Richard Tello

Principal & Lead Consultant. at ComplyZoom

Jacksonville FL, United States

Richard Tello is Principal and Lead Consultant of ComplyZoom, a specialist IT GRC advisory firm serving aerospace, space, Defense Industrial Base, and federal suppliers, DoD contractors, and subcontractors. His work focuses on a single leadership question: can the organization prove readiness on demand?

Rich advises on CMMC Level 2, NIST SP 800-171, and DFARS 252.204-7012 / 252.204-7021 readiness, with emphasis on making evidence provable and leadership representations supportable before SPRS submission, Level 2 self-assessment, C3PAO Level 2 certification assessment, prime review, or Affirming Official action under 32 CFR 170.22.

His signature 10-minute test (pick one control, ask the accountable owner to prove it, and watch the pause) is the entry point for his thinking on why CMMC programs often fail at the evidence layer rather than the control layer. That thinking is codified in two proprietary frameworks: the Proof Equation™, WHO + WHERE + WHAT + HOW = PROOF, and the Scope-to-Evidence Readiness Model™: Scope, Map, Close, Evidence, Affirm. Together, they turn readiness from a periodic scramble into an operating discipline: Readiness: Provable on Demand™.

Rich writes and speaks on evidence-based CMMC readiness, objective-level assessment, 32 CFR 170.24 evidence requirements, executive accountability under the Affirming Official requirement, AI governance where AI tools touch CUI, and the convergence of CMMC with EASA Part-IS for aerospace suppliers operating across defense, aviation, safety, quality, and regulated information-security obligations. His published themes include CUI governance, SPRS score defensibility, NIST SP 800-171A evidence traceability, supplier and cloud dependencies, AI risk in defense environments, and the operational gap between implemented controls and evidence that holds under examination.

Rich brings 15+ years of information security and compliance leadership, holds the CISM certification, and is a CMMC Registered Practitioner. He founded ComplyZoom in 2018, advising defense suppliers on DFARS 252.204-7012 and NIST SP 800-171 implementation before CMMC existed. ComplyZoom is advisory and readiness-focused: not a C3PAO, assessor, or certification body. Based in Jacksonville, Florida, serving clients nationwide.

His view in one sentence: readiness is not what you implemented; it is what you can prove in 10 mins or less, in final form, on demand.

Available for briefings, webinars, podcasts, panels, executive education, and expert commentary on CMMC readiness, CUI evidence discipline, AI governance, and aerospace compliance convergence.

Available For: Advising, Authoring, Consulting, Speaking
Travels From: Jacksonville, FL
Speaking Topics: 1. The 10-Minute Test: Why CMMC Evidence Fails Before Controls Do One control, one accountable owner, ten minutes, and the pause that predicts assessm