inDirectIT names former CMMC lead assessor Alexy Johnson as Director of Compliance Services
Air Force veteran brings more than 20 years of cybersecurity experience to help defense contractors strengthen security
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
WHITE PLAINS, Md., Nov. 12, 2026 (GLOBE NEWSWIRE) — inDirectIT Inc., a cybersecurity firm that helps defense contractors protect sensitive information and meet federal security requirements, has appointed Alexy Johnson as Director of Compliance Services. A former Cybersecurity Maturity Model Certification (CMMC) Level 2 lead assessor and retired U.S. Air Force veteran, Johnson brings more than 20 years of experience securing information systems and evaluating compliance with federal cybersecurity standards.
In his new role, Johnson will spearhead inDirectIT’s internal CMMC program, oversee compliance for the company’s managed services clients, and help lead the company’s CMMC advisory practice. His experience on both sides of the assessment process will help defense contractors implement effective cybersecurity measures and demonstrate that those protections meet federal requirements.
Johnson also brings experience with several federal cybersecurity standards and frameworks, including NIST SP 800-171, which defines safeguards for sensitive government information held by contractors, and NIST SP 800-53, which provides a broader catalog of security controls. His expertise also extends to the Federal Risk and Authorization Management Program (FedRAMP), which establishes security requirements for cloud services used by federal agencies.
“Alexy has worked on both sides of cybersecurity compliance, from securing Air Force networks to assessing whether organizations meet federal standards,” said RJ Williams, CEO of inDirectIT. “Our customers are navigating changing requirements while protecting sensitive information that supports critical federal missions. Alexy’s perspective helps connect those obligations to the day-to-day work of keeping their systems secure.”
The appointment comes as defense contractors navigate changes to the CMMC program, which establishes cybersecurity assessment requirements for companies in the defense supply chain. Although the Pentagon suspended the program’s planned second phase in July, applicable self-assessment requirements and existing obligations to protect controlled unclassified information remain in effect.
“Twenty years as an Air Force systems administrator taught me that compliance only holds up when it reflects how systems actually operate,” Johnson said. “As a CMMC assessor, I saw the importance of being able to demonstrate that security controls are working, not just documenting that they exist. I’m glad to join a team focused on building compliance programs that last, even as requirements change, so our customers can stay focused on the federal missions they support.”
About inDirectIT
inDirectIT Inc. is a cybersecurity, cloud engineering and managed compliance firm helping defense contractors and federal suppliers protect sensitive government information. The company designs, implements and operates secure IT environments, specializing in NIST SP 800-171, CMMC readiness, Microsoft 365 GCC High and Azure Government. Having achieved CMMC Level 2 certification for its own environment, inDirectIT brings firsthand assessment experience to its cybersecurity and compliance services. To learn more or schedule a strategy call for CMMC advisory support, visit https://indirectit.com.
Media Contact
inDirectIT
media@indirectit.com
A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/aafc3b9a-01bb-461b-b766-eaa76c4f0bb9
Media gallery
