inDirectIT Names Former CMMC Lead Assessor to Direct Compliance Services

On November 12, 2026, inDirectIT Inc. announced the appointment of Alexy Johnson as Director of Compliance Services. Johnson is a retired U.S. Air Force veteran and former Cybersecurity Maturity Model Certification (CMMC) Level 2 lead assessor with more than 20 years of experience securing information systems and evaluating compliance with federal cybersecurity standards. The appointment places experienced compliance leadership inside a cybersecurity firm serving defense contractors as they address requirements for protecting sensitive government information and demonstrating the effectiveness of their security practices.

Johnson will lead inDirectIT’s internal CMMC program, oversee compliance for the company’s managed services clients, and help direct its CMMC advisory practice. His work is expected to draw on experience both implementing security measures and assessing whether organizations satisfy federal standards. For contractors, this background is relevant to the practical challenge of not only documenting controls, but also showing that they are implemented and operate as intended across systems that handle controlled unclassified information (CUI).

The appointment comes amid changes to the CMMC program, which establishes cybersecurity assessment requirements for companies in the defense supply chain. The source states that the U.S. Department of Defense suspended the program’s planned second phase in July, but that applicable self-assessment requirements and existing obligations to protect CUI remain in effect. Contractors should therefore avoid treating the pause as a blanket end to cybersecurity responsibilities. They need to identify which requirements apply to their organization and contracts, maintain relevant protections, and monitor official guidance for changes to implementation timelines or assessment expectations.

Johnson’s cited experience includes NIST SP 800-171, which defines safeguards for sensitive government information held by contractors, and NIST SP 800-53, a broader catalog of security controls. He also has expertise in the Federal Risk and Authorization Management Program (FedRAMP), which sets security requirements for cloud services used by federal agencies. These frameworks can matter across contractor environments, particularly where defense supply-chain work involves controlled information, managed services, or cloud platforms. CEO RJ Williams said customers are “navigating changing requirements while protecting sensitive information that supports critical federal missions,” and described Johnson’s perspective as connecting obligations to day-to-day security work. Johnson similarly emphasized that compliance must reflect how systems actually operate and that organizations should be able to demonstrate controls are working, not merely document that they exist.

• inDirectIT appointed Alexy Johnson as Director of Compliance Services on November 12, 2026.
• Johnson is a retired U.S. Air Force veteran and former CMMC Level 2 lead assessor with more than 20 years of cybersecurity experience.
• His responsibilities include leading inDirectIT’s internal CMMC program, overseeing compliance for managed services clients, and helping lead its CMMC advisory practice.
• The Pentagon suspended CMMC’s planned second phase in July, according to the source; applicable self-assessments and existing CUI protection obligations remain in effect.
• Contractors should determine which CMMC and cybersecurity requirements apply to their specific organizations and contract work rather than assume the phase suspension removes existing duties.
• Johnson’s experience includes NIST SP 800-171 safeguards for sensitive government information and the broader security-control catalog in NIST SP 800-53.
• His expertise also includes FedRAMP, relevant to security requirements for cloud services used by federal agencies.
• A practical readiness priority is validating that controls work in operating environments and can be demonstrated, in addition to maintaining documentation.
• The appointment signals continued commercial demand for CMMC readiness, managed compliance, and NIST-aligned cybersecurity support among defense contractors.
• inDirectIT media contact: media@indirectit.com.