Carl B. Johnson

Carl B. Johnson is a Fractional CISO and compliance consultant serving federal contractors and defense-sector organizations. As principal of Cleared Systems, LLC in Fairfax, Virginia, he helps clients navigate the overlapping demands of ITAR, HIPAA, CMMC, and other regulatory frameworks that govern how sensitive and controlled information must be protected.

With a track record of training healthcare professionals, defense primes, and small and mid-sized federal contractors, Carl brings a practitioner's lens to compliance: what the regulations actually require, what auditors look for, and what works in the real-world operations of the people doing the work. He has published an extensive library of compliance and cybersecurity books, including a comprehensive eight-domain CISSP exam preparation series widely used by candidates sitting for the ISC2 CISSP certification.

Carl hosts the InfoSec Battlefield podcast, where he interviews practitioners, auditors, and policy makers on the state of defense-sector cybersecurity. He is a frequent speaker at industry events on topics ranging from ITAR classification and technical data controls to CMMC Level 2 assessments and HIPAA Security Rule implementation.

Cleared Systems serves U.S. defense contractors on a retainer-only basis, with every engagement staffed exclusively by U.S. citizens as required by the ITAR technical data and DoD contractual obligations that govern the firm's work.