and NAVAIR, providing continuous monitoring and status updates.
• Reported ATO status for SIPR and NIPR systems, delivering clear insights to program management for informed decision-making.
• Reviewed and defined policies to enhance governance by identifying and mitigating risks, thereby maintaining data protection and regulatory compliance.
• Documented and communicated security findings with detailed risk analysis, ensuring effective control evaluation and continuous risk reduction.
• Conduct CMMC Level 2 certification assessment activities as a member of the assessment team under the direction of the Lead Assessor.
• Examine documentation and artifacts, interview personnel, and test security controls across the 110 NIST SP 800-171 Rev 2 requirements using NIST SP 800-171A methods.
• Document findings and recommend MET / NOT MET / NOT APPLICABLE determinations for assigned requirements, with supporting evidence.
• Support development of the assessment plan, scope validation, and pre‑assessment readiness reviews.
• Contribute to the assessment report and support POA&M closeout activities within the required timeframe.
• Maintain assessment evidence and working papers in accordance with C3PAO procedures and ISO/IEC 17020:2012.
• Adhere to the Cyber AB Code of Professional Conduct, conflict‑of‑interest, ethics, and impartiality requirements.
• Support clients during C3PAO Level 2 assessments: answer assessor questions, locate evidence, provide clarifications, and coordinate responses to findings.
• Conduct comprehensive gap assessments against all 320 objectives across 110 controls of NIST SP 800-171 Rev 2. Score each objective as Met, Not Met, or Partially Met.
• Proficient with new CMMC 2.0 requirements and knowledgeable about the Department of Defense's recently released final rule for the Cybersecurity Maturity Model Certification (CMMC) Program.
• Experience working with the Defense Industrial Base (DIB) and handling Controlled Unclassified Information (CUI).
• Prior experience developing Plans of Action and Milestones (POA&M) for cybersecurity compliance.
• Familiarity with the latest DFARS Clause 252.204-7021 requirements and the implications of the August 2024 CMMC 2.0 updates.
• Monitored cyber risks and vulnerabilities, overseeing the closure of POA&Ms while tracking progress to meet security standards.
• Supported RMF activities by reviewing cybersecurity requirements for LHA IPT systems, maintaining traceability of vulnerabilities and remedial actions in eMASS.
• Assessed system risks and conducted security control evaluations in line with NIST 800-53A standards, reinforcing robust risk mitigation strategies.

Sr. Security Controls Assessor at 22nd Century Technology (2020-01 – 2022-01)

• Supported the Rural Development Cybersecurity Compliance Program by executing IT Security Authorization, Continuous Monitoring, and FedRAMP Certification tasks with a focus on risk identification and mitigation.
• Performed risk assessments on planned and installed systems using the RMF, ensuring precise evaluation of vulnerabilities and alignment with NIST, USDA, and industry standards.
• Led the development and documentation of USDA Key Controls assessments, providing subject matter expertise to strengthen governance and regulatory compliance.
• Managed continuous monitoring processes, updating ATO package artifacts and POA&Ms to ensure effective control evaluation and risk reporting.
• Facilitated assessment kick-off meetings and developed detailed SAP per SP 800-53A, reinforcing control evaluation and technical risk management for new RD Information Systems.
• Prepared comprehensive Security Assessment Reports and maintained incident response plans, ensuring robust control governance and proactive risk mitigation.

Sr. Security Controls Assessor / Compliance Analyst at 22nd Century Technology - DOL (2019-08 – 2019-12)

• Prepare Authorization and Accreditation (A&A) package documents to enable the Authorizing officer to make risk-based decision to Authorization to Operate (ATO).
• Perform system security evaluations, audits related to the assessment and authorization process.
• Manage POAMs and provide oversight of system vulnerability assessment and monitor remediation efforts of findings and communicate progress to stakeholders.
• Provide advice on proposed change requests and work closely with auditors to identify key controls to be assessed.
• Support independent security control Assessments for all assigned systems. Run scans on systems and analyze vulnerabilities.
• Analyze vulnerability reports and produce summary guidance for System Owners and administrators.

Cybersecurity Analyst at Aurotech Consulting (2013-02 – 2019-08)

• Develop a security assessment plan (SAP) in preparation to security controls Assessment/Testing.
• Assessed information systems to make sure the controls are implemented correctly and performing their assigned functions using NIST 800-53 and Federal Information Processing Standards (FIPS199).
• Evaluate, analyze, and operate industry standard vulnerability assessment tools.
• Participating in incident response sharing efforts and contribute to education and awareness within the organization.
• Work with ISSO's to create and manage POA&Ms for identified system vulnerabilities and track findings to ensure that they are remediated and closed.
• Assessing Technical, Operational and Management controls following RMF NIST 800-37 rev 1 methodology and other NIST 800 publications. Maintain a working knowledge of local security policies and execute general controls as assigned.
• Experience reviewing/updating security artifacts including, but not limited to, SSP, SAR, POA&M, screenshots, Scan data. Conduct periodic and continuous reviews of the system to ensure compliance with the authorization package.

MSc in Information Technology & Information Assurance (IT/IA) – University of Maryland Global Campus (2020)

MS in Environmental Biology and Biogeochemistry (EBB) – University of Eastern Finland (2012)

BSc in Environmental Sciences – University of Buea (2004)