WEBVTT
00:00:02.959 --> 00:00:13.679
Welcome to Beast Talk, M&J's podcast where we are sharing and showcasing our areas of expertise through conversations with practice leaders on their knowledge and experience.
00:00:13.679 --> 00:00:24.399
Recently I was joined by Jameson Miller, the leader of our technology services practice, to discuss the Cybersecurity Maturity Model Certification, or CMMC.
00:00:24.399 --> 00:00:27.440
This is a space that continues to evolve.
00:00:27.440 --> 00:00:35.439
So I have asked Jameson to come back and join me on the microphone to discuss where we're at now with CMMC and what's around the corner for us.
00:00:35.439 --> 00:00:42.560
And additionally, we're joined by a guest, an expert in the CMMC space, Chris Silvers, to help with our conversation.
00:00:42.560 --> 00:00:44.000
So thank you for tuning in.
00:00:44.000 --> 00:00:46.000
And Jameson, thank you for joining us.
00:00:46.000 --> 00:00:47.600
Chris, thank you for joining us.
00:00:48.000 --> 00:00:48.479
Great to be here.
00:00:48.799 --> 00:00:58.320
Will you both do me a favor, uh, starting with you, Jameson, and just give our audience a little brief background of kind of who you are, what your role is, and your your kind of touch points with CMMC.
00:00:58.719 --> 00:00:58.960
Sure.
00:00:58.960 --> 00:01:06.719
So as you already mentioned, my name is Jameson Miller, and I uh am the IT leader of our practice leader here at Mauldin & Jenkins.
00:01:06.719 --> 00:01:09.200
I've been with our firm about 20 years now.
00:01:09.200 --> 00:01:19.920
Um spent the first half of my career as a as a CPA working on financial statement audits, and then I've spent the last half of my career uh working in the information security space.
00:01:19.920 --> 00:01:21.439
So that's all things.
00:01:21.439 --> 00:01:27.200
Uh Graham Leech Bliley Act to SOC 2 compliance and SOC 1 reporting.
00:01:27.200 --> 00:01:37.439
Um and so it was just kind of a natural fit for us to pursue this other assessment area uh that the Department of Defense has created.
00:01:37.439 --> 00:01:43.359
And so joining me today is Chris, who I've been partnering with on some CMMC assessments.
00:01:43.840 --> 00:02:02.959
And and Jameson, last time we were together, you kind of gave some background on just kind of how the CPA profession is tackling information security and kind of the playbook of just public trust and third-party, you know, independent assessments and kind of how that's being directed, you know, at the world of cybersecurity and and the like.
00:02:02.959 --> 00:02:05.040
So, you know, fantastic conversation.
00:02:05.040 --> 00:02:06.719
I look forward to continuing it here.
00:02:06.719 --> 00:02:12.240
And and Chris, will you do our audience a favor and just kind of tell a little bit about your background and your roles?
00:02:12.560 --> 00:02:13.520
Yeah, absolutely.
00:02:13.520 --> 00:02:19.039
So uh I've been in the cybersecurity industry since uh the late 90s, back in 98.
00:02:19.039 --> 00:02:23.039
Started here in Atlanta at the Federal Reserve Bank of Atlanta.
00:02:23.039 --> 00:02:28.319
Um, that's kind of where I say I cut my teeth, if you will, in cybersecurity.
00:02:28.319 --> 00:02:33.039
Um, bounced around a little bit and got into consulting back in 2008.
00:02:33.039 --> 00:02:52.080
And um, and then 2014 started my own company, kind of branched out and uh uh created CG Silver's consulting, doing penetration testing, doing a little PCI uh assessment, some Sarbanes Oxley, that kind of stuff, uh a little bit of compliance.
00:02:52.080 --> 00:02:57.599
And then early 2020, uh, I found out about this new thing called CMMC.
00:02:57.599 --> 00:03:17.759
And uh back then it was version 1.02, and uh started doing a little consulting and a little bit of uh mock assessments for some clients, and then uh was fortunate enough to start teaching uh CMMC certification courses back in October of 2021.
00:03:17.759 --> 00:03:22.960
Uh and so uh that's been really a great opportunity.
00:03:22.960 --> 00:03:26.960
I'm honored to say that I've I've taught over 2,000 students now.
00:03:26.960 --> 00:03:28.159
I stay in touch.
00:03:28.159 --> 00:03:31.599
Uh Jameson was one of my star students, obviously.
00:03:31.599 --> 00:03:35.680
And uh and yeah, it's it's been a great, great, great ecosystem.
00:03:36.000 --> 00:03:39.520
Well, Chris, we were very appreciative of you joining us for this episode.
00:03:39.520 --> 00:03:42.319
So thank you for making that the trip to join us.
00:03:42.319 --> 00:03:45.520
And that background is is just it's awesome to hear about.
00:03:45.520 --> 00:03:52.240
And and one thing I love about both of you too is that not only are you experts in this field, but also you're business leaders and business owners.
00:03:52.240 --> 00:03:54.479
So a lot of these concepts, they mean something to you too.
00:03:54.479 --> 00:04:00.879
You've been navigating these for yourselves and also, you know, know the playbook to help other organizations kind of follow best practices.
00:04:00.879 --> 00:04:06.639
Now, Chris, you mentioned that you know you first learned about the CBMC concept in 2020.
00:04:06.639 --> 00:04:15.599
You know, it does feel like from somebody who's kind of on the outskirts of it, that this is a relatively recent evolution, kind of kind of a newer thing that all of us are navigating.
00:04:15.599 --> 00:04:19.120
But the truth really seems to be this has been around for a while.
00:04:19.120 --> 00:04:27.279
So will you kind of help me start out by describing a little bit more of kind of briefly the history of CMMC, kind of where are we now?
00:04:27.279 --> 00:04:30.160
How has the history led to where we are now?
00:04:30.160 --> 00:04:33.839
And then also we'll kind of expand that into what's kind of coming around the corner.
00:04:33.839 --> 00:04:36.399
But just some background around the kind of the current environment.
00:04:36.800 --> 00:04:37.439
Oh goodness.
00:04:37.439 --> 00:04:39.600
Um, all right, buckle up, kids.
00:04:39.600 --> 00:04:55.279
Uh I'll try to just hit the just the highlights uh because believe it or not, the history of CMMC goes back to controlling or protecting controlled unclassified information.
00:04:55.279 --> 00:04:57.600
All right, it's also called CUI.
00:04:57.600 --> 00:05:08.079
And believe it or not, the what prompted the need for uh protecting CUI was 9/11.
00:05:08.079 --> 00:05:11.439
All right, so we go back to 2001.
00:05:11.439 --> 00:05:40.560
Uh based on the 9/11 tragedy, there was a report that came out, I believe it was 2004, the 9/11 Commission, and they found that if different federal agencies had shared information that was not even classified information, it was unclassified information, if they had shared that information between themselves, they could potentially have avoided the attack.
00:05:40.560 --> 00:05:43.439
Now that was really impacting, right?
00:05:43.439 --> 00:05:50.560
Um so Obama signed uh uh an executive order 13556, right?
00:05:50.560 --> 00:05:59.920
Jameson can probably quote that number as well, uh, because we cover that in our training, uh, in 2010 to create the CUI program.
00:05:59.920 --> 00:06:16.800
And so uh shortly after that, shortly, in government time, I guess, uh 2016-2017, uh a standard was uh was created called NIST Special Publication 800 171.
00:06:16.800 --> 00:06:24.160
And that is the that is the bedrock upon which CMMC is created, right?
00:06:24.160 --> 00:06:36.079
That that standard, uh that standard list of safeguards is what CMMC uh kind of audits and and makes sure that that companies are adhering to.
00:06:36.079 --> 00:06:40.720
So uh so yeah, when you say it's been a long time coming, yeah, it's been quite a while.
00:06:41.040 --> 00:06:55.519
Well, and that makes sense because, like you said, that that CUI concept, you know, as soon as we kind of opened our eyes to the importance of unclassified information that does need to have a certain level of confidentiality to it, like clearly we needed to be mindful of it and protect it in some regard.
00:06:55.519 --> 00:07:04.720
So it is interesting kind of what that journey looked like in terms of just you know the implications that could tragically occur if we're not being you know mindful of that.
00:07:04.720 --> 00:07:16.319
Um and then kind of as we've developed practices and built you know through the NIST, that 800-171 publication, um, and then now kind of expanding that further to this assessment concept through CMMC.
00:07:16.319 --> 00:07:19.439
So, Jameson, talk me a little bit more about where we're at today.
00:07:19.439 --> 00:07:21.600
What is CMMC today?
00:07:21.600 --> 00:07:26.079
And what kind of, I guess, phase would you say we're in with respect to CMMC?
00:07:26.399 --> 00:07:26.560
Yeah.
00:07:26.560 --> 00:07:32.240
So according to the Department of Defense, uh they would say that we're in phase one right now of the CMMC.
00:07:32.240 --> 00:07:36.079
So that essentially means that the CMMC is in full rollout.
00:07:36.079 --> 00:08:14.160
Organizations that are seeking assess uh certifications or assessments are uh partnering with C 3 PAOs or certified third-party assessor or C 3 PAO to start either mock assessments or full assessments uh with the intention to be ready by the rollout of phase two, which is coming this November 2026, where at that point that's when uh organizations that are signing defense contracts will be required to have a level two certification in order to uh uh to be in compliance with that contract.
00:08:14.160 --> 00:08:23.759
Uh now technically though, when we start talking about this, this is not anything new that these companies should have been doing.
00:08:23.759 --> 00:08:29.199
As Chris mentioned, NIST 800-171 has been around for quite some time.
00:08:29.199 --> 00:08:39.600
And actually under the DFARS, the defense federal acquisition regulations, they are required to have been implementing NIST 800-171 all along.
00:08:39.600 --> 00:08:50.480
Um but this is a new, you know, third-party assessment that verifies, you know, organizations can no longer self-assess themselves and say, yeah, we're meeting all these requirements.
00:08:51.039 --> 00:09:01.120
So, Chris, you know, looking ahead, kind of what Jameson is describing, I guess, what does that environment look like in terms of who is this really going to apply and you know, kind of what do people need to prepare for?
00:09:01.519 --> 00:09:01.759
Yeah.
00:09:01.759 --> 00:09:17.919
So uh the DOD estimates that there are uh around 80,000 companies, 80,000 contractors, and realize that this the reason that number is so large is because it's not just prime contractors.
00:09:17.919 --> 00:09:18.480
All right.
00:09:18.480 --> 00:09:32.960
There's a there's a misunderstanding out in the marketplace, I think, that that suppliers who are subcontractors don't think that they're covered under this compliancy, um, when in fact they are.
00:09:32.960 --> 00:09:52.960
There's a there's a thing called the flow down rule, and it's just that's just a kind of colloquialism, but it's but it's actually written into these laws, these defense uh federal acquisition regulation supplements to force prime contractors to flow down these requirements to all their subcontractors.
00:09:52.960 --> 00:10:05.360
And when they flow down the requirements, they're also flowing down the flow down so that a subcontractor has to flow down those requirements to their supplier.
00:10:05.360 --> 00:10:09.120
So it goes all the way down through the defense industrial base.
00:10:09.120 --> 00:10:19.039
So you've got 80,000 companies out there, some of them mom and pop shops, like right, like my own company, just a small family business, right?
00:10:19.039 --> 00:10:25.600
And uh so uh so we've got those 80,000 companies out there.
00:10:25.600 --> 00:10:38.159
And to date, uh the last number I saw was less than 800 of these companies have actually gotten certified, have gone through the certification assessment process and everything.
00:10:38.159 --> 00:10:45.759
So uh, you know, that's that's one percent of the 80,000 have actually been assessed.
00:10:46.159 --> 00:10:47.679
So I want to sit on those numbers for a minute.
00:10:47.679 --> 00:10:53.840
So 80,000 is the estimate for who's gonna need to have this process applied to them.
00:10:53.840 --> 00:10:59.519
That they're going to need to be compliant with this process and therefore show some kind of you know different levels of compliant.
00:11:00.080 --> 00:11:02.639
And actually, let me let me let me clarify that.
00:11:02.639 --> 00:11:09.279
80,000 are going to need to be certified by a third-party assessment organization.
00:11:09.279 --> 00:11:12.720
So that's not even self-self-assessment.
00:11:12.720 --> 00:11:18.799
There's another uh estimated 120,000 that would that would need to do self-assessment.
00:11:19.200 --> 00:11:21.279
So 80,000 is those who need to be assessed.
00:11:21.279 --> 00:11:25.440
And what was the count estimated of who has currently gone through this process?
00:11:25.759 --> 00:11:26.799
It's less than 800.
00:11:26.799 --> 00:11:30.480
I think it was 773, is what the number that's sticking in my mind.
00:11:30.639 --> 00:11:30.720
Yeah.
00:11:30.960 --> 00:11:38.639
So I so I guess question to both of you what's leading to that gap in terms of well, well, I guess, you know, it's not required yet.
00:11:38.639 --> 00:11:40.639
It's just coming around the corner.
00:11:40.639 --> 00:11:41.440
Is that right?
00:11:41.919 --> 00:11:48.480
Well, it's the the way that the DOD is rolling this out is that it shows up in a contract, right?
00:11:48.480 --> 00:11:58.159
Um when you receive a contract from the government or when you are when you receive a solicitation for a bid, right?
00:11:58.159 --> 00:12:06.080
They uh the government will uh give you a list of requirements for the bid.
00:12:06.080 --> 00:12:13.840
You know, we need a coffee cup made, and it needs to be three inches in diameter, and you know, the all the specifications.
00:12:13.840 --> 00:12:19.519
But in addition to that, they specify what regulations you have to meet.
00:12:19.519 --> 00:12:25.519
And it's and it's usually a list of like two or three hundred regulations.
00:12:25.519 --> 00:12:43.200
There, you have the federal acquisition regulations that all government agencies have to uh comply to, and then you have these defense federal acquisition regulations supplements that supplement those those acquisition regulations.
00:12:43.200 --> 00:12:46.320
And there can be hundreds of those.
00:12:46.320 --> 00:13:03.679
So the way that the DOD implemented CMMC is that they're including a new supplement, and it's it's actually 252.204-7021 or 7021 as we we commonly refer to it.
00:13:03.679 --> 00:13:06.000
So that will show up in the contract.
00:13:06.000 --> 00:13:18.320
And so essentially, if you are bidding on that contract, you have to adhere to that that those requirements by the time the DOD awards the contract.
00:13:18.320 --> 00:13:19.039
Okay?
00:13:19.039 --> 00:13:28.879
So you'll get basically about a 60 to 90 day heads up that this contract requires CMMC certification.
00:13:28.879 --> 00:13:33.039
And and then you'll have 90 days to be compliant.
00:13:33.039 --> 00:13:38.080
If you're not, then the DOD cannot award you that contract.
00:13:38.080 --> 00:13:50.240
So they'll go to the next bidder who you know maybe had the next, you know, uh more expensive price or whatever reason and say, okay, are you compliant?
00:13:50.240 --> 00:13:52.799
You're compliant, congratulations, you win the bid.
00:13:53.120 --> 00:13:56.559
And and Jameson, you mentioned that we're in like a phase one right now.
00:13:56.559 --> 00:13:58.960
So I guess phase two is that one that's around the corner.
00:13:58.960 --> 00:14:02.799
So tell me a little bit more about kind of what that transition to phase two looks like.
00:14:03.200 --> 00:14:11.919
Yeah, so like I said, in phase two, that's when the uh DOD is going to then start writing those into the contracts.
00:14:11.919 --> 00:14:19.360
And so uh, you know, if you have an existing contract that's playing out, you might not have to immediately comply.
00:14:19.360 --> 00:14:26.960
But the next time that contract re-ups, you better believe it, it's gonna be in there because they want everybody doing this.
00:14:26.960 --> 00:14:31.440
And uh this is just gonna be a business requirement moving forward.
00:14:31.440 --> 00:14:34.639
It's not an option, it's not voluntary.
00:14:34.639 --> 00:14:38.480
Um, if you want to play in this space, this is what you have to do.
00:14:38.799 --> 00:15:02.480
And and I imagine that the expertise you all have to be assessors, and Jameson, we covered this a little bit in our previous episode, but just the the efforts it takes to get certified and the lift you have to navigate in order to be an assessor firm for the uh the rest of the 80,000 who are going to need this, who are not of the around 800 who've already had it done, they're going to be having to navigate this.
00:15:02.480 --> 00:15:04.559
Like you said, it's going to be in their contracts.
00:15:04.559 --> 00:15:10.960
So I guess do you have any advice for the business leaders in terms of like they need to probably get started on this, right?
00:15:11.200 --> 00:15:20.080
And and again, you know, they need to be starting right away because the assessment process is not uh something to be taken lightly.
00:15:20.080 --> 00:15:21.600
It's very rigorous.
00:15:21.600 --> 00:15:26.559
Um the documentation requirements are are very onerous.
00:15:26.559 --> 00:15:42.960
And if you think that you're gonna be able to close that gap in 60 days when you're notified of a contract, you're you're not gonna have the time that it's gonna take uh to get your environment ready and assessed uh within that 60-day time frame.
00:15:42.960 --> 00:15:51.759
And and as you mentioned, just the sheer numbers, uh I'd be interested, Chris, in that you know, 773 uh organizations.
00:15:51.759 --> 00:15:56.799
How many of those were organizations that are C 3 PAOs getting their level two assessment?
00:15:57.120 --> 00:15:59.039
Because No, that's that's OSCs.
00:15:59.039 --> 00:16:02.000
That's that that's organizations seeking compliance.
00:16:02.000 --> 00:16:17.120
It's it's not counting the the what uh 97 uh C 3 PAOs who who are certified or actually uh I shouldn't say certified, um authorized is the term.
00:16:17.519 --> 00:16:23.039
So our process as an example is a firm to get up to speed to be able to help with a service would not count toward that number.
00:16:23.759 --> 00:16:24.480
Correct.
00:16:24.480 --> 00:16:36.639
Um but you know, also I think it should be you should be aware that these organizations that are becoming a third-party assessor, they have to practice what they're preaching uh essentially.
00:16:36.639 --> 00:16:46.320
So we have to be level two certified before we're able to certify other companies as a certified third party assessor.
00:16:46.320 --> 00:16:59.840
And so again, that is I think another reason why you probably see some of these lower numbers uh because there are you know several organizations that are ramping up to become a third-party assessor, but it is difficult.
00:16:59.840 --> 00:17:00.559
It's not easy.
00:17:00.559 --> 00:17:11.200
There's a lot of training I've had to go through to become a lead CCA, and you need at least three of those on your team to make uh a C3PAO function independently on its own.
00:17:11.279 --> 00:17:22.400
So as a business leader who you know is is overseeing a company that has CUI and that has contracts, you know, with the defense industrial base.
00:17:22.400 --> 00:17:33.440
So I need to start thinking about the schedule of how am I going to be navigating the process of getting ready to be certification ready almost and actually getting the certification done.
00:17:33.440 --> 00:17:40.400
And it sounds like I probably need to be doing that planning sooner sooner rather than later, because there's gonna be a a lot of my peers will be seeking that out, Stan.
00:17:40.640 --> 00:17:55.279
Well, to be to be honest, the what I what I tell clients the first step really needs to be is you need to make a decision, a business decision on whether you want to continue in the defense industrial base or not.
00:17:55.279 --> 00:17:57.839
That's the that's decision one.
00:17:57.839 --> 00:18:07.200
And uh we we've had several clients that uh we performed mock assessments on in 2020, right?
00:18:07.200 --> 00:18:13.680
Because there when word got out, there was there was kind of a rush in early 2020 to, you know, what is this?
00:18:13.680 --> 00:18:18.720
I need GAP assessment, I need to figure out, you know, what I need to do to get compliant.
00:18:18.720 --> 00:18:28.319
And I had several clients come back to me after doing the GAP assessment and told me, we've decided we're not doing any more business with the DOD.
00:18:28.319 --> 00:18:31.920
And that's a valid, that's a valid business decision, right?
00:18:31.920 --> 00:18:42.799
For them, it represented like 5% of their business, and the cost to become compliant was more than what they were benefiting from those government contracts.
00:18:42.799 --> 00:18:47.680
So I I feel like that's that's really the first thing that needs to happen.
00:18:47.680 --> 00:18:56.720
And then the next thing is figure out how are you going to uh how are you going to get compliant.
00:18:56.720 --> 00:19:06.799
And uh because compliance itself, like getting compliant is actually more expensive and takes more time than getting assessed.
00:19:06.799 --> 00:19:14.799
You know, we talk about you know lead times for getting assessed, and the the process itself takes, you know, two months.
00:19:14.799 --> 00:19:22.079
And leading up to that, we like to reserve two months to make sure that the company is ready, right?
00:19:22.079 --> 00:19:28.000
We we go through, we're going through that right now of making sure that they're ready to be assessed.
00:19:28.000 --> 00:19:31.839
But before all that happens, you've got to get compliant.
00:19:31.839 --> 00:19:34.799
And that can take 12 to 18 months.
00:19:34.799 --> 00:19:38.720
So, you know, you it it is a it's a big deal.
00:19:38.720 --> 00:19:52.960
So there are to me, uh a lot of small companies, the better play for them may be to seek acquisition by a company who is on this path already.
00:19:53.359 --> 00:20:09.039
And and Jameson, that this my my mind goes to, you know, system and organization control audits, SOC audits, SOC 1, SOC 2, you know, talking about this having to meet control objectives and having an independent assessor come in and give some type of an opinion or conclusion or authorization, whatever the case might be.
00:20:09.039 --> 00:20:17.359
So will you just kind of talk me through what are some of the similarities and what are some of the differences between a SOC audit and this CMMC assessment?
00:20:17.839 --> 00:20:18.160
Sure.
00:20:18.160 --> 00:20:31.039
So uh I I think when you want to talk about SOC SOC audits and SOC examinations, the one that that mirrors most closely to the CMMC is gonna be the SOC two versus the SOC 1.
00:20:31.039 --> 00:20:42.000
But the the there are differences where a SOC 2 is gonna be more focused on the security of the organization, how they're maintaining confidentiality or privacy.
00:20:42.000 --> 00:20:46.079
Uh it's not about protecting controlled unclassified information.
00:20:46.079 --> 00:20:48.960
That's what the CMMC assessment is about.
00:20:48.960 --> 00:20:55.599
The other part that kind of sets the two uh assessments uh apart from another.
00:20:55.599 --> 00:21:20.079
Uh in a SOC 2, if you have a qualified opinion, meaning you had so many exceptions in your report that one or more control objectives couldn't couldn't be met, then you get a section five in your report and you get to talk about, well, here's why this uh exception happened and here's what we are gonna do about it in the future, so on and so forth, and you issue that report.
00:21:20.079 --> 00:21:29.440
A third party that's using your services looks at that report, they assess how that impacts their environment, and you don't necessarily lose your contract with that user.
00:21:29.440 --> 00:21:32.720
The CMMC doesn't work that way.
00:21:32.720 --> 00:21:44.400
If if you're going through an assessment and you fail certain aspects, I know we won't get in the weeds with you know the nuances, but if you fail so many of the requirements, then you fail the assessment.
00:21:44.400 --> 00:21:47.440
If you fail the assessment, you don't get the contract.
00:21:47.440 --> 00:21:51.440
So that's the biggest difference that I see between the two assessments.
00:21:51.440 --> 00:21:54.400
Um they're both very rigorous examinations.
00:21:54.799 --> 00:22:04.000
Yeah, that that makes sense because it you know, a a a stop two are like you're saying that you know that section five, that talk through what the findings were and the management has an opportunity to respond to them.
00:22:04.000 --> 00:22:07.440
You know, we're not quite sure how a customer might respond to that.
00:22:07.440 --> 00:22:09.759
You know, it might not put your contract at risk.
00:22:09.759 --> 00:22:17.440
Whereas this case, like our customer per se is the DOD, and they're going to have an opinion on those failures to a certain degree, like you're describing.
00:22:17.440 --> 00:22:18.240
Interesting.
00:22:18.240 --> 00:22:23.039
Well, I guess tell me a little bit about like what does write look like from a CMMC perspective.
00:22:23.039 --> 00:22:32.160
You know, what what what does a company's operations or posture look like to help them have, you know, navigate a successful assessment process?
00:22:32.640 --> 00:22:52.160
Well, I think the the biggest point kind of goes back to uh one of Chris's earlier earlier points, which is they need the the at the top management or the owners or the board, whoever it is that's charged with governance of that organization has to make a business decision.
00:22:52.160 --> 00:22:55.359
Are we going to continue to stay in this space?
00:22:55.359 --> 00:23:05.440
And if that is the case, then right looks like um making sure that you are ready to meet this assessment process.
00:23:05.440 --> 00:23:12.079
That goes with getting started right away with mock assessments if you don't think you're ready.
00:23:12.079 --> 00:23:24.480
Um starting to get with those registered practitioner organizations or RPOs, those are people that have been qualified under the Cyber A B, which is a the um accreditation.
00:23:24.480 --> 00:23:28.640
Accreditation accreditating body for the for the for the CMMC.
00:23:28.640 --> 00:23:41.839
So those organizations have been uh have gone through some uh rigorous training uh to to consult in this space and help get organizations ready for those assessments.
00:23:41.839 --> 00:23:46.640
Uh but those RPOs are not certified third-party assessors necessarily.
00:23:46.640 --> 00:23:48.720
Some are, some aren't.
00:23:48.720 --> 00:23:55.200
Um but you you then would have to have the third-party assessment completed by the the C3PAO.
00:23:55.599 --> 00:23:55.759
Right.
00:23:55.759 --> 00:24:00.240
And and if I can tack on to that, um you bring up a great point, Jameson.
00:24:00.240 --> 00:24:05.200
There's and and this is something that has borne out over the last year of doing assessments.
00:24:05.200 --> 00:24:08.720
I think we've done now 11, 12 assessments.
00:24:08.720 --> 00:24:24.400
And you can tell the difference between companies who are who have been focusing on compliance and the ones who have not only focused on compliance, but focused on becoming ready for an assessment.
00:24:24.400 --> 00:24:26.720
So it's two different things, right?
00:24:26.720 --> 00:24:29.839
It it's, you know, everybody needs to be compliant.
00:24:29.839 --> 00:24:40.079
They need to, you know, implement the practices and in such a way that that controls are consistent and reliable and all those things.
00:24:40.079 --> 00:24:47.119
But uh but they also need to be ready for an assessor to come in and ask questions.
00:24:47.119 --> 00:25:01.920
They need to have uh you know their evidence organized in such a way that it's easy to present to an assessor so that it presents their security program in the best light, right?
00:25:01.920 --> 00:25:06.480
They need to prep the individuals who are going to be interviewed, right?
00:25:06.480 --> 00:25:14.000
How many times have you been on an interview when you ask someone what time it is and they tell you how to build a watch?
00:25:14.000 --> 00:25:14.880
Right?
00:25:14.880 --> 00:25:16.319
Yeah.
00:25:16.319 --> 00:25:19.759
And you know, people get themselves in trouble that way.
00:25:19.759 --> 00:25:34.000
You know, the the more you talk, the more the assessor is hearing, well, wait a minute, I don't think this control works the way your documentation says based on what you just told me, even though I didn't ask you that particular question.
00:25:34.400 --> 00:25:46.319
So so obviously we need to have the controls that help us meet our objectives, but we also need to be able to demonstrate we have the controls and they are functioning properly.
00:25:46.799 --> 00:25:57.920
And it needs to be documented in a manner in which it makes it easy for an assessor to close those gaps and you know look at the proper artifacts for each requirement.
00:25:58.240 --> 00:25:59.599
Well, do y'all have any advice for that?
00:25:59.599 --> 00:26:03.119
Like I'm thinking, you know, maybe like continuous processes that can help some.
00:26:03.119 --> 00:26:07.440
I guess just baking into our SOPs, you know, creating artifacts and the like.
00:26:07.440 --> 00:26:13.680
Like, do you have any just practical advice for our listeners in terms of how they can help with the demonstration and prepare themselves for an assessor?
00:26:14.000 --> 00:26:14.480
Absolutely.
00:26:14.480 --> 00:26:26.319
Number one, engage with a consultant who uh is knowledgeable, who has the requisite certifications, uh, especially, you know, the more the better.
00:26:26.319 --> 00:26:32.720
If you if you're working with a consultant who is also a C3 PAO as a business, that's great.
00:26:32.720 --> 00:26:45.279
Uh the individuals that you're working with, if they if they are uh CMMC certified assessors and CMMC certified professionals, um, you know, the more the merrier.
00:26:45.279 --> 00:26:48.799
Um and then and then practice, right?
00:26:48.799 --> 00:26:52.880
Um do practice runs of assessments.
00:26:52.880 --> 00:27:10.720
And while you're doing, you know, when the assessor says, can you show me this setting within you know this configuration setting, uh go through the process of creating, you know, doing that demonstration and at the end take a screenshot.
00:27:10.720 --> 00:27:21.039
And then as long as the same person who created the screenshot is the one who's gonna get interviewed in the assessment, uh, they've already done it once.
00:27:21.039 --> 00:27:26.079
So that when it comes time, when it comes show time, they're not nervous.
00:27:26.079 --> 00:27:34.960
They, you know, they know what requirement assessment objective was was demanded that screenshot and they remember what they did.
00:27:34.960 --> 00:27:38.480
So when the assessor says, Can you show me that setting?
00:27:38.480 --> 00:27:40.400
they just do it once again.
00:27:40.400 --> 00:27:50.400
And from an assessor standpoint, it really, you know, even if we know that they were coached, subconsciously, it makes us feel confident.
00:27:50.400 --> 00:27:55.119
It makes us feel like they know what they're doing and they have implemented the practice.
00:27:55.119 --> 00:27:55.680
Right?
00:27:55.680 --> 00:27:56.799
It's very important.
00:27:56.799 --> 00:27:59.599
Got to remember assessors are people too, right?
00:27:59.839 --> 00:28:00.720
That's exactly right.
00:28:00.720 --> 00:28:02.720
And Jameson, same question to you.
00:28:02.720 --> 00:28:08.880
Any considerations in terms of advice to folks to help posture themselves for a successful assessment?
00:28:09.200 --> 00:28:18.559
You know, but from my perspective, I think the the more documentation you can provide in your system security plan, that's always super helpful for an assessor.
00:28:18.559 --> 00:28:25.119
Um, and then also including your own internal security control assessment is part of your artifacts.
00:28:25.119 --> 00:28:42.319
That can also help uh because a lot of times we we like to look at that to see what kind of artifacts that you were looking at to determine your compliance, and then make sure, okay, well, is that same evidence going to be uh adequate and sufficient to meet this requirement, you know, for our needs on our side.
00:28:42.319 --> 00:28:46.160
So I definitely think the more you do there, uh, the better.
00:28:46.160 --> 00:28:49.359
I think the more, you know, depending on your environment too.
00:28:49.359 --> 00:28:55.519
So this, you know, also is heavily contingent on what kind of environment.
00:28:55.519 --> 00:28:57.440
Are you a manufacturing facility?
00:28:57.440 --> 00:29:03.599
You know, you might have more challenges than somebody that's operating just a secure enclave with a few people in it.
00:29:03.599 --> 00:29:30.400
And so um, you know, if you're in that secure enclave environment, the more configuration um information that you can give me with how certain assets within the environment are set up, uh the easier it is for me to go through and determine, yes, they they are practicing what they're preaching, they're doing what they're saying they're doing in their system security plan, uh, the quicker I can get through the assessment, the fewer demonstrations we have to go through.
00:29:30.400 --> 00:29:35.200
Um so it just saves everybody time by being that organized.
00:29:35.200 --> 00:29:54.559
Um and then it just keeps us from asking, kind of like Chris said, keeps us from asking more questions and then getting somebody into that, you know, rambling on and on and on, and then just well, well, actually, so and so uses this jump drive to take this uh controlled unclassified information over.
00:29:54.559 --> 00:29:56.240
It's like, whoa, what did you just say?
00:29:56.240 --> 00:29:59.519
Like that's that just blew this whole assessment up, you know.
00:29:59.519 --> 00:30:05.200
So uh making sure that people aren't gonna blunder something, you know, quite like that.
00:30:05.200 --> 00:30:11.359
But at the same time, we're not asking for people to be coached on misleading the assessors.
00:30:11.359 --> 00:30:13.440
Um, that's not what we're encouraging.
00:30:13.440 --> 00:30:17.920
We're just encouraging people to be coached up on how to get to those artifacts.
00:30:17.920 --> 00:30:22.559
Because again, I don't know, like we sit in a lot of these walkthroughs and demonstrations.
00:30:22.559 --> 00:30:32.640
There's nothing kind of more frustrating than sitting on a demonstration for 15 minutes watching somebody fumble through, you know, their Microsoft Azure environment trying to find certain settings.
00:30:32.960 --> 00:30:34.240
Great advice from both of you.
00:30:34.240 --> 00:30:40.720
I think all of us business leaders can kind of take those and put them into action in terms of how we're developing our policies.
00:30:40.720 --> 00:30:50.240
We're gonna actually practice what we preach, do what we say, you know, live by it, like you were saying, Jameson, in terms of our policies are actually representative of our procedures.
00:30:50.240 --> 00:31:12.480
And then additionally, importantly, preparing our people, making sure that we can navigate like you were describing, Chris, in terms of just, you know, being coached in the ways that make sense to coach our folks, just so that we can successfully and accurately demonstrate what we are doing as a business and what our controls are and how we are documenting satisfaction of those controls.
00:31:12.480 --> 00:31:34.240
So great, great advice from both of you, but I'm also curious about maybe some misses, you know, maybe something from y'all's experience of navigating either side of the coin in terms of whether you've been consulting with companies to help them prepare and be assessment ready, or whether you've actually been navigating an assessment, you know, uh with a company.
00:31:34.240 --> 00:31:37.599
Just what are some things you've seen where maybe something's gone a little sideways?
00:31:37.599 --> 00:31:39.119
So Chris, you first.
00:31:39.519 --> 00:31:39.839
Okay.
00:31:39.839 --> 00:31:47.839
Well, uh from an assessment perspective, I think, well, actually, I I do have a good consulting one.
00:31:47.839 --> 00:31:51.680
Um I was doing a mock assessment back in 2020, right?
00:31:51.680 --> 00:32:05.119
So it's been quite a while, uh, where they had great policies and they had a policy that administrators, uh, when they log into the system, they have to use multi-factor authentication.
00:32:05.119 --> 00:32:05.519
Okay.
00:32:05.519 --> 00:32:18.720
This is a this is one of those requirements that it's it's so easy to say it, and it's so easy to understand it, and of course, a bit difficult to implement, right?
00:32:18.720 --> 00:32:26.720
But uh nobody really questions the need for multi-factor authentication in today's world and and all that.
00:32:26.720 --> 00:32:37.119
So uh I'm with the client, we're sitting in a conference room, and he's showing me up on the screen uh the authentication mechanism.
00:32:37.119 --> 00:32:38.720
And I say, okay, great.
00:32:38.720 --> 00:32:41.680
So show me the administrators.
00:32:41.680 --> 00:32:47.200
And you know, his policy said, you know, sure enough, all administrators have to use MFA.
00:32:47.200 --> 00:32:51.039
So uh I said, okay, show me the administrators now.
00:32:51.039 --> 00:32:54.960
Uh show me, you know, where it says that they have to use MFA.
00:32:54.960 --> 00:32:58.000
And he's showing me a list of about six or seven administrators.
00:32:58.000 --> 00:33:02.640
I noticed that two of them, it says no MFA required.
00:33:02.640 --> 00:33:07.440
I'm like, uh, are you sure we're at the right place?
00:33:07.440 --> 00:33:10.400
I mean, what you know, I'm just trying to throw him a bone, right?
00:33:10.400 --> 00:33:14.160
And he just kind of looks at me and he says, I'll be back in five minutes.
00:33:14.160 --> 00:33:17.039
So, you know, very important.
00:33:17.039 --> 00:33:19.759
Uh again, goes back to that coaching.
00:33:19.759 --> 00:33:28.559
Make sure that uh whatever you have implemented is still implemented when the assessor shows up, right?
00:33:28.559 --> 00:33:29.599
It's very embarrassing.
00:33:29.599 --> 00:33:34.720
Apparently, there were a couple administrators who were troubleshooting something and they had turned that off.
00:33:34.720 --> 00:33:40.079
Well, you know, during the assessment's not a good time to turn off uh security controls, right?
00:33:40.079 --> 00:33:42.160
Maybe never a good time to turn off security controls.
00:33:42.160 --> 00:33:50.720
Never is a good time, but but still, uh yeah, it it all comes down to you know, make sure you're doing what you say you're doing.
00:33:51.039 --> 00:33:51.599
Yeah, exactly.
00:33:51.599 --> 00:33:54.240
No, that's a great example because I agree, Jameson.
00:33:54.240 --> 00:33:56.720
It's probably never a good time to turn off security controls.
00:33:56.720 --> 00:34:09.360
But but yeah, Chris, and I feel like that's something where this process, you know, is really valuable just to kind of keep all this top of mind for us, too, that you know, we created that MFA policy for a reason, you know, and we first enabled it for a reason.
00:34:09.360 --> 00:34:16.159
And it's probably good for us to go through even just internally and check that it's there, especially if we know an assessor is going to be coming in soon.
00:34:16.480 --> 00:34:17.119
Yeah, absolutely.
00:34:17.119 --> 00:34:21.440
And I and I wanted to mention one other thing about uh interviews as well.
00:34:21.440 --> 00:34:34.159
Uh most of the time when we are performing interviews and and we're having demonstrations done, we need to take uh a little bit of time to document what we're seeing, right?
00:34:34.159 --> 00:34:39.199
Because we we don't just sit down at night and replay the day and do all our documentation.
00:34:39.199 --> 00:34:40.960
I mean, that there's no way to do that.
00:34:40.960 --> 00:34:43.519
There's just too many questions that you've asked.
00:34:43.519 --> 00:34:49.840
So it's very common that there's going to be a good 15 to 30 seconds of silence.
00:34:49.840 --> 00:34:53.760
Learn to get comfortable with the silence.
00:34:53.760 --> 00:34:55.360
Embrace the silence.
00:34:55.360 --> 00:35:13.199
Because as a person who is being interviewed and uh and assessed, and I've been in that seat, I've been in that hot seat, it is so hard to just sit and let the silence linger while the assessor is typing up his notes, right?
00:35:13.199 --> 00:35:16.239
It's it is difficult, but you need to learn to do it.
00:35:16.639 --> 00:35:16.880
Right.
00:35:16.880 --> 00:35:24.639
Not just as this assessor is digesting what my response was and updating their notes related to my response.
00:35:24.639 --> 00:35:31.440
I don't need to just fill that silence by telling the assessor even more way beyond exactly relevant to the scope of what they're navigating.
00:35:31.440 --> 00:35:33.199
That's fantastic advice.
00:35:33.199 --> 00:35:35.280
Uh Jameson, same question to you.
00:35:35.280 --> 00:35:38.960
And any anything you've now encountered where things went a little bit sideways.
00:35:39.360 --> 00:35:41.039
Well, it didn't really go sideways.
00:35:41.039 --> 00:35:51.679
Uh I guess the closest thing that I've come across in an assessment, we we kind of had a near-miss, but this was uh it wasn't a that major uh or that big of a deal.
00:35:51.679 --> 00:36:05.519
Uh so essentially uh one of the organizations I was working with, uh the Department of Defense, by the way, is they're very um uh they place a high priority on logging.
00:36:05.519 --> 00:36:18.239
So if something happens, they want to make sure that adequate amount of information has been retained for an appropriate time period to investigate what occurred.
00:36:18.239 --> 00:36:27.440
So on this particular assessment, um a lot of this organization's network traffic was running through a particular network device.
00:36:27.440 --> 00:36:34.480
And they said in their system security plan that that network device was was maintaining logs for 90 days.
00:36:34.480 --> 00:36:47.119
And when we came to doing the demonstration, uh it was one of those situations where I don't think they were actually prepared for me to ask, well, show me where it's keeping maintaining logs for 90 days.
00:36:47.119 --> 00:37:01.760
Um and so they kind of fumbled around for a bit, uh, had to actually go back and say, well, we'll have to we'll reshow you this demonstration because we think that actually the logs are being sent to this other system, this other seam, and that's where they're maintained.
00:37:01.760 --> 00:37:04.800
I'm like, well, that's not what your SSP says.
00:37:04.800 --> 00:37:12.880
And so uh, you know, the other thing is when you're doing the assessment, you're not really allowed to do any kind of consulting.
00:37:12.880 --> 00:37:21.679
And so when you point things out like this, you kind of have to be careful how you phrase things because you can't just be like, well, just update your SSP.
00:37:21.679 --> 00:37:30.320
To, you know, you have to you have to make them kind of, oh yeah, we need to update our SSP.
00:37:30.320 --> 00:37:34.239
We'll be we'll be right back, you know, and and we'll give you an updated version.
00:37:34.239 --> 00:37:44.639
And so uh that's the kind of the closest thing that that I've run across uh in terms of uh uh and that that would have been poammable though, even if they would have failed it.
00:37:44.719 --> 00:37:56.480
Um so that that is a good point in terms of you know we we have a really good written policy and then we have a really good procedure, but they're different.
00:37:56.480 --> 00:37:58.159
Yeah, they just don't match.
00:37:58.159 --> 00:37:59.360
They just don't match.
00:37:59.360 --> 00:38:08.559
So we need to ensure that we have alignment because there's a degree where that's relevant to the assessment of the assessment be like, that is a good practice, but that's not what you say you do, and that's a problem.
00:38:08.559 --> 00:38:10.480
Now, what's that word you just threw out?
00:38:10.480 --> 00:38:10.719
Po.
00:38:11.280 --> 00:38:11.599
POAM?
00:38:11.599 --> 00:38:12.559
Poeammable, yeah.
00:38:12.559 --> 00:38:13.440
So poammable.
00:38:13.440 --> 00:38:14.559
What's poamable?
00:38:14.559 --> 00:38:17.360
So essentially it's a made-up word.
00:38:17.360 --> 00:38:27.920
Yeah, it's it it is a made-up word, uh, I guess used in the uh industry, but uh it stands for POAM or uh plan of action and milestone.
00:38:27.920 --> 00:38:37.119
So essentially if you have uh an exception or you're not meeting a requirement, it goes on your schedule, your plan of action and milestone schedule POAM.
00:38:37.119 --> 00:38:41.760
Uh you have uh a certain period of time to correct those.
00:38:41.760 --> 00:38:46.719
Uh now when you're going through an assessment, this is kind of getting down in the weeds.
00:38:46.719 --> 00:38:52.559
But if you get if you have too many of those, or there's certain requirements that are just you can't POAM.
00:38:52.559 --> 00:38:57.440
Um so if you fail one of those, that's an automatic failure of the assessment.
00:38:57.440 --> 00:38:59.679
There is no fixing it.
00:39:00.159 --> 00:39:04.239
So there are some some comparisons to like a cap, a corrective corrective action plan.
00:39:04.800 --> 00:39:05.199
Absolutely.
00:39:05.199 --> 00:39:07.280
That's essentially the same kind of thing.
00:39:07.280 --> 00:39:19.519
So like if you're familiar with high trust, uh where they have this corrective action plans, and you have to have an external assessor come back out six months later and reassess those those uh corrective action plans.
00:39:19.519 --> 00:39:21.679
POAM works the same way.
00:39:21.679 --> 00:39:36.880
An OSC would have to have a uh if they did achieve the certification on the front end, they would have six months to correct those POAMs and have uh a C3PAO come in and reassess those requirements.
00:39:36.880 --> 00:39:40.559
Doesn't have to be the same C3PAO that they worked with originally.
00:39:40.559 --> 00:39:42.320
It could be a different one.
00:39:42.320 --> 00:39:45.599
Um it could be the same one though, presumably.
00:39:45.760 --> 00:39:49.119
So well, this conversation has been so helpful.
00:39:49.119 --> 00:40:00.000
I recognize now just the the magnitude of what we're navigating in terms of how many different companies in the supply chain of the defense ecosystem this is gonna start applying to.
00:40:00.000 --> 00:40:09.679
And so some real critical business decisions they need to make in terms of does this strategically make sense for them to continue to operate within this world?
00:40:09.679 --> 00:40:33.039
And if yes, they need to start acting now, if they haven't already, in terms of preparing for an assessment, recognizing the next contract and where they get is gonna have some additional language in it, identifying their gaps, and then when it comes time for an actual assessment, you know, making sure that they have in place the processes, procedures, and training to come out on the other side with the successful assessment.
00:40:33.039 --> 00:40:40.719
Um and also we discussed some pitfalls that you know we we've seen in the real world in terms of kind of what we can avoid for ourselves.
00:40:40.719 --> 00:40:43.519
Um, I guess I'm gonna ask one last question to both of you, Jameson.
00:40:43.519 --> 00:40:47.519
I'll start with you and then end with you, Chris, in terms of kind of just your final takeaway for our listeners.
00:40:47.519 --> 00:40:54.639
Just kind of that one final piece of advice that you had for them, just as they're preparing for or navigating this CMMC environment.
00:40:54.639 --> 00:40:57.440
So, Jameson, what's your what's your last takeaway for our listeners?
00:40:57.840 --> 00:40:58.079
Sure.
00:40:58.079 --> 00:41:11.199
So uh maybe a couple of things, but uh the first, starting with uh whoever is gonna be in your organization leading the charge for the certification, in my opinion, this is not a requirement, but just this is my opinion.
00:41:11.199 --> 00:41:16.320
I think it would be helpful for them to go through the CCP and maybe even the CCA course.
00:41:16.320 --> 00:41:27.840
Uh that way they are familiar with what the assessors are gonna be looking at, what the assessors are gonna be doing, and that will give them a better understanding of the requirements also.
00:41:27.840 --> 00:41:34.000
Um they don't necessarily need to go take the examinations, but I do think it would help for them to go through that training.
00:41:34.000 --> 00:41:42.800
There's one-week courses, um, so that would that would help educate somebody internally, uh, and they're not too expensive.
00:41:42.800 --> 00:41:47.599
So we're not talking about, you know, tens of thousands of dollars of training here.
00:41:47.599 --> 00:41:53.599
Uh the second thing I would close with is just scoping is so important in your environment.
00:41:53.599 --> 00:42:08.639
So if you can't figure out or get your head, your hands or your head wrapped around everywhere you have controlled unclassified information in your environment and you don't understand all the scope of the assets you have in your environment, then you can't protect them all.
00:42:08.639 --> 00:42:23.360
And you can't under- So if you're having difficulties navigating that, then you need to find a partner that can help you navigate that and organize this stuff in a manner uh to get you over that hump quicker.
00:42:23.360 --> 00:42:25.519
Um so that would be my biggest takeaways.
00:42:25.760 --> 00:42:29.199
Well, I've heard you say before, Jameson, you can't protect what you don't know you have.
00:42:29.599 --> 00:42:30.000
That's right.
00:42:30.000 --> 00:42:30.320
Yeah.
00:42:30.320 --> 00:42:50.639
So if you don't know you have it, or you don't know that, you know, the example I gave earlier of, you know, somebody takes a jump drive and moves it from a machine uh in this network to over here in the warehouse, you know, if you don't understand that those things are happening, uh then you can't have adequate controls in place to protect everything and pass this assessment.
00:42:51.039 --> 00:42:52.320
Chris, same question to you.
00:42:52.320 --> 00:42:54.800
Kind of a final takeaway for our listeners.
00:42:55.119 --> 00:42:55.360
Wow.
00:42:55.360 --> 00:43:00.880
Well, Jameson kind of covered really the big hitters that I probably would throw out there.
00:43:00.880 --> 00:43:03.039
And especially you brought up scoping.
00:43:03.039 --> 00:43:06.159
Um, yeah, I would I would echo that 10 times.
00:43:06.159 --> 00:43:08.480
Scoping, scoping, scoping, right?
00:43:08.480 --> 00:43:13.440
Uh we we have we've seen uh a false start.
00:43:13.440 --> 00:43:24.400
Uh the the one kind of false start that we've had um was because of scoping, because we started asking the question, the simple question, how do you receive CUI?
00:43:24.400 --> 00:43:31.039
And the the contractor, the OSC started describing all the ways they receive it.
00:43:31.039 --> 00:43:40.880
And I'm sitting here looking at a network diagram, and they didn't have on the diagram a couple of ways that they receive CUI.
00:43:40.880 --> 00:43:43.440
So I'm like, we can't go forward.
00:43:43.440 --> 00:43:50.239
There's you know, without without a solid documented scope, we cannot go forward.
00:43:50.239 --> 00:43:53.199
So it is, it's it's it's vitally important.
00:43:53.199 --> 00:43:59.280
Um, the only other thing I would, I guess, uh reiterate is assessors are human.
00:43:59.280 --> 00:44:05.039
Uh in my case, in my particular case, uh my wife works with me.
00:44:05.039 --> 00:44:09.119
She's been working with me for five, six years now, and she is an assessor.
00:44:09.119 --> 00:44:11.360
She's a a CCA.
00:44:11.360 --> 00:44:15.360
And when we show up on site, uh, we're not mean.
00:44:15.360 --> 00:44:17.039
We're not there to trick you.
00:44:17.039 --> 00:44:22.320
We're not, you know, we're not we don't hold a grudge against anything in the world.
00:44:22.320 --> 00:44:30.800
We're we're literally just wanting to provide the OSC an opportunity to provide evidence that they are compliant.
00:44:30.800 --> 00:44:37.199
So um, you know, we're we uh my wife's also name is Chris, so we're Chris and Chris.
00:44:37.199 --> 00:44:43.280
And uh one one of the consultants, yeah, one of the consultants started calling us Chris Pleural.
00:44:43.599 --> 00:44:44.960
So Chris Squared.
00:44:45.119 --> 00:44:46.320
Yes, Chris Squared.
00:44:46.320 --> 00:44:47.920
We I think we've heard them all.
00:44:47.920 --> 00:44:49.840
Uh Chris Pleural was a new one, though.
00:44:49.840 --> 00:44:51.039
I hadn't heard that before.
00:44:51.039 --> 00:44:54.079
But uh but yeah, I assessors are human.
00:44:54.079 --> 00:44:57.199
And um keep that in mind, right?
00:44:57.199 --> 00:45:07.119
I I I wouldn't suggest doing anything untoured or or deceitful or anything, but assessors are human and we can't escape that.
00:45:07.119 --> 00:45:08.639
It is what it is.
00:45:09.039 --> 00:45:10.800
Uh also fantastic advice.
00:45:10.800 --> 00:45:17.760
I love your comment about scoping because I know that's oftentimes whenever we're trying to secure some type of environment, we have to know what are the boundaries of that environment.
00:45:17.760 --> 00:45:18.639
What is our system?
00:45:18.639 --> 00:45:24.239
What are we kind of ties into that concept if you can't protect what you don't know, you have, but what what is relevant to it?
00:45:24.239 --> 00:45:30.079
Like you're saying, kind of how CUI is coming into our environment, making sure our network diagram is appropriately capturing that.
00:45:30.079 --> 00:45:34.000
And I also love the con the comment too, Chris, about just assessors being human.
00:45:34.000 --> 00:45:36.000
You know, we're all playing our part, right?
00:45:36.000 --> 00:45:40.320
And we and we all want this to be a smooth process, a successful process.
00:45:40.320 --> 00:45:42.159
You know, we're we're all in this together.
00:45:42.159 --> 00:45:45.199
At the end of the day, the way I see it too is this has real implications.
00:45:45.199 --> 00:45:48.400
I mean, we're not just doing this just to check off some boxes, right?
00:45:48.719 --> 00:45:49.599
Yeah, absolutely.
00:45:49.599 --> 00:46:06.639
I mean, uh, you know, we didn't we didn't really talk about like the real world impact of of not protecting CUI, but you know, there's stories about the the Chinese bomber that that looks a lot like our stealth bomber, the the space shuttle that looks a lot like our space shuttle.
00:46:06.639 --> 00:46:09.199
Well, there's a reason for that, right?
00:46:09.199 --> 00:46:16.159
Plans and designs and sensitive information is getting stolen and used by our adversaries.
00:46:16.480 --> 00:46:17.039
Yeah, you're right.
00:46:17.039 --> 00:46:21.119
Like there are actual real world implications to all of this.
00:46:21.119 --> 00:46:28.480
And Chris, will you also just do uh do uh me a favor and tell listeners a little bit more about your business and how they can get in contact with you?
00:46:28.800 --> 00:46:29.760
Yeah, absolutely.
00:46:29.760 --> 00:46:37.440
So, in addition to CMMC, uh we do other compliance frameworks like PCI, HIPAA, those type things.
00:46:37.440 --> 00:46:39.760
We also do penetration tests.
00:46:39.760 --> 00:46:45.440
And uh uh I as you might imagine, I love education.
00:46:45.440 --> 00:46:54.800
So uh we have a whole education department in our business where we can do uh user awareness training and and that type of stuff.
00:46:54.800 --> 00:46:55.679
It's a little different.
00:46:55.679 --> 00:47:03.360
It's not a platform, it's not just a five-minute video, it's literally me coming on site and doing kind of a roadshow.
00:47:03.360 --> 00:47:12.480
So uh yeah, as you can probably imagine, I'm pretty passionate about security and about helping companies uh become more secure, right?
00:47:12.480 --> 00:47:17.280
There is no hundred percent out there and uh just trying to approach it.
00:47:17.280 --> 00:47:29.199
So uh so basically in the late 90s, early 2000s, um I I essentially bought uh everything that says CG Silvers that I could find.
00:47:29.199 --> 00:47:37.119
So what I tell people is the way to get in touch with me is just go out on the internet and yell CG Silvers, and you'll probably come up with me.
00:47:37.119 --> 00:47:42.639
That's literally LinkedIn.com slash IN slash CG Silvers, right?
00:47:42.639 --> 00:47:45.360
And of course our website, CGSilvers.com.
00:47:45.599 --> 00:47:47.920
Well, again, thank you so much to both of you for joining me.
00:47:47.920 --> 00:47:52.000
And and first off, just thank you for the work that you do because it really is impactful.
00:47:52.000 --> 00:47:58.079
But I just also really appreciate you joining me today and get on the microphone to talk through these considerations.
00:47:58.079 --> 00:48:01.599
And to our listeners, also thank you for tuning in.
00:48:01.599 --> 00:48:14.800
If you have any thought questions about the items we discussed today or any other business challenges you're navigating, please don't hesitate to contact us at www.mjxcpa.com and also go to the internet and just yell CG Silvers.
00:00:02.959 --> 00:00:13.679
Welcome to Beast Talk, M&J's podcast where we are sharing and showcasing our areas of expertise through conversations with practice leaders on their knowledge and experience.
00:00:13.679 --> 00:00:24.399
Recently I was joined by Jameson Miller, the leader of our technology services practice, to discuss the Cybersecurity Maturity Model Certification, or CMMC.
00:00:24.399 --> 00:00:27.440
This is a space that continues to evolve.
00:00:27.440 --> 00:00:35.439
So I have asked Jameson to come back and join me on the microphone to discuss where we're at now with CMMC and what's around the corner for us.
00:00:35.439 --> 00:00:42.560
And additionally, we're joined by a guest, an expert in the CMMC space, Chris Silvers, to help with our conversation.
00:00:42.560 --> 00:00:44.000
So thank you for tuning in.
00:00:44.000 --> 00:00:46.000
And Jameson, thank you for joining us.
00:00:46.000 --> 00:00:47.600
Chris, thank you for joining us.
00:00:48.000 --> 00:00:48.479
Great to be here.
00:00:48.799 --> 00:00:58.320
Will you both do me a favor, uh, starting with you, Jameson, and just give our audience a little brief background of kind of who you are, what your role is, and your your kind of touch points with CMMC.
00:00:58.719 --> 00:00:58.960
Sure.
00:00:58.960 --> 00:01:06.719
So as you already mentioned, my name is Jameson Miller, and I uh am the IT leader of our practice leader here at Mauldin & Jenkins.
00:01:06.719 --> 00:01:09.200
I've been with our firm about 20 years now.
00:01:09.200 --> 00:01:19.920
Um spent the first half of my career as a as a CPA working on financial statement audits, and then I've spent the last half of my career uh working in the information security space.
00:01:19.920 --> 00:01:21.439
So that's all things.
00:01:21.439 --> 00:01:27.200
Uh Graham Leech Bliley Act to SOC 2 compliance and SOC 1 reporting.
00:01:27.200 --> 00:01:37.439
Um and so it was just kind of a natural fit for us to pursue this other assessment area uh that the Department of Defense has created.
00:01:37.439 --> 00:01:43.359
And so joining me today is Chris, who I've been partnering with on some CMMC assessments.
00:01:43.840 --> 00:02:02.959
And and Jameson, last time we were together, you kind of gave some background on just kind of how the CPA profession is tackling information security and kind of the playbook of just public trust and third-party, you know, independent assessments and kind of how that's being directed, you know, at the world of cybersecurity and and the like.
00:02:02.959 --> 00:02:05.040
So, you know, fantastic conversation.
00:02:05.040 --> 00:02:06.719
I look forward to continuing it here.
00:02:06.719 --> 00:02:12.240
And and Chris, will you do our audience a favor and just kind of tell a little bit about your background and your roles?
00:02:12.560 --> 00:02:13.520
Yeah, absolutely.
00:02:13.520 --> 00:02:19.039
So uh I've been in the cybersecurity industry since uh the late 90s, back in 98.
00:02:19.039 --> 00:02:23.039
Started here in Atlanta at the Federal Reserve Bank of Atlanta.
00:02:23.039 --> 00:02:28.319
Um, that's kind of where I say I cut my teeth, if you will, in cybersecurity.
00:02:28.319 --> 00:02:33.039
Um, bounced around a little bit and got into consulting back in 2008.
00:02:33.039 --> 00:02:52.080
And um, and then 2014 started my own company, kind of branched out and uh uh created CG Silver's consulting, doing penetration testing, doing a little PCI uh assessment, some Sarbanes Oxley, that kind of stuff, uh a little bit of compliance.
00:02:52.080 --> 00:02:57.599
And then early 2020, uh, I found out about this new thing called CMMC.
00:02:57.599 --> 00:03:17.759
And uh back then it was version 1.02, and uh started doing a little consulting and a little bit of uh mock assessments for some clients, and then uh was fortunate enough to start teaching uh CMMC certification courses back in October of 2021.
00:03:17.759 --> 00:03:22.960
Uh and so uh that's been really a great opportunity.
00:03:22.960 --> 00:03:26.960
I'm honored to say that I've I've taught over 2,000 students now.
00:03:26.960 --> 00:03:28.159
I stay in touch.
00:03:28.159 --> 00:03:31.599
Uh Jameson was one of my star students, obviously.
00:03:31.599 --> 00:03:35.680
And uh and yeah, it's it's been a great, great, great ecosystem.
00:03:36.000 --> 00:03:39.520
Well, Chris, we were very appreciative of you joining us for this episode.
00:03:39.520 --> 00:03:42.319
So thank you for making that the trip to join us.
00:03:42.319 --> 00:03:45.520
And that background is is just it's awesome to hear about.
00:03:45.520 --> 00:03:52.240
And and one thing I love about both of you too is that not only are you experts in this field, but also you're business leaders and business owners.
00:03:52.240 --> 00:03:54.479
So a lot of these concepts, they mean something to you too.
00:03:54.479 --> 00:04:00.879
You've been navigating these for yourselves and also, you know, know the playbook to help other organizations kind of follow best practices.
00:04:00.879 --> 00:04:06.639
Now, Chris, you mentioned that you know you first learned about the CBMC concept in 2020.
00:04:06.639 --> 00:04:15.599
You know, it does feel like from somebody who's kind of on the outskirts of it, that this is a relatively recent evolution, kind of kind of a newer thing that all of us are navigating.
00:04:15.599 --> 00:04:19.120
But the truth really seems to be this has been around for a while.
00:04:19.120 --> 00:04:27.279
So will you kind of help me start out by describing a little bit more of kind of briefly the history of CMMC, kind of where are we now?
00:04:27.279 --> 00:04:30.160
How has the history led to where we are now?
00:04:30.160 --> 00:04:33.839
And then also we'll kind of expand that into what's kind of coming around the corner.
00:04:33.839 --> 00:04:36.399
But just some background around the kind of the current environment.
00:04:36.800 --> 00:04:37.439
Oh goodness.
00:04:37.439 --> 00:04:39.600
Um, all right, buckle up, kids.
00:04:39.600 --> 00:04:55.279
Uh I'll try to just hit the just the highlights uh because believe it or not, the history of CMMC goes back to controlling or protecting controlled unclassified information.
00:04:55.279 --> 00:04:57.600
All right, it's also called CUI.
00:04:57.600 --> 00:05:08.079
And believe it or not, the what prompted the need for uh protecting CUI was 9/11.
00:05:08.079 --> 00:05:11.439
All right, so we go back to 2001.
00:05:11.439 --> 00:05:40.560
Uh based on the 9/11 tragedy, there was a report that came out, I believe it was 2004, the 9/11 Commission, and they found that if different federal agencies had shared information that was not even classified information, it was unclassified information, if they had shared that information between themselves, they could potentially have avoided the attack.
00:05:40.560 --> 00:05:43.439
Now that was really impacting, right?
00:05:43.439 --> 00:05:50.560
Um so Obama signed uh uh an executive order 13556, right?
00:05:50.560 --> 00:05:59.920
Jameson can probably quote that number as well, uh, because we cover that in our training, uh, in 2010 to create the CUI program.
00:05:59.920 --> 00:06:16.800
And so uh shortly after that, shortly, in government time, I guess, uh 2016-2017, uh a standard was uh was created called NIST Special Publication 800 171.
00:06:16.800 --> 00:06:24.160
And that is the that is the bedrock upon which CMMC is created, right?
00:06:24.160 --> 00:06:36.079
That that standard, uh that standard list of safeguards is what CMMC uh kind of audits and and makes sure that that companies are adhering to.
00:06:36.079 --> 00:06:40.720
So uh so yeah, when you say it's been a long time coming, yeah, it's been quite a while.
00:06:41.040 --> 00:06:55.519
Well, and that makes sense because, like you said, that that CUI concept, you know, as soon as we kind of opened our eyes to the importance of unclassified information that does need to have a certain level of confidentiality to it, like clearly we needed to be mindful of it and protect it in some regard.
00:06:55.519 --> 00:07:04.720
So it is interesting kind of what that journey looked like in terms of just you know the implications that could tragically occur if we're not being you know mindful of that.
00:07:04.720 --> 00:07:16.319
Um and then kind of as we've developed practices and built you know through the NIST, that 800-171 publication, um, and then now kind of expanding that further to this assessment concept through CMMC.
00:07:16.319 --> 00:07:19.439
So, Jameson, talk me a little bit more about where we're at today.
00:07:19.439 --> 00:07:21.600
What is CMMC today?
00:07:21.600 --> 00:07:26.079
And what kind of, I guess, phase would you say we're in with respect to CMMC?
00:07:26.399 --> 00:07:26.560
Yeah.
00:07:26.560 --> 00:07:32.240
So according to the Department of Defense, uh they would say that we're in phase one right now of the CMMC.
00:07:32.240 --> 00:07:36.079
So that essentially means that the CMMC is in full rollout.
00:07:36.079 --> 00:08:14.160
Organizations that are seeking assess uh certifications or assessments are uh partnering with C 3 PAOs or certified third-party assessor or C 3 PAO to start either mock assessments or full assessments uh with the intention to be ready by the rollout of phase two, which is coming this November 2026, where at that point that's when uh organizations that are signing defense contracts will be required to have a level two certification in order to uh uh to be in compliance with that contract.
00:08:14.160 --> 00:08:23.759
Uh now technically though, when we start talking about this, this is not anything new that these companies should have been doing.
00:08:23.759 --> 00:08:29.199
As Chris mentioned, NIST 800-171 has been around for quite some time.
00:08:29.199 --> 00:08:39.600
And actually under the DFARS, the defense federal acquisition regulations, they are required to have been implementing NIST 800-171 all along.
00:08:39.600 --> 00:08:50.480
Um but this is a new, you know, third-party assessment that verifies, you know, organizations can no longer self-assess themselves and say, yeah, we're meeting all these requirements.
00:08:51.039 --> 00:09:01.120
So, Chris, you know, looking ahead, kind of what Jameson is describing, I guess, what does that environment look like in terms of who is this really going to apply and you know, kind of what do people need to prepare for?
00:09:01.519 --> 00:09:01.759
Yeah.
00:09:01.759 --> 00:09:17.919
So uh the DOD estimates that there are uh around 80,000 companies, 80,000 contractors, and realize that this the reason that number is so large is because it's not just prime contractors.
00:09:17.919 --> 00:09:18.480
All right.
00:09:18.480 --> 00:09:32.960
There's a there's a misunderstanding out in the marketplace, I think, that that suppliers who are subcontractors don't think that they're covered under this compliancy, um, when in fact they are.
00:09:32.960 --> 00:09:52.960
There's a there's a thing called the flow down rule, and it's just that's just a kind of colloquialism, but it's but it's actually written into these laws, these defense uh federal acquisition regulation supplements to force prime contractors to flow down these requirements to all their subcontractors.
00:09:52.960 --> 00:10:05.360
And when they flow down the requirements, they're also flowing down the flow down so that a subcontractor has to flow down those requirements to their supplier.
00:10:05.360 --> 00:10:09.120
So it goes all the way down through the defense industrial base.
00:10:09.120 --> 00:10:19.039
So you've got 80,000 companies out there, some of them mom and pop shops, like right, like my own company, just a small family business, right?
00:10:19.039 --> 00:10:25.600
And uh so uh so we've got those 80,000 companies out there.
00:10:25.600 --> 00:10:38.159
And to date, uh the last number I saw was less than 800 of these companies have actually gotten certified, have gone through the certification assessment process and everything.
00:10:38.159 --> 00:10:45.759
So uh, you know, that's that's one percent of the 80,000 have actually been assessed.
00:10:46.159 --> 00:10:47.679
So I want to sit on those numbers for a minute.
00:10:47.679 --> 00:10:53.840
So 80,000 is the estimate for who's gonna need to have this process applied to them.
00:10:53.840 --> 00:10:59.519
That they're going to need to be compliant with this process and therefore show some kind of you know different levels of compliant.
00:11:00.080 --> 00:11:02.639
And actually, let me let me let me clarify that.
00:11:02.639 --> 00:11:09.279
80,000 are going to need to be certified by a third-party assessment organization.
00:11:09.279 --> 00:11:12.720
So that's not even self-self-assessment.
00:11:12.720 --> 00:11:18.799
There's another uh estimated 120,000 that would that would need to do self-assessment.
00:11:19.200 --> 00:11:21.279
So 80,000 is those who need to be assessed.
00:11:21.279 --> 00:11:25.440
And what was the count estimated of who has currently gone through this process?
00:11:25.759 --> 00:11:26.799
It's less than 800.
00:11:26.799 --> 00:11:30.480
I think it was 773, is what the number that's sticking in my mind.
00:11:30.639 --> 00:11:30.720
Yeah.
00:11:30.960 --> 00:11:38.639
So I so I guess question to both of you what's leading to that gap in terms of well, well, I guess, you know, it's not required yet.
00:11:38.639 --> 00:11:40.639
It's just coming around the corner.
00:11:40.639 --> 00:11:41.440
Is that right?
00:11:41.919 --> 00:11:48.480
Well, it's the the way that the DOD is rolling this out is that it shows up in a contract, right?
00:11:48.480 --> 00:11:58.159
Um when you receive a contract from the government or when you are when you receive a solicitation for a bid, right?
00:11:58.159 --> 00:12:06.080
They uh the government will uh give you a list of requirements for the bid.
00:12:06.080 --> 00:12:13.840
You know, we need a coffee cup made, and it needs to be three inches in diameter, and you know, the all the specifications.
00:12:13.840 --> 00:12:19.519
But in addition to that, they specify what regulations you have to meet.
00:12:19.519 --> 00:12:25.519
And it's and it's usually a list of like two or three hundred regulations.
00:12:25.519 --> 00:12:43.200
There, you have the federal acquisition regulations that all government agencies have to uh comply to, and then you have these defense federal acquisition regulations supplements that supplement those those acquisition regulations.
00:12:43.200 --> 00:12:46.320
And there can be hundreds of those.
00:12:46.320 --> 00:13:03.679
So the way that the DOD implemented CMMC is that they're including a new supplement, and it's it's actually 252.204-7021 or 7021 as we we commonly refer to it.
00:13:03.679 --> 00:13:06.000
So that will show up in the contract.
00:13:06.000 --> 00:13:18.320
And so essentially, if you are bidding on that contract, you have to adhere to that that those requirements by the time the DOD awards the contract.
00:13:18.320 --> 00:13:19.039
Okay?
00:13:19.039 --> 00:13:28.879
So you'll get basically about a 60 to 90 day heads up that this contract requires CMMC certification.
00:13:28.879 --> 00:13:33.039
And and then you'll have 90 days to be compliant.
00:13:33.039 --> 00:13:38.080
If you're not, then the DOD cannot award you that contract.
00:13:38.080 --> 00:13:50.240
So they'll go to the next bidder who you know maybe had the next, you know, uh more expensive price or whatever reason and say, okay, are you compliant?
00:13:50.240 --> 00:13:52.799
You're compliant, congratulations, you win the bid.
00:13:53.120 --> 00:13:56.559
And and Jameson, you mentioned that we're in like a phase one right now.
00:13:56.559 --> 00:13:58.960
So I guess phase two is that one that's around the corner.
00:13:58.960 --> 00:14:02.799
So tell me a little bit more about kind of what that transition to phase two looks like.
00:14:03.200 --> 00:14:11.919
Yeah, so like I said, in phase two, that's when the uh DOD is going to then start writing those into the contracts.
00:14:11.919 --> 00:14:19.360
And so uh, you know, if you have an existing contract that's playing out, you might not have to immediately comply.
00:14:19.360 --> 00:14:26.960
But the next time that contract re-ups, you better believe it, it's gonna be in there because they want everybody doing this.
00:14:26.960 --> 00:14:31.440
And uh this is just gonna be a business requirement moving forward.
00:14:31.440 --> 00:14:34.639
It's not an option, it's not voluntary.
00:14:34.639 --> 00:14:38.480
Um, if you want to play in this space, this is what you have to do.
00:14:38.799 --> 00:15:02.480
And and I imagine that the expertise you all have to be assessors, and Jameson, we covered this a little bit in our previous episode, but just the the efforts it takes to get certified and the lift you have to navigate in order to be an assessor firm for the uh the rest of the 80,000 who are going to need this, who are not of the around 800 who've already had it done, they're going to be having to navigate this.
00:15:02.480 --> 00:15:04.559
Like you said, it's going to be in their contracts.
00:15:04.559 --> 00:15:10.960
So I guess do you have any advice for the business leaders in terms of like they need to probably get started on this, right?
00:15:11.200 --> 00:15:20.080
And and again, you know, they need to be starting right away because the assessment process is not uh something to be taken lightly.
00:15:20.080 --> 00:15:21.600
It's very rigorous.
00:15:21.600 --> 00:15:26.559
Um the documentation requirements are are very onerous.
00:15:26.559 --> 00:15:42.960
And if you think that you're gonna be able to close that gap in 60 days when you're notified of a contract, you're you're not gonna have the time that it's gonna take uh to get your environment ready and assessed uh within that 60-day time frame.
00:15:42.960 --> 00:15:51.759
And and as you mentioned, just the sheer numbers, uh I'd be interested, Chris, in that you know, 773 uh organizations.
00:15:51.759 --> 00:15:56.799
How many of those were organizations that are C 3 PAOs getting their level two assessment?
00:15:57.120 --> 00:15:59.039
Because No, that's that's OSCs.
00:15:59.039 --> 00:16:02.000
That's that that's organizations seeking compliance.
00:16:02.000 --> 00:16:17.120
It's it's not counting the the what uh 97 uh C 3 PAOs who who are certified or actually uh I shouldn't say certified, um authorized is the term.
00:16:17.519 --> 00:16:23.039
So our process as an example is a firm to get up to speed to be able to help with a service would not count toward that number.
00:16:23.759 --> 00:16:24.480
Correct.
00:16:24.480 --> 00:16:36.639
Um but you know, also I think it should be you should be aware that these organizations that are becoming a third-party assessor, they have to practice what they're preaching uh essentially.
00:16:36.639 --> 00:16:46.320
So we have to be level two certified before we're able to certify other companies as a certified third party assessor.
00:16:46.320 --> 00:16:59.840
And so again, that is I think another reason why you probably see some of these lower numbers uh because there are you know several organizations that are ramping up to become a third-party assessor, but it is difficult.
00:16:59.840 --> 00:17:00.559
It's not easy.
00:17:00.559 --> 00:17:11.200
There's a lot of training I've had to go through to become a lead CCA, and you need at least three of those on your team to make uh a C3PAO function independently on its own.
00:17:11.279 --> 00:17:22.400
So as a business leader who you know is is overseeing a company that has CUI and that has contracts, you know, with the defense industrial base.
00:17:22.400 --> 00:17:33.440
So I need to start thinking about the schedule of how am I going to be navigating the process of getting ready to be certification ready almost and actually getting the certification done.
00:17:33.440 --> 00:17:40.400
And it sounds like I probably need to be doing that planning sooner sooner rather than later, because there's gonna be a a lot of my peers will be seeking that out, Stan.
00:17:40.640 --> 00:17:55.279
Well, to be to be honest, the what I what I tell clients the first step really needs to be is you need to make a decision, a business decision on whether you want to continue in the defense industrial base or not.
00:17:55.279 --> 00:17:57.839
That's the that's decision one.
00:17:57.839 --> 00:18:07.200
And uh we we've had several clients that uh we performed mock assessments on in 2020, right?
00:18:07.200 --> 00:18:13.680
Because there when word got out, there was there was kind of a rush in early 2020 to, you know, what is this?
00:18:13.680 --> 00:18:18.720
I need GAP assessment, I need to figure out, you know, what I need to do to get compliant.
00:18:18.720 --> 00:18:28.319
And I had several clients come back to me after doing the GAP assessment and told me, we've decided we're not doing any more business with the DOD.
00:18:28.319 --> 00:18:31.920
And that's a valid, that's a valid business decision, right?
00:18:31.920 --> 00:18:42.799
For them, it represented like 5% of their business, and the cost to become compliant was more than what they were benefiting from those government contracts.
00:18:42.799 --> 00:18:47.680
So I I feel like that's that's really the first thing that needs to happen.
00:18:47.680 --> 00:18:56.720
And then the next thing is figure out how are you going to uh how are you going to get compliant.
00:18:56.720 --> 00:19:06.799
And uh because compliance itself, like getting compliant is actually more expensive and takes more time than getting assessed.
00:19:06.799 --> 00:19:14.799
You know, we talk about you know lead times for getting assessed, and the the process itself takes, you know, two months.
00:19:14.799 --> 00:19:22.079
And leading up to that, we like to reserve two months to make sure that the company is ready, right?
00:19:22.079 --> 00:19:28.000
We we go through, we're going through that right now of making sure that they're ready to be assessed.
00:19:28.000 --> 00:19:31.839
But before all that happens, you've got to get compliant.
00:19:31.839 --> 00:19:34.799
And that can take 12 to 18 months.
00:19:34.799 --> 00:19:38.720
So, you know, you it it is a it's a big deal.
00:19:38.720 --> 00:19:52.960
So there are to me, uh a lot of small companies, the better play for them may be to seek acquisition by a company who is on this path already.
00:19:53.359 --> 00:20:09.039
And and Jameson, that this my my mind goes to, you know, system and organization control audits, SOC audits, SOC 1, SOC 2, you know, talking about this having to meet control objectives and having an independent assessor come in and give some type of an opinion or conclusion or authorization, whatever the case might be.
00:20:09.039 --> 00:20:17.359
So will you just kind of talk me through what are some of the similarities and what are some of the differences between a SOC audit and this CMMC assessment?
00:20:17.839 --> 00:20:18.160
Sure.
00:20:18.160 --> 00:20:31.039
So uh I I think when you want to talk about SOC SOC audits and SOC examinations, the one that that mirrors most closely to the CMMC is gonna be the SOC two versus the SOC 1.
00:20:31.039 --> 00:20:42.000
But the the there are differences where a SOC 2 is gonna be more focused on the security of the organization, how they're maintaining confidentiality or privacy.
00:20:42.000 --> 00:20:46.079
Uh it's not about protecting controlled unclassified information.
00:20:46.079 --> 00:20:48.960
That's what the CMMC assessment is about.
00:20:48.960 --> 00:20:55.599
The other part that kind of sets the two uh assessments uh apart from another.
00:20:55.599 --> 00:21:20.079
Uh in a SOC 2, if you have a qualified opinion, meaning you had so many exceptions in your report that one or more control objectives couldn't couldn't be met, then you get a section five in your report and you get to talk about, well, here's why this uh exception happened and here's what we are gonna do about it in the future, so on and so forth, and you issue that report.
00:21:20.079 --> 00:21:29.440
A third party that's using your services looks at that report, they assess how that impacts their environment, and you don't necessarily lose your contract with that user.
00:21:29.440 --> 00:21:32.720
The CMMC doesn't work that way.
00:21:32.720 --> 00:21:44.400
If if you're going through an assessment and you fail certain aspects, I know we won't get in the weeds with you know the nuances, but if you fail so many of the requirements, then you fail the assessment.
00:21:44.400 --> 00:21:47.440
If you fail the assessment, you don't get the contract.
00:21:47.440 --> 00:21:51.440
So that's the biggest difference that I see between the two assessments.
00:21:51.440 --> 00:21:54.400
Um they're both very rigorous examinations.
00:21:54.799 --> 00:22:04.000
Yeah, that that makes sense because it you know, a a a stop two are like you're saying that you know that section five, that talk through what the findings were and the management has an opportunity to respond to them.
00:22:04.000 --> 00:22:07.440
You know, we're not quite sure how a customer might respond to that.
00:22:07.440 --> 00:22:09.759
You know, it might not put your contract at risk.
00:22:09.759 --> 00:22:17.440
Whereas this case, like our customer per se is the DOD, and they're going to have an opinion on those failures to a certain degree, like you're describing.
00:22:17.440 --> 00:22:18.240
Interesting.
00:22:18.240 --> 00:22:23.039
Well, I guess tell me a little bit about like what does write look like from a CMMC perspective.
00:22:23.039 --> 00:22:32.160
You know, what what what does a company's operations or posture look like to help them have, you know, navigate a successful assessment process?
00:22:32.640 --> 00:22:52.160
Well, I think the the biggest point kind of goes back to uh one of Chris's earlier earlier points, which is they need the the at the top management or the owners or the board, whoever it is that's charged with governance of that organization has to make a business decision.
00:22:52.160 --> 00:22:55.359
Are we going to continue to stay in this space?
00:22:55.359 --> 00:23:05.440
And if that is the case, then right looks like um making sure that you are ready to meet this assessment process.
00:23:05.440 --> 00:23:12.079
That goes with getting started right away with mock assessments if you don't think you're ready.
00:23:12.079 --> 00:23:24.480
Um starting to get with those registered practitioner organizations or RPOs, those are people that have been qualified under the Cyber A B, which is a the um accreditation.
00:23:24.480 --> 00:23:28.640
Accreditation accreditating body for the for the for the CMMC.
00:23:28.640 --> 00:23:41.839
So those organizations have been uh have gone through some uh rigorous training uh to to consult in this space and help get organizations ready for those assessments.
00:23:41.839 --> 00:23:46.640
Uh but those RPOs are not certified third-party assessors necessarily.
00:23:46.640 --> 00:23:48.720
Some are, some aren't.
00:23:48.720 --> 00:23:55.200
Um but you you then would have to have the third-party assessment completed by the the C3PAO.
00:23:55.599 --> 00:23:55.759
Right.
00:23:55.759 --> 00:24:00.240
And and if I can tack on to that, um you bring up a great point, Jameson.
00:24:00.240 --> 00:24:05.200
There's and and this is something that has borne out over the last year of doing assessments.
00:24:05.200 --> 00:24:08.720
I think we've done now 11, 12 assessments.
00:24:08.720 --> 00:24:24.400
And you can tell the difference between companies who are who have been focusing on compliance and the ones who have not only focused on compliance, but focused on becoming ready for an assessment.
00:24:24.400 --> 00:24:26.720
So it's two different things, right?
00:24:26.720 --> 00:24:29.839
It it's, you know, everybody needs to be compliant.
00:24:29.839 --> 00:24:40.079
They need to, you know, implement the practices and in such a way that that controls are consistent and reliable and all those things.
00:24:40.079 --> 00:24:47.119
But uh but they also need to be ready for an assessor to come in and ask questions.
00:24:47.119 --> 00:25:01.920
They need to have uh you know their evidence organized in such a way that it's easy to present to an assessor so that it presents their security program in the best light, right?
00:25:01.920 --> 00:25:06.480
They need to prep the individuals who are going to be interviewed, right?
00:25:06.480 --> 00:25:14.000
How many times have you been on an interview when you ask someone what time it is and they tell you how to build a watch?
00:25:14.000 --> 00:25:14.880
Right?
00:25:14.880 --> 00:25:16.319
Yeah.
00:25:16.319 --> 00:25:19.759
And you know, people get themselves in trouble that way.
00:25:19.759 --> 00:25:34.000
You know, the the more you talk, the more the assessor is hearing, well, wait a minute, I don't think this control works the way your documentation says based on what you just told me, even though I didn't ask you that particular question.
00:25:34.400 --> 00:25:46.319
So so obviously we need to have the controls that help us meet our objectives, but we also need to be able to demonstrate we have the controls and they are functioning properly.
00:25:46.799 --> 00:25:57.920
And it needs to be documented in a manner in which it makes it easy for an assessor to close those gaps and you know look at the proper artifacts for each requirement.
00:25:58.240 --> 00:25:59.599
Well, do y'all have any advice for that?
00:25:59.599 --> 00:26:03.119
Like I'm thinking, you know, maybe like continuous processes that can help some.
00:26:03.119 --> 00:26:07.440
I guess just baking into our SOPs, you know, creating artifacts and the like.
00:26:07.440 --> 00:26:13.680
Like, do you have any just practical advice for our listeners in terms of how they can help with the demonstration and prepare themselves for an assessor?
00:26:14.000 --> 00:26:14.480
Absolutely.
00:26:14.480 --> 00:26:26.319
Number one, engage with a consultant who uh is knowledgeable, who has the requisite certifications, uh, especially, you know, the more the better.
00:26:26.319 --> 00:26:32.720
If you if you're working with a consultant who is also a C3 PAO as a business, that's great.
00:26:32.720 --> 00:26:45.279
Uh the individuals that you're working with, if they if they are uh CMMC certified assessors and CMMC certified professionals, um, you know, the more the merrier.
00:26:45.279 --> 00:26:48.799
Um and then and then practice, right?
00:26:48.799 --> 00:26:52.880
Um do practice runs of assessments.
00:26:52.880 --> 00:27:10.720
And while you're doing, you know, when the assessor says, can you show me this setting within you know this configuration setting, uh go through the process of creating, you know, doing that demonstration and at the end take a screenshot.
00:27:10.720 --> 00:27:21.039
And then as long as the same person who created the screenshot is the one who's gonna get interviewed in the assessment, uh, they've already done it once.
00:27:21.039 --> 00:27:26.079
So that when it comes time, when it comes show time, they're not nervous.
00:27:26.079 --> 00:27:34.960
They, you know, they know what requirement assessment objective was was demanded that screenshot and they remember what they did.
00:27:34.960 --> 00:27:38.480
So when the assessor says, Can you show me that setting?
00:27:38.480 --> 00:27:40.400
they just do it once again.
00:27:40.400 --> 00:27:50.400
And from an assessor standpoint, it really, you know, even if we know that they were coached, subconsciously, it makes us feel confident.
00:27:50.400 --> 00:27:55.119
It makes us feel like they know what they're doing and they have implemented the practice.
00:27:55.119 --> 00:27:55.680
Right?
00:27:55.680 --> 00:27:56.799
It's very important.
00:27:56.799 --> 00:27:59.599
Got to remember assessors are people too, right?
00:27:59.839 --> 00:28:00.720
That's exactly right.
00:28:00.720 --> 00:28:02.720
And Jameson, same question to you.
00:28:02.720 --> 00:28:08.880
Any considerations in terms of advice to folks to help posture themselves for a successful assessment?
00:28:09.200 --> 00:28:18.559
You know, but from my perspective, I think the the more documentation you can provide in your system security plan, that's always super helpful for an assessor.
00:28:18.559 --> 00:28:25.119
Um, and then also including your own internal security control assessment is part of your artifacts.
00:28:25.119 --> 00:28:42.319
That can also help uh because a lot of times we we like to look at that to see what kind of artifacts that you were looking at to determine your compliance, and then make sure, okay, well, is that same evidence going to be uh adequate and sufficient to meet this requirement, you know, for our needs on our side.
00:28:42.319 --> 00:28:46.160
So I definitely think the more you do there, uh, the better.
00:28:46.160 --> 00:28:49.359
I think the more, you know, depending on your environment too.
00:28:49.359 --> 00:28:55.519
So this, you know, also is heavily contingent on what kind of environment.
00:28:55.519 --> 00:28:57.440
Are you a manufacturing facility?
00:28:57.440 --> 00:29:03.599
You know, you might have more challenges than somebody that's operating just a secure enclave with a few people in it.
00:29:03.599 --> 00:29:30.400
And so um, you know, if you're in that secure enclave environment, the more configuration um information that you can give me with how certain assets within the environment are set up, uh the easier it is for me to go through and determine, yes, they they are practicing what they're preaching, they're doing what they're saying they're doing in their system security plan, uh, the quicker I can get through the assessment, the fewer demonstrations we have to go through.
00:29:30.400 --> 00:29:35.200
Um so it just saves everybody time by being that organized.
00:29:35.200 --> 00:29:54.559
Um and then it just keeps us from asking, kind of like Chris said, keeps us from asking more questions and then getting somebody into that, you know, rambling on and on and on, and then just well, well, actually, so and so uses this jump drive to take this uh controlled unclassified information over.
00:29:54.559 --> 00:29:56.240
It's like, whoa, what did you just say?
00:29:56.240 --> 00:29:59.519
Like that's that just blew this whole assessment up, you know.
00:29:59.519 --> 00:30:05.200
So uh making sure that people aren't gonna blunder something, you know, quite like that.
00:30:05.200 --> 00:30:11.359
But at the same time, we're not asking for people to be coached on misleading the assessors.
00:30:11.359 --> 00:30:13.440
Um, that's not what we're encouraging.
00:30:13.440 --> 00:30:17.920
We're just encouraging people to be coached up on how to get to those artifacts.
00:30:17.920 --> 00:30:22.559
Because again, I don't know, like we sit in a lot of these walkthroughs and demonstrations.
00:30:22.559 --> 00:30:32.640
There's nothing kind of more frustrating than sitting on a demonstration for 15 minutes watching somebody fumble through, you know, their Microsoft Azure environment trying to find certain settings.
00:30:32.960 --> 00:30:34.240
Great advice from both of you.
00:30:34.240 --> 00:30:40.720
I think all of us business leaders can kind of take those and put them into action in terms of how we're developing our policies.
00:30:40.720 --> 00:30:50.240
We're gonna actually practice what we preach, do what we say, you know, live by it, like you were saying, Jameson, in terms of our policies are actually representative of our procedures.
00:30:50.240 --> 00:31:12.480
And then additionally, importantly, preparing our people, making sure that we can navigate like you were describing, Chris, in terms of just, you know, being coached in the ways that make sense to coach our folks, just so that we can successfully and accurately demonstrate what we are doing as a business and what our controls are and how we are documenting satisfaction of those controls.
00:31:12.480 --> 00:31:34.240
So great, great advice from both of you, but I'm also curious about maybe some misses, you know, maybe something from y'all's experience of navigating either side of the coin in terms of whether you've been consulting with companies to help them prepare and be assessment ready, or whether you've actually been navigating an assessment, you know, uh with a company.
00:31:34.240 --> 00:31:37.599
Just what are some things you've seen where maybe something's gone a little sideways?
00:31:37.599 --> 00:31:39.119
So Chris, you first.
00:31:39.519 --> 00:31:39.839
Okay.
00:31:39.839 --> 00:31:47.839
Well, uh from an assessment perspective, I think, well, actually, I I do have a good consulting one.
00:31:47.839 --> 00:31:51.680
Um I was doing a mock assessment back in 2020, right?
00:31:51.680 --> 00:32:05.119
So it's been quite a while, uh, where they had great policies and they had a policy that administrators, uh, when they log into the system, they have to use multi-factor authentication.
00:32:05.119 --> 00:32:05.519
Okay.
00:32:05.519 --> 00:32:18.720
This is a this is one of those requirements that it's it's so easy to say it, and it's so easy to understand it, and of course, a bit difficult to implement, right?
00:32:18.720 --> 00:32:26.720
But uh nobody really questions the need for multi-factor authentication in today's world and and all that.
00:32:26.720 --> 00:32:37.119
So uh I'm with the client, we're sitting in a conference room, and he's showing me up on the screen uh the authentication mechanism.
00:32:37.119 --> 00:32:38.720
And I say, okay, great.
00:32:38.720 --> 00:32:41.680
So show me the administrators.
00:32:41.680 --> 00:32:47.200
And you know, his policy said, you know, sure enough, all administrators have to use MFA.
00:32:47.200 --> 00:32:51.039
So uh I said, okay, show me the administrators now.
00:32:51.039 --> 00:32:54.960
Uh show me, you know, where it says that they have to use MFA.
00:32:54.960 --> 00:32:58.000
And he's showing me a list of about six or seven administrators.
00:32:58.000 --> 00:33:02.640
I noticed that two of them, it says no MFA required.
00:33:02.640 --> 00:33:07.440
I'm like, uh, are you sure we're at the right place?
00:33:07.440 --> 00:33:10.400
I mean, what you know, I'm just trying to throw him a bone, right?
00:33:10.400 --> 00:33:14.160
And he just kind of looks at me and he says, I'll be back in five minutes.
00:33:14.160 --> 00:33:17.039
So, you know, very important.
00:33:17.039 --> 00:33:19.759
Uh again, goes back to that coaching.
00:33:19.759 --> 00:33:28.559
Make sure that uh whatever you have implemented is still implemented when the assessor shows up, right?
00:33:28.559 --> 00:33:29.599
It's very embarrassing.
00:33:29.599 --> 00:33:34.720
Apparently, there were a couple administrators who were troubleshooting something and they had turned that off.
00:33:34.720 --> 00:33:40.079
Well, you know, during the assessment's not a good time to turn off uh security controls, right?
00:33:40.079 --> 00:33:42.160
Maybe never a good time to turn off security controls.
00:33:42.160 --> 00:33:50.720
Never is a good time, but but still, uh yeah, it it all comes down to you know, make sure you're doing what you say you're doing.
00:33:51.039 --> 00:33:51.599
Yeah, exactly.
00:33:51.599 --> 00:33:54.240
No, that's a great example because I agree, Jameson.
00:33:54.240 --> 00:33:56.720
It's probably never a good time to turn off security controls.
00:33:56.720 --> 00:34:09.360
But but yeah, Chris, and I feel like that's something where this process, you know, is really valuable just to kind of keep all this top of mind for us, too, that you know, we created that MFA policy for a reason, you know, and we first enabled it for a reason.
00:34:09.360 --> 00:34:16.159
And it's probably good for us to go through even just internally and check that it's there, especially if we know an assessor is going to be coming in soon.
00:34:16.480 --> 00:34:17.119
Yeah, absolutely.
00:34:17.119 --> 00:34:21.440
And I and I wanted to mention one other thing about uh interviews as well.
00:34:21.440 --> 00:34:34.159
Uh most of the time when we are performing interviews and and we're having demonstrations done, we need to take uh a little bit of time to document what we're seeing, right?
00:34:34.159 --> 00:34:39.199
Because we we don't just sit down at night and replay the day and do all our documentation.
00:34:39.199 --> 00:34:40.960
I mean, that there's no way to do that.
00:34:40.960 --> 00:34:43.519
There's just too many questions that you've asked.
00:34:43.519 --> 00:34:49.840
So it's very common that there's going to be a good 15 to 30 seconds of silence.
00:34:49.840 --> 00:34:53.760
Learn to get comfortable with the silence.
00:34:53.760 --> 00:34:55.360
Embrace the silence.
00:34:55.360 --> 00:35:13.199
Because as a person who is being interviewed and uh and assessed, and I've been in that seat, I've been in that hot seat, it is so hard to just sit and let the silence linger while the assessor is typing up his notes, right?
00:35:13.199 --> 00:35:16.239
It's it is difficult, but you need to learn to do it.
00:35:16.639 --> 00:35:16.880
Right.
00:35:16.880 --> 00:35:24.639
Not just as this assessor is digesting what my response was and updating their notes related to my response.
00:35:24.639 --> 00:35:31.440
I don't need to just fill that silence by telling the assessor even more way beyond exactly relevant to the scope of what they're navigating.
00:35:31.440 --> 00:35:33.199
That's fantastic advice.
00:35:33.199 --> 00:35:35.280
Uh Jameson, same question to you.
00:35:35.280 --> 00:35:38.960
And any anything you've now encountered where things went a little bit sideways.
00:35:39.360 --> 00:35:41.039
Well, it didn't really go sideways.
00:35:41.039 --> 00:35:51.679
Uh I guess the closest thing that I've come across in an assessment, we we kind of had a near-miss, but this was uh it wasn't a that major uh or that big of a deal.
00:35:51.679 --> 00:36:05.519
Uh so essentially uh one of the organizations I was working with, uh the Department of Defense, by the way, is they're very um uh they place a high priority on logging.
00:36:05.519 --> 00:36:18.239
So if something happens, they want to make sure that adequate amount of information has been retained for an appropriate time period to investigate what occurred.
00:36:18.239 --> 00:36:27.440
So on this particular assessment, um a lot of this organization's network traffic was running through a particular network device.
00:36:27.440 --> 00:36:34.480
And they said in their system security plan that that network device was was maintaining logs for 90 days.
00:36:34.480 --> 00:36:47.119
And when we came to doing the demonstration, uh it was one of those situations where I don't think they were actually prepared for me to ask, well, show me where it's keeping maintaining logs for 90 days.
00:36:47.119 --> 00:37:01.760
Um and so they kind of fumbled around for a bit, uh, had to actually go back and say, well, we'll have to we'll reshow you this demonstration because we think that actually the logs are being sent to this other system, this other seam, and that's where they're maintained.
00:37:01.760 --> 00:37:04.800
I'm like, well, that's not what your SSP says.
00:37:04.800 --> 00:37:12.880
And so uh, you know, the other thing is when you're doing the assessment, you're not really allowed to do any kind of consulting.
00:37:12.880 --> 00:37:21.679
And so when you point things out like this, you kind of have to be careful how you phrase things because you can't just be like, well, just update your SSP.
00:37:21.679 --> 00:37:30.320
To, you know, you have to you have to make them kind of, oh yeah, we need to update our SSP.
00:37:30.320 --> 00:37:34.239
We'll be we'll be right back, you know, and and we'll give you an updated version.
00:37:34.239 --> 00:37:44.639
And so uh that's the kind of the closest thing that that I've run across uh in terms of uh uh and that that would have been poammable though, even if they would have failed it.
00:37:44.719 --> 00:37:56.480
Um so that that is a good point in terms of you know we we have a really good written policy and then we have a really good procedure, but they're different.
00:37:56.480 --> 00:37:58.159
Yeah, they just don't match.
00:37:58.159 --> 00:37:59.360
They just don't match.
00:37:59.360 --> 00:38:08.559
So we need to ensure that we have alignment because there's a degree where that's relevant to the assessment of the assessment be like, that is a good practice, but that's not what you say you do, and that's a problem.
00:38:08.559 --> 00:38:10.480
Now, what's that word you just threw out?
00:38:10.480 --> 00:38:10.719
Po.
00:38:11.280 --> 00:38:11.599
POAM?
00:38:11.599 --> 00:38:12.559
Poeammable, yeah.
00:38:12.559 --> 00:38:13.440
So poammable.
00:38:13.440 --> 00:38:14.559
What's poamable?
00:38:14.559 --> 00:38:17.360
So essentially it's a made-up word.
00:38:17.360 --> 00:38:27.920
Yeah, it's it it is a made-up word, uh, I guess used in the uh industry, but uh it stands for POAM or uh plan of action and milestone.
00:38:27.920 --> 00:38:37.119
So essentially if you have uh an exception or you're not meeting a requirement, it goes on your schedule, your plan of action and milestone schedule POAM.
00:38:37.119 --> 00:38:41.760
Uh you have uh a certain period of time to correct those.
00:38:41.760 --> 00:38:46.719
Uh now when you're going through an assessment, this is kind of getting down in the weeds.
00:38:46.719 --> 00:38:52.559
But if you get if you have too many of those, or there's certain requirements that are just you can't POAM.
00:38:52.559 --> 00:38:57.440
Um so if you fail one of those, that's an automatic failure of the assessment.
00:38:57.440 --> 00:38:59.679
There is no fixing it.
00:39:00.159 --> 00:39:04.239
So there are some some comparisons to like a cap, a corrective corrective action plan.
00:39:04.800 --> 00:39:05.199
Absolutely.
00:39:05.199 --> 00:39:07.280
That's essentially the same kind of thing.
00:39:07.280 --> 00:39:19.519
So like if you're familiar with high trust, uh where they have this corrective action plans, and you have to have an external assessor come back out six months later and reassess those those uh corrective action plans.
00:39:19.519 --> 00:39:21.679
POAM works the same way.
00:39:21.679 --> 00:39:36.880
An OSC would have to have a uh if they did achieve the certification on the front end, they would have six months to correct those POAMs and have uh a C3PAO come in and reassess those requirements.
00:39:36.880 --> 00:39:40.559
Doesn't have to be the same C3PAO that they worked with originally.
00:39:40.559 --> 00:39:42.320
It could be a different one.
00:39:42.320 --> 00:39:45.599
Um it could be the same one though, presumably.
00:39:45.760 --> 00:39:49.119
So well, this conversation has been so helpful.
00:39:49.119 --> 00:40:00.000
I recognize now just the the magnitude of what we're navigating in terms of how many different companies in the supply chain of the defense ecosystem this is gonna start applying to.
00:40:00.000 --> 00:40:09.679
And so some real critical business decisions they need to make in terms of does this strategically make sense for them to continue to operate within this world?
00:40:09.679 --> 00:40:33.039
And if yes, they need to start acting now, if they haven't already, in terms of preparing for an assessment, recognizing the next contract and where they get is gonna have some additional language in it, identifying their gaps, and then when it comes time for an actual assessment, you know, making sure that they have in place the processes, procedures, and training to come out on the other side with the successful assessment.
00:40:33.039 --> 00:40:40.719
Um and also we discussed some pitfalls that you know we we've seen in the real world in terms of kind of what we can avoid for ourselves.
00:40:40.719 --> 00:40:43.519
Um, I guess I'm gonna ask one last question to both of you, Jameson.
00:40:43.519 --> 00:40:47.519
I'll start with you and then end with you, Chris, in terms of kind of just your final takeaway for our listeners.
00:40:47.519 --> 00:40:54.639
Just kind of that one final piece of advice that you had for them, just as they're preparing for or navigating this CMMC environment.
00:40:54.639 --> 00:40:57.440
So, Jameson, what's your what's your last takeaway for our listeners?
00:40:57.840 --> 00:40:58.079
Sure.
00:40:58.079 --> 00:41:11.199
So uh maybe a couple of things, but uh the first, starting with uh whoever is gonna be in your organization leading the charge for the certification, in my opinion, this is not a requirement, but just this is my opinion.
00:41:11.199 --> 00:41:16.320
I think it would be helpful for them to go through the CCP and maybe even the CCA course.
00:41:16.320 --> 00:41:27.840
Uh that way they are familiar with what the assessors are gonna be looking at, what the assessors are gonna be doing, and that will give them a better understanding of the requirements also.
00:41:27.840 --> 00:41:34.000
Um they don't necessarily need to go take the examinations, but I do think it would help for them to go through that training.
00:41:34.000 --> 00:41:42.800
There's one-week courses, um, so that would that would help educate somebody internally, uh, and they're not too expensive.
00:41:42.800 --> 00:41:47.599
So we're not talking about, you know, tens of thousands of dollars of training here.
00:41:47.599 --> 00:41:53.599
Uh the second thing I would close with is just scoping is so important in your environment.
00:41:53.599 --> 00:42:08.639
So if you can't figure out or get your head, your hands or your head wrapped around everywhere you have controlled unclassified information in your environment and you don't understand all the scope of the assets you have in your environment, then you can't protect them all.
00:42:08.639 --> 00:42:23.360
And you can't under- So if you're having difficulties navigating that, then you need to find a partner that can help you navigate that and organize this stuff in a manner uh to get you over that hump quicker.
00:42:23.360 --> 00:42:25.519
Um so that would be my biggest takeaways.
00:42:25.760 --> 00:42:29.199
Well, I've heard you say before, Jameson, you can't protect what you don't know you have.
00:42:29.599 --> 00:42:30.000
That's right.
00:42:30.000 --> 00:42:30.320
Yeah.
00:42:30.320 --> 00:42:50.639
So if you don't know you have it, or you don't know that, you know, the example I gave earlier of, you know, somebody takes a jump drive and moves it from a machine uh in this network to over here in the warehouse, you know, if you don't understand that those things are happening, uh then you can't have adequate controls in place to protect everything and pass this assessment.
00:42:51.039 --> 00:42:52.320
Chris, same question to you.
00:42:52.320 --> 00:42:54.800
Kind of a final takeaway for our listeners.
00:42:55.119 --> 00:42:55.360
Wow.
00:42:55.360 --> 00:43:00.880
Well, Jameson kind of covered really the big hitters that I probably would throw out there.
00:43:00.880 --> 00:43:03.039
And especially you brought up scoping.
00:43:03.039 --> 00:43:06.159
Um, yeah, I would I would echo that 10 times.
00:43:06.159 --> 00:43:08.480
Scoping, scoping, scoping, right?
00:43:08.480 --> 00:43:13.440
Uh we we have we've seen uh a false start.
00:43:13.440 --> 00:43:24.400
Uh the the one kind of false start that we've had um was because of scoping, because we started asking the question, the simple question, how do you receive CUI?
00:43:24.400 --> 00:43:31.039
And the the contractor, the OSC started describing all the ways they receive it.
00:43:31.039 --> 00:43:40.880
And I'm sitting here looking at a network diagram, and they didn't have on the diagram a couple of ways that they receive CUI.
00:43:40.880 --> 00:43:43.440
So I'm like, we can't go forward.
00:43:43.440 --> 00:43:50.239
There's you know, without without a solid documented scope, we cannot go forward.
00:43:50.239 --> 00:43:53.199
So it is, it's it's it's vitally important.
00:43:53.199 --> 00:43:59.280
Um, the only other thing I would, I guess, uh reiterate is assessors are human.
00:43:59.280 --> 00:44:05.039
Uh in my case, in my particular case, uh my wife works with me.
00:44:05.039 --> 00:44:09.119
She's been working with me for five, six years now, and she is an assessor.
00:44:09.119 --> 00:44:11.360
She's a a CCA.
00:44:11.360 --> 00:44:15.360
And when we show up on site, uh, we're not mean.
00:44:15.360 --> 00:44:17.039
We're not there to trick you.
00:44:17.039 --> 00:44:22.320
We're not, you know, we're not we don't hold a grudge against anything in the world.
00:44:22.320 --> 00:44:30.800
We're we're literally just wanting to provide the OSC an opportunity to provide evidence that they are compliant.
00:44:30.800 --> 00:44:37.199
So um, you know, we're we uh my wife's also name is Chris, so we're Chris and Chris.
00:44:37.199 --> 00:44:43.280
And uh one one of the consultants, yeah, one of the consultants started calling us Chris Pleural.
00:44:43.599 --> 00:44:44.960
So Chris Squared.
00:44:45.119 --> 00:44:46.320
Yes, Chris Squared.
00:44:46.320 --> 00:44:47.920
We I think we've heard them all.
00:44:47.920 --> 00:44:49.840
Uh Chris Pleural was a new one, though.
00:44:49.840 --> 00:44:51.039
I hadn't heard that before.
00:44:51.039 --> 00:44:54.079
But uh but yeah, I assessors are human.
00:44:54.079 --> 00:44:57.199
And um keep that in mind, right?
00:44:57.199 --> 00:45:07.119
I I I wouldn't suggest doing anything untoured or or deceitful or anything, but assessors are human and we can't escape that.
00:45:07.119 --> 00:45:08.639
It is what it is.
00:45:09.039 --> 00:45:10.800
Uh also fantastic advice.
00:45:10.800 --> 00:45:17.760
I love your comment about scoping because I know that's oftentimes whenever we're trying to secure some type of environment, we have to know what are the boundaries of that environment.
00:45:17.760 --> 00:45:18.639
What is our system?
00:45:18.639 --> 00:45:24.239
What are we kind of ties into that concept if you can't protect what you don't know, you have, but what what is relevant to it?
00:45:24.239 --> 00:45:30.079
Like you're saying, kind of how CUI is coming into our environment, making sure our network diagram is appropriately capturing that.
00:45:30.079 --> 00:45:34.000
And I also love the con the comment too, Chris, about just assessors being human.
00:45:34.000 --> 00:45:36.000
You know, we're all playing our part, right?
00:45:36.000 --> 00:45:40.320
And we and we all want this to be a smooth process, a successful process.
00:45:40.320 --> 00:45:42.159
You know, we're we're all in this together.
00:45:42.159 --> 00:45:45.199
At the end of the day, the way I see it too is this has real implications.
00:45:45.199 --> 00:45:48.400
I mean, we're not just doing this just to check off some boxes, right?
00:45:48.719 --> 00:45:49.599
Yeah, absolutely.
00:45:49.599 --> 00:46:06.639
I mean, uh, you know, we didn't we didn't really talk about like the real world impact of of not protecting CUI, but you know, there's stories about the the Chinese bomber that that looks a lot like our stealth bomber, the the space shuttle that looks a lot like our space shuttle.
00:46:06.639 --> 00:46:09.199
Well, there's a reason for that, right?
00:46:09.199 --> 00:46:16.159
Plans and designs and sensitive information is getting stolen and used by our adversaries.
00:46:16.480 --> 00:46:17.039
Yeah, you're right.
00:46:17.039 --> 00:46:21.119
Like there are actual real world implications to all of this.
00:46:21.119 --> 00:46:28.480
And Chris, will you also just do uh do uh me a favor and tell listeners a little bit more about your business and how they can get in contact with you?
00:46:28.800 --> 00:46:29.760
Yeah, absolutely.
00:46:29.760 --> 00:46:37.440
So, in addition to CMMC, uh we do other compliance frameworks like PCI, HIPAA, those type things.
00:46:37.440 --> 00:46:39.760
We also do penetration tests.
00:46:39.760 --> 00:46:45.440
And uh uh I as you might imagine, I love education.
00:46:45.440 --> 00:46:54.800
So uh we have a whole education department in our business where we can do uh user awareness training and and that type of stuff.
00:46:54.800 --> 00:46:55.679
It's a little different.
00:46:55.679 --> 00:47:03.360
It's not a platform, it's not just a five-minute video, it's literally me coming on site and doing kind of a roadshow.
00:47:03.360 --> 00:47:12.480
So uh yeah, as you can probably imagine, I'm pretty passionate about security and about helping companies uh become more secure, right?
00:47:12.480 --> 00:47:17.280
There is no hundred percent out there and uh just trying to approach it.
00:47:17.280 --> 00:47:29.199
So uh so basically in the late 90s, early 2000s, um I I essentially bought uh everything that says CG Silvers that I could find.
00:47:29.199 --> 00:47:37.119
So what I tell people is the way to get in touch with me is just go out on the internet and yell CG Silvers, and you'll probably come up with me.
00:47:37.119 --> 00:47:42.639
That's literally LinkedIn.com slash IN slash CG Silvers, right?
00:47:42.639 --> 00:47:45.360
And of course our website, CGSilvers.com.
00:47:45.599 --> 00:47:47.920
Well, again, thank you so much to both of you for joining me.
00:47:47.920 --> 00:47:52.000
And and first off, just thank you for the work that you do because it really is impactful.
00:47:52.000 --> 00:47:58.079
But I just also really appreciate you joining me today and get on the microphone to talk through these considerations.
00:47:58.079 --> 00:48:01.599
And to our listeners, also thank you for tuning in.
00:48:01.599 --> 00:48:14.800
If you have any thought questions about the items we discussed today or any other business challenges you're navigating, please don't hesitate to contact us at www.mjxcpa.com and also go to the internet and just yell CG Silvers.
