Treat Cybersecurity Like a Trade

Derrich Phillips joined the Army two weeks after he graduated from high school in 2002. September 11 was less than nine months behind him.

“That definitely had a profound effect on me,” he says. He remembers first responders and others “running towards the danger and really putting their lives on the line to help others,” and he wanted to join the fight.

He had a head start with computers. He had done a Cisco boot camp in high school, and the job he chose in the Army set him on a path toward a field that didn’t have its name yet.

“Cybersecurity wasn’t called cybersecurity back then,” he says.

He served four years, deployed to Iraq, and left the Army in 2006. Two principles from his service still shape how he works. The first is integrity, which he describes as doing what’s right when no one is looking. The second is leading from the front. In the military, he says, a leader is responsible for the people underneath them, including their personal lives, and he contrasts that with the civilian world.

“That’s something you don’t really have in corporate America, where when it comes to training and development and mentorship, a lot of times people are just on their own,” he says.

After the Army he worked at defense contractors, including Lockheed Martin, and at Hewlett-Packard Enterprise, where he was an information security officer. He later moved to Bank of America, where he worked as a third-party risk assessor. Many of the small businesses he encountered there could not pass an enterprise-level risk assessment. He read that as a sign of a large unmet need. Small companies had compliance, contractual, and regulatory requirements to meet and little help in meeting them.

He and his wife started Aspire Cyber in 2021. The first year centered on virtual chief information security officer services, a fractional cybersecurity expert for small businesses. Around then he learned about the Cybersecurity Maturity Model Certification, known as CMMC, and was surprised that the Department of War did not already have third-party risk assessments of its contractors. In financial services, vendor management programs were robust and mature. Now the department was going to require defense contractors to undergo the same kind of review. Knowing it would be disruptive, he wanted to help companies meet the requirements.

He earned both the CMMC Certified Professional and Certified Assessor credentials, then became a CMMC Credentialed Instructor (CCI). For the last three years he has been all in on CMMC. Aspire Cyber has helped about 35 companies reach Level 2 certification and holds Level 2 certification itself.

Aspire is also one of 52 approved training providers. Anyone who wants to sit for the exam, whether as a certified professional (the consultants) or a certified assessor (the people who serve on assessment teams), has to complete training with one of them first. More than 100 trainees have come through Aspire’s program.

Most of the company’s clients are defense contractors. He chose deliberately to focus on research universities, and several large ones are clients. Manufacturers came as a byproduct. Beyond CMMC, Aspire works with any organization that has regulatory or contractual cybersecurity requirements, including SOC 2 and ISO 27001. He expects AI governance to join that list once frameworks around it take shape.

“It’s going to be interesting to see what happens with AI and governance around that,” he says. “But once that happens, we’ll be involved in that as well.”

Phillips also founded the CMMC Professionals Network (CPN), a nonprofit built around hands-on training for consultants and assessors. “It’s a fun part,” he says. “Getting your hands dirty.” Public training is free, and advanced hands-on training comes with a $99 annual membership.

The most recent course ran twelve weeks. The group met weekly and finished with a mock assessment. A cloud service provider gave them a training tenant to configure, and they also had access to Aspire’s governance, risk, and compliance tool. “They definitely got their money’s worth out of that training,” he says.

The CMMC rule took effect in November 2025 and set a four-phase rollout over three years. Phase one, which relies on self-assessments, is underway. Phase two would have required third-party certification assessments for companies whose contracts call for them, and it was set to begin this November. In July, the Department of War’s chief information officer suspended it and launched a reform task force to find a way to start certification assessments with the least disruption and better control over cost. The department also published a request for information so the public could submit recommendations. Aspire and the rest of the industry are waiting on the results.

Phillips sees a cost in the pause. “That looming deadline was causing those defense contractors to take it serious and start to implement the requirements,” he says. “Suspending it now just kills that momentum.” The contractors who were sitting on the sidelines, convinced it would never happen or that they could wait until it showed up in their own contract, now have a reason to keep waiting. “It just reinforces that type of behavior,” he says.

His next goal is taking certification training into high schools, community colleges, and universities. CMMC has created a new industry inside cybersecurity, he says, under governance, risk, and compliance, and it is a career path that “a lot of people don’t know about.” He is in talks with several school districts and colleges. If all goes as planned, a first pilot with Dallas ISD will start this fall.

The model has high schools hosting cybersecurity clinics. Students who pass the certification training could work as interns under Aspire’s supervision on real client work, and the program would connect to a Department of Labor-approved cybersecurity apprenticeship. Dallas and other districts already run career institutes that train plumbers and electricians.

“Our vision is to treat cybersecurity like a trade,” he says.

It mirrors his own training in the Army. He learned the job in a classroom, but the bulk of it was on-the-job training, and he wants to replicate that model in schools. Students would also see how Aspire uses AI in its daily operations and learn to automate and optimize processes with it, so that AI works as a force multiplier in their roles.

Phillips has stayed close to veteran entrepreneurs mostly through the training side of the business and the nonprofit, where he meets veterans interested in cybersecurity training and others who are leaving the military. Much of that is mentorship. Early on, while starting Aspire, he worked with a veteran business group in Dallas. Now he wants more connections with business owners, to find work they can pursue together. He sees small business owners who are “really talented” but lack “the business knowledge or the marketing,” and who are trying to go at it alone.

Asked for one thing people should know about him, Phillips points to adaptability. Growing up in poverty required it of him, he says, along with the ability to endure “a lot of just trauma.” The military reinforced it, and so did a deployment to Iraq.

“At the core, there’s really been just one thing that has led to my success, and that’s being able to be resilient and adapt to whatever curveballs are thrown my way,” he says.

Derrich Phillips is the Founder and President of Aspire Cyber, a cybersecurity compliance firm that helps defense contractors, research universities, and manufacturers meet CMMC and other regulatory requirements. A Lead CMMC Certified Assessor (LCCA) and CMMC Credentialed Instructor (CCI), he founded the CMMC Professionals Network (CPN), a nonprofit that delivers hands-on CMMC training. Phillips served four years in the U.S. Army, including a deployment to Iraq, and previously held cybersecurity roles at Lockheed Martin, Hewlett-Packard Enterprise, and Bank of America. Aspire Cyber is an approved CMMC training provider and has helped about 35 companies reach Level 2 certification.