Latest / CMMC Compliance Guide / Why Contractors Fail CMMC Assessments and How to Prepare

Transcript

Why Contractors Fail CMMC Assessments and How to Prepare · CMMC Compliance Guide

• 0:21
  Austin: Hey there and welcome to the CMMC Compliance Guide Podcast.
• 0:25
  Austin: I'm Austin and I'm Brooke from Justice IT Consulting, where we help businesses like yours navigate CMMC and NIST 800-1701 compliance.
• 0:35
  Austin: We're hired guns getting companies fast-tracked to compliance.
• 0:38
  Austin: But today, we're here to give you all the secrets for free.
• 0:41
  Austin: So if you want to tackle it yourself, you're equipped to do so.
• 0:45
  Austin: Let's dive into today's episode and keep your business on track.
• 0:50
  Austin: Today, we're talking about something that surprises a lot of defense contractors when they go through a real CMMC assessment.
• 0:57
  Austin: Many companies feel confident they're ready, they've written policies, deployed security tools, and even maybe submitted a strong SPRS score or Spurs score.
• 1:07
  Austin: But when assessors actually evaluate the environment, that confidence doesn't always hold up.
• 1:13
  Austin: In fact, Department of Defense or data has shown that only a small percentage of contractors who believed they were compliant with NIST 800 171 actually met the requirements when it was independently validated.
• 1:27
  Austin: So today we're going to talk about why that gap exists, how assessors actually evaluate compliance, and what contractors need to understand before they schedule their CMMC level two assessment.
• 1:41
  Austin: Alright, Brooke.
• 1:42
  Austin: So a lot of contractors uh often get excited, find a C3PAO, schedule an assessment, and then when it comes time to actually do the assessment, uh you'll hear C three PAOs uh complain about this all the time that uh they have to then reschedule uh because they're not ready.
• 2:01
  Austin: All right.
• 2:02
  Austin: Um so uh why do so many contractors believe that they're compliant, but whenever assessment day starts creeping up, uh they end up finding major gaps or suddenly feel that they're not ready?
• 2:15
  Brooke: Uh well, they're the the I guess well, I'm not an assessor, so and we're not a C3PAO.
• 2:24
  Brooke: I just tell you what we've heard.
• 2:25
  Brooke: One of the biggest things really is that uh, you know, contractors uh typically there's somebody technical involved in the heavily involved or in charge of the implementation and getting everything ready.
• 2:38
  Brooke: You know, maybe that's an IT guy, uh CIO or whatever, um, something like that.
• 2:44
  Brooke: But uh they may be in charge of getting it done.
• 2:47
  Brooke: And so what do IT guys like me like to do?
• 2:50
  Brooke: Get all those technical controls in place.
• 2:53
  Brooke: Documentation, yeah, we can put some documentation down, you know.
• 2:57
  Brooke: Uh so you know, the uh the assessors might get that documentation or look and go, you know, this you know, what you have in your uh policies doesn't necessarily, you know, uh doesn't necessarily match or uh, you know, looks it appears like you might not be ready, uh, you know, something like that.
• 3:17
  Brooke: Or uh, you know, when you do anyway, there's there's all sorts of reasons, but uh more times than not uh the uh contractor just doesn't understand what that assessor is really looking for, right?
• 3:31
  Brooke: Uh you can read the assessment uh objectives, or you can read the uh you can read the controls, you can read the assessment objectives, uh the DOD guidance and stuff like that.
• 3:43
  Brooke: You can come up with a completely different technical guy, you can come up with something completely different than the assessor does.
• 3:50
  Brooke: And the all the other problem is that, you know, us when we're writing this stuff down, some of it just makes sense to us because this is our system, right?
• 3:59
  Brooke: So we just you write stuff down.
• 4:01
  Brooke: What you really need to do is you need to write your your statements like maybe a third party outside your organization is gonna read it and have to understand it.
• 4:10
  Brooke: There's a thought.
• 4:13
  Brooke: And to be honest, when you know I first started writing these a while back, you know, I I I did that too, you know.
• 4:19
  Brooke: So it makes perfect sense.
• 4:20
  Brooke: You know, and then you think about it, and uh, well, an assessor has to come in and they might have to make heads or tails out of this, you know.
• 4:26
  Brooke: And uh so they've got to be able to look at it and understand it and needs to tell them a story.
• 4:31
  Brooke: The policies need to match, all that kind of fun stuff.
• 4:34
  Brooke: And and uh so uh you really need to write your SSP and uh and your all your control statements, your uh assessment objective statements, you need to do everything with somebody else in mind, right?
• 4:49
  Brooke: So uh a lot of people a lot of people to treat it like a checklist at first, you know.
• 4:54
  Brooke: Hopefully at this point in the uh CMMC uh journey, life cycle, however you want to phrase that, you know, hopefully at this point uh people understand that more and that they uh they need to explain it.
• 5:06
  Brooke: But truthfully, uh of course all the people come or that are coming to us are the ones that you know need help and have realized that, oh crap, this is this is something that's gonna be gigantically hard for us to do, right?
• 5:20
  Brooke: And so that's that's the people we see.
• 5:22
  Brooke: But um being in the community and understanding and hearing, that's that's a very common problem, is that you just don't understand what the assessor is looking for and and you have a tendency to treat it more like a and you have to have a tendency to treat it more like a checkbox.
• 5:38
  Brooke: Not literally really like a checkbox, but uh more simply than than the that it really needs to be done.
• 5:47
  Austin: And uh oftentimes that can be as uh the the realization that they're not ready can be as soon as uh when the uh assessor or C3PAO sends the first request for the evidence package out prior to their assessment date.
• 6:01
  Brooke: They get that assessment package and they look at it and they go, uh hey buddy, you ain't there.
• 6:07
  Brooke: So how about we s how about we hold off on this mock?
• 6:09
  Austin: You know, or the contractor gets the request and they go, You want what?
• 6:13
  Brooke: That's yes.
• 6:15
  Brooke: And the uh the assessors know that if you can't uh provide that package within a time frame that they're looking for, uh they know they have a very good idea that you're not gonna be ready.
• 6:26
  Brooke: You know.
• 6:27
  Brooke: Uh so but the the package is a lot that they want to look at and they want to see.
• 6:32
  Brooke: Um depends on how you're doing it exactly, but you know, a lot of times they'll want to see the uh maybe your SSP and then you know an inventory of of everything that you have, you know.
• 6:43
  Brooke: And uh once you provide that inventory, if you know, if it's a short list, they'll be going, is is this is this really it?
• 6:51
  Brooke: Are you sure?
• 6:53
  Brooke: So yeah.
• 6:54
  Brooke: Uh it it there's a lot to it.
• 6:57
  Brooke: And they they gotta see that there's a lot to that package.
• 7:00
  Austin: All right.
• 7:00
  Austin: So we had mentioned uh the evidence package.
• 7:03
  Austin: So normally, you know, you'll hire your C3PAO, your assessment data'll come up, they'll request the evidence and your other documentation and stuff.
• 7:11
  Austin: Um, and then you will uh get to the day where they're either in your conference room at your place of business or over Zoom or something, um, and they have to start validating controls and and determine whether you're meeting things or not, right?
• 7:31
  Austin: Whether things are actually implemented.
• 7:32
  Austin: So how do they actually do that?
• 7:35
  Brooke: Well, uh depending on whether it's a mock or not, depending on whether you know you're you're all remote or not, uh they may or may not have to come on site.
• 7:44
  Brooke: Um but uh when you're reviewing it with them, they um examine, you know, there's examine, interview, and test, and so they'll examine all your uh documents, all your statements, uh they'll examine uh everything for for that assessment objective, right?
• 8:03
  Brooke: And uh they can do that, they can uh interview people.
• 8:07
  Brooke: So you say, you know, um my admin here is uh is the one that uh implements all the all the change orders or all the you know whatever it may be in the CLSO, Mr.
• 8:23
  Brooke: Admin or Mrs.
• 8:24
  Brooke: Admin or Ms.
• 8:25
  Brooke: Admin or whatever.
• 8:27
  Brooke: Anyway, uh you know, just show me how you do this, you know, or or they'll ask them how do you do this, you know.
• 8:34
  Brooke: And so they can explain it.
• 8:36
  Brooke: Or, you know, what kind of uh employee training, what kind of train what kind of uh uh training have you gone through?
• 8:43
  Brooke: You know, they may ask them that, or did you do any training?
• 8:46
  Brooke: Uh in the interview part, they'll test it.
• 8:49
  Brooke: So they themselves won't test it, but they'll say, Hey, you have this screenshot here, great, you got this documentation, it says how you do it, it says how you're supposed to do it, you got your documentation that says this is how we do it, you got your screenshot here that says you know the shows you're doing it.
• 9:06
  Brooke: Now I need you to show me that login, that uh login banner, or I need you to show me uh some the ACLs on the firewall, or I need you to show me, you know, where your timeout setting is, or the uh the server room door that has the label on it, you know, what whatever it may be.
• 9:29
  Brooke: They that's the test.
• 9:30
  Brooke: They want to test that control or that uh that assessment objective, right?
• 9:35
  Brooke: Um so that's how they do it.
• 9:38
  Brooke: Uh and whether it's uh remote or in person, that's that's how it's gonna be done.
• 9:42
  Brooke: If they're in person, you know, they'll sit with you in a comfort room or watch you over your shoulder or whatever it may be, uh, you know, so they can see that stuff.
• 9:53
  Austin: Aaron Powell Thank you for that, Brooke.
• 9:55
  Austin: Uh so another thing we see a lot is that people always talk about the 110 controls, the 110 controls, the 110 controls.
• 10:02
  Austin: Absolutely, right.
• 10:03
  Austin: You know, um and often they forget the importance of the objectives, the 320 objectives, right?
• 10:11
  Brooke: Aaron Powell Those are those are actually more important, yes.
• 10:13
  Austin: Right.
• 10:14
  Austin: Uh so why are the objectives important whenever the 110 controls are um what everyone talks about?
• 10:23
  Brooke: Uh because well, uh the assessment objectives are what you're graded on, really.
• 10:28
  Brooke: Uh the control is what contains the points, uh if you want to look at it that way.
• 10:33
  Brooke: But the assessment objectives are are what they uh examine, interview, or test on, right?
• 10:39
  Brooke: So uh the the control statement does matter, of course, uh but really what you're being validated on and what you're being what they're looking at is do you meet all these control, uh all these uh assessment objectives?
• 10:52
  Brooke: Because you know, there may be 3.1.1 has six uh assessment objectives.
• 10:58
  Brooke: So if you don't uh uh if you meet all those assessment objectives, good, that control is met.
• 11:04
  Brooke: Right?
• 11:05
  Brooke: Uh and if you uh meet five of those assessment objectives and you one is not met, or the assessor thinks one's not met, that whole control just went out the window.
• 11:17
  Brooke: You don't you didn't meet it.
• 11:19
  Brooke: So now you will find out they won't just tell you, you know, this control's not met.
• 11:25
  Brooke: They'll tell you uh which assessment objective, you know.
• 11:29
  Brooke: And they they may even uh they'll tell you why, but they won't get into any more details than that because they have to stay because of our code of professional conduct, our code of ethics, right?
• 11:42
  Brooke: Uh you gotta s they have to stay a thousand percent they have to stay way away from uh consulting.
• 11:48
  Brooke: So if they uh if they even inch up to that line a little bit, they get they get queasy, right?
• 11:56
  Brooke: So that's a that's a really big deal.
• 11:59
  Brooke: They can't do any they can't be seen as doing any sort of consulting.
• 12:04
  Brooke: So but in any case, the question you're asking is you know, the assessment objectives are uh arguably a lot more important than the than the actual control is because if you meet all those assessment objectives, you're good.
• 12:15
  Brooke: You're golden.
• 12:16
  Brooke: If you miss one, you're not golden anymore.
• 12:19
  Brooke: I guess you'd be uh, you know, copper at that point, or you know, maybe that's still kind of expensive, you know, maybe something else.
• 12:27
  Brooke: But um in any point, uh in any case, uh those assessment objectives are really what matters.
• 12:35
  Austin: Yeah, so I guess that that really highlights the uh benefit of a mock.
• 12:39
  Austin: And I know whenever we're talking to customers um and we're kind of coaching them through everything, um, you know, oftentimes they'll you know ask what the value of a mock assessment is, right?
• 12:51
  Austin: Um and I think it's that, right?
• 12:52
  Austin: So you've got you've got the controls, and then you may have, you know, uh some amount, sometimes it's a lot, sometimes it's a little of objectives associated with control, right?
• 13:02
  Austin: And so if you've got all the objectives except for the one, you know, that might blow you up on it, um, it's you know super useful to know that in a mock assessment that um that you've just missed that one because they told you on that you missed this objective, right?
• 13:19
  Austin: And so you can go fix that and then go into your assessment with a lot more confidence um uh and not have to report a failure.
• 13:27
  Brooke: Yeah, exactly.
• 13:28
  Brooke: If you know and the other part of that is that um you want your the C through PAO that's gonna be doing your certification, you want them to do your mock.
• 13:37
  Brooke: You don't want somebody else, I mean it if you're way, way off base, way you know, you have no clue, yes, have somebody else come in and do an assessment, and then you can have I would still argue for a uh mock assessment at that point, right?
• 13:53
  Brooke: Um because if that see-through PAO that's performing the certification assessment does your mock, you'll know exactly where you stand with that person who is interpreting what you wrote down.
• 14:05
  Brooke: If you have somebody else in there to do the mock or some other kind of assessment or prep you and get you ready, then their opinion about how all that's done may be different than that assessor that's assessing you.
• 14:17
  Brooke: Ostensibly, it's all supposed to be exactly the same.
• 14:23
  Brooke: But it's not.
• 14:24
  Brooke: Uh you know, Austin here showed cattle uh when he was growing up and and uh you know you may have uh you may have some cattle that you know win first and second place at you know all these places, and then somewhere else they place eighth or ninth, and you're like, well, why did that happen?
• 14:40
  Austin: And and uh They're all judged by the same breed standards.
• 14:42
  Brooke: All b same breed standards, yeah, exactly.
• 14:45
  Brooke: I mean you have standards you're judged against and everything else.
• 14:47
  Brooke: Uh but what did we say about that?
• 14:50
  unknown: I don't know.
• 14:51
  Brooke: You don't remember?
• 14:52
  Austin: I don't know what you're talking about.
• 14:53
  Brooke: So uh we always said, well, you know that's one judge's opinion on one day.
• 14:57
  Brooke: Oh yeah.
• 14:57
  Austin: Well, yeah.
• 14:59
  Brooke: You know, it's it's different than some by some other judge's opinion, and it might even be different than his opinion on Tuesday, you know.
• 15:06
  Brooke: So anyway.
• 15:07
  Austin: I must have been clean mucking stalls and and picking up uh cow crap whenever y'all are saying that.
• 15:14
  Austin: Maybe.
• 15:15
  Brooke: But uh yeah, that's uh the same thing with assessors, and not quite to that extent.
• 15:20
  Austin: But the there's a lot tighter controls.
• 15:24
  Brooke: There are a lot, it's a lot tighter.
• 15:25
  Brooke: They have everything very, very defined, but um there is still gonna be some interpretation uh because after all, everybody's uh environment is not the same.
• 15:36
  Brooke: Right.
• 15:37
  Brooke: Uh so uh they're having to interpret what you wrote down, uh what you're doing, how you did it, all that kind of fun stuff.
• 15:46
  Brooke: So that does lead to some discrepancy.
• 15:50
  Austin: Yeah, and another thing that I see uh people do um that just in my opinion, it's the wrong way.
• 15:57
  Austin: Go about it.
• 15:58
  Austin: Um, you know, you're you're welcome to approach this however you want.
• 16:02
  Austin: It's not necessarily there's not something inherently wrong with it, but oftentimes when someone's starting to get or wanting to get down, you know, through their compliance journey, they always hear about C three PAOs and they want to hire a C through PO, even if they're not, you know, if they're at the beginning of the journey to like do a mock or to do their gaps assessment or something, um, and then uh and then like start implementing.
• 16:26
  Austin: And my personal opinion on that is don't do that.
• 16:30
  Austin: Um one, it's it's gonna be decently expensive.
• 16:33
  Austin: Um, but two, you can just, you know, if you do a good self-assessment, you you have an idea of you know where you're at to begin with, but if you hire an RPO or um you know a CCP or something to come in and help you with your readiness, they can um, you know, help you with uh your self-assessment, your gaps assessment, um, and then shore up a lot of the holes because you're gonna have a lot more gaps than you realize.
• 17:00
  Austin: Um and people even if people know that they have a lot of gaps, whenever we come in and do a gap assessment, we show them they're like, ah, and it's way worse than I thought.
• 17:10
  Austin: Yeah.
• 17:11
  Austin: So just to be honest.
• 17:14
  Austin: Right, right.
• 17:15
  Austin: So I mean, you're welcome to go find a C through Pao and and have them do a mock or uh gap assessment or something for you right off the bat.
• 17:25
  Austin: But my personal opinion would just be wait till you're closer to ready.
• 17:30
  Brooke: On that note, you know, uh and this is not to talk bad about any assessor or any C through PAO or anything like that, but uh they they're doing the assessments, and this is this is what they've been doing.
• 17:45
  Brooke: They're they're doing these CMMC assessments and they've also been doing other kinds, you know, SOC uh SOC2 assessments, stuff like that.
• 17:52
  Brooke: So uh that's that's what they've been doing, right?
• 17:56
  Brooke: Um they're not necessarily on the implementation side of it, so uh they they can't necessarily um always give you the best advice as to how you might handle that.
• 18:10
  Brooke: Some of them are some of them been on the implementation side and they they're they're great and and make some good recommendations, you know.
• 18:17
  Brooke: Um but uh you want to hire somebody that uh has some expertise in implementation and understands uh the whole um you know, the whole process, right?
• 18:29
  Brooke: Uh maybe he's even been through the process, but um you know I and I would say if you're looking for an RPO uh to help you with implementation uh and getting ready, uh then I'd say look for one with a CCP or CCA on staff or more than one CCP or CCA, right?
• 18:46
  Brooke: Um RPs are good, but you've you've gotta you've gotta really do your homework.
• 18:51
  Brooke: So look for look for an RPO at registered practitioner organization.
• 18:55
  Brooke: We're bad about you know uh not remembering to say the whole all the words.
• 19:01
  Brooke: Uh so if you're looking for you know a registered practitioner organization, uh RPO, uh you can find them on the Cyber A B marketplace.
• 19:09
  Brooke: Uh look for one that has you know CCP or CCAs on staff and and uh that that those can usually get you a a good you know help you with implementation really well.
• 19:20
  Brooke: So uh especially if they've been through you know mock assessments, uh certification assessments, whatever it is that you know what I can tell you is those when you start doing that mock assessment, you realize how valuable it is, you know, and how much it helps out.
• 19:35
  Brooke: As much as you know you might know and everything else, the first one you go through, you're like, oh yeah.
• 19:40
  Brooke: That's uh that's eye-opening.
• 19:44
  Austin: Absolutely.
• 19:45
  Austin: All right, going back to uh the assessors and and when they come in, um let's talk about the gap between reality and and documentation.
• 19:57
  Austin: And what I'm trying to look for here is what are some examples that uh assessors commonly find are that are gaps in documentation and evidence when they start reviewing environment?
• 20:11
  Brooke: Uh a lot of uh common things are gonna be your policies uh may not exactly match your uh your control statements or implementation.
• 20:21
  Brooke: Or maybe your maybe your what everything is written down doesn't match implementation.
• 20:26
  Brooke: Uh hopefully it does, but uh you know uh with your policies you need to need to have some a good set of policies.
• 20:37
  Brooke: You need to have a good set of policies.
• 20:39
  Brooke: Uh but uh I would say put in your policies exactly what needs to be there and uh nothing more, right?
• 20:47
  Brooke: Uh you don't want to get too detailed because those policies lock you in and uh and you have to do it.
• 20:53
  Brooke: So um if you go over above and beyond, you know, what needs to be done, then you're you're set and you you you're stuck there and you have to do that, right?
• 21:03
  Brooke: Um but you do need to define things like if in your policy, if you say lockout is fifteen minutes and and your uh in your SSP you say it's 10 minutes, you might think that's great, because it's better than my policy, right?
• 21:21
  Brooke: And if your implementation it shows 10 minutes, you're like, I'm golden, man, it's better than over here.
• 21:26
  Brooke: Not really.
• 21:28
  Brooke: They don't even a lot of times it'll be okay, most likely, but a lot of times they don't even like to see, you know, uh at least 15 minutes, or at least, you know, they they want to say that it says 15 minutes here, 15 minutes there, 15 minutes there, right?
• 21:44
  Brooke: So it has to all match.
• 21:46
  Brooke: That's that's the that's uh what I hear is that's the biggest thing uh that happens is the documentation doesn't match, or maybe you didn't spell something out uh completely uh in in your policies that you need to.
• 22:01
  Brooke: Um but I would still caution you from being too verbose, I guess, in your uh in your policies, right?
• 22:09
  Brooke: And uh just put in there, you know, like uh you probably you never seen this, but the old Dragnet series on TV.
• 22:17
  Brooke: Uh it was e it was on and reruns when I was a kid.
• 22:20
  Brooke: So uh anyway, the It was an FBI agent, and he said, you know, Letty was telling him his big long story, and he says, uh, ma'am, just the facts, ma'am.
• 22:28
  Brooke: So so whether it's your policies or also when you're talking to the assessor, just the facts, just what they asked for, nothing else, right?
• 22:38
  Brooke: You know, the other thing that uh they I don't know how common it is, but the other thing that you'll hear stories about is that they have boilerplate templates in there for their policies.
• 22:49
  Brooke: You know.
• 22:50
  Brooke: Believe it or not, you actually have to read through the policies you put in there.
• 22:55
  Brooke: If it says, you know, insert company name, it's probably not a good thing.
• 22:59
  Brooke: It's a red flag.
• 23:00
  Brooke: That is a red flag.
• 23:02
  Brooke: That will probably, if they see that in the documentation at phase one, they'll say, We're gonna put a pause on this, and uh you need to tell us when you're really ready, you know.
• 23:11
  Austin: Um that is uh most common are intakes as well.
• 23:14
  Austin: And you know, I'll ask if someone has uh SSP and they're like, oh yeah, yeah, yeah.
• 23:18
  Austin: And they they do, you know, and then you start digging a little deeper, you realize it's something like that.
• 23:23
  Austin: Or, you know, I'll I'll ask, uh, you know, do you have uh um SSP or like an unsupported policies and like yeah, yeah, and you go, okay, do you have an instant response plan?
• 23:31
  Austin: They go, No.
• 23:33
  Austin: You know, so it's just just because you have a Word document with some words on it doesn't mean you know it's it's meeting the uh what they're looking for, right?
• 23:43
  Brooke: Yep.
• 23:43
  Brooke: And I can tell you it's a big pain in the rear, but you do need to go and go through all those policies.
• 23:49
  Brooke: You need to read through every single bit of it, you know, make sure it matches what you're what is supposed to be in there from from the uh uh assessment objectives, right?
• 24:01
  Brooke: Um make sure it matches what's supposed to be what it's supposed to have, and then make sure that it's for your environment and that it's specifically for your environment.
• 24:10
  Brooke: And you know if it says, you know, how many minutes or the timeout is, make sure that matches what's actually implemented, right?
• 24:19
  Brooke: So absolutely.
• 24:22
  Austin: Absolutely.
• 24:23
  Austin: So um up next, you know, you'll see uh a lot of contractors with um SPRS scores are really or Spurs scores they're really proud of, you know, um, you know, 90s, 110s, stuff like that.
• 24:37
  Austin: Um you know if uh if a contractor feels as if as if they really have a 90 or 110 SPRS score, um does that mean that they're they're ready for a CMMC assessment?
• 24:52
  Brooke: It should, but it doesn't.
• 24:54
  Brooke: Uh so uh most of the time, uh unless they've gone through the process and they've they've did an actual real assessment, self-assessment on themselves, you know, um most of the time that score is just gonna be, you know, what how how they think everything's implemented, right?
• 25:11
  Brooke: Just going back to the check boxes, you know.
• 25:13
  Brooke: Check, check, check, check, check, you know.
• 25:15
  Brooke: Um a lot of times those are inflated, uh, and the government knows that.
• 25:22
  Brooke: And that's why we ended up with these third-party certifications.
• 25:27
  Austin: That is very true.
• 25:29
  Austin: So I don't think it's an episode um of CMMC Compliance Guide Podcast.
• 25:34
  Austin: If we don't uh mention scope.
• 25:38
  Austin: Right.
• 25:38
  Brooke: We've already mentioned documentation.
• 25:39
  Austin: Right.
• 25:40
  Austin: So yeah.
• 25:40
  Austin: So yeah, we got both documentation and and scope now.
• 25:43
  Austin: So we're we're rounded out, we're set.
• 25:45
  Austin: Right.
• 25:46
  Austin: Um so uh, you know, in particular, talking about assessments and and you know, hiring a C through PO, having to come in and do your assessment.
• 25:56
  Austin: What role does scope play and why is it such a big deal with an assessment?
• 26:01
  Brooke: Uh well really it can make things easier difficult.
• 26:04
  Brooke: Right.
• 26:05
  Brooke: Uh and and a lot of people, in our experience, we we do a lot of manufacturer, so uh having an on having a true enclave, like you would your first the first picture in rear mind about an on what an enclave is, you know, um it just doesn't work for a lot of people.
• 26:24
  Brooke: It does work for people that are office only, you know.
• 26:27
  Brooke: Uh works great for C through PAOs.
• 26:30
  Brooke: I'm sure it works good for other dib contractors.
• 26:33
  Brooke: I hear it does.
• 26:34
  Brooke: But for for actual uh manufacturers and and and construction folks, um that enclave uh breaks down.
• 26:43
  Brooke: So um doesn't break down completely.
• 26:45
  Brooke: You just have to expand the scope outside the enclave a little bit, so uh or a lot maybe.
• 26:50
  Brooke: Um but uh scope matters a whole lot.
• 26:53
  Brooke: Uh that's the very first thing you actually the very first thing you should uh you should start with, and you could make it part of scope or say it's a separate part, but uh is figuring out what data do you have?
• 27:06
  Brooke: You know, what kind of CUI do you have?
• 27:09
  Brooke: Or what what kind of CUI do you want to plan on having if you don't have any right now, right?
• 27:14
  Brooke: Um what do you want to build it to to fit?
• 27:17
  Brooke: So um uh so you start off with that scope, you figure out uh what all mach what what all has to be in the scope and one doesn't, you know?
• 27:27
  Brooke: Um and you you write your policies, your your data flow diagram, your network diagram, or your all your uh your SSP and your all your policies, considering what's in scope, and leave what's what needs to be uh what can be out of scope, you leave that out.
• 27:44
  Brooke: That'll that'll make it a lot easier on you.
• 27:46
  Brooke: Uh if you just say everything's in scope, just put everything in scope.
• 27:49
  Brooke: That'll that'll make your life difficult.
• 27:52
  Brooke: There is, you know, there are quite a few contractors who all their business is DOD or DOW, right?
• 28:02
  Brooke: And so uh if it's all DOW work and all C UI work, then yeah, probably most everything's gonna be in scope, right?
• 28:13
  Brooke: Uh it in some manner, right?
• 28:15
  Brooke: Uh however, you can scope out the accounting folks, you can scope out the HR folks, uh, you know, stuff like that.
• 28:22
  Brooke: So you can you can start thinking about that and carving things out that you don't have to that you don't have to scope in it.
• 28:27
  Brooke: And that that makes things easier, makes your life easier, um, makes the assessors happy that you know they don't have to worry about some of this stuff.
• 28:37
  Brooke: I assume it does.
• 28:38
  Brooke: I you know Yeah.
• 28:40
  Austin: Yeah, no, uh so I was talking to someone yesterday in machine shop, um, and uh we were talking about his scope um and and everything, and then I could see just kind of the light bulb, you know, turn on over his head, and we were talking about it, and and he was like, Well, so does that mean like my physical shop floor, you know, like it's in scope?
• 28:59
  Austin: And I was like, Well, if you're doing it the way that you're describing it, yes, it it does.
• 29:03
  Austin: And so as that means we have to have physical access control of the building.
• 29:07
  Austin: I was like, Well, yes, and sort of talk about the employee entrance and the front door and receiving where they get bar bar stock.
• 29:13
  Brooke: Oh, we just leave all our doors open, it gets hot in there.
• 29:15
  Austin: Right.
• 29:16
  Austin: That's an issue.
• 29:17
  Austin: Well, and uh for him, um, you know, it's uh we start talking about more and more, and then um he uh we talked about you know what how they do the rault doors in the back, you know.
• 29:27
  Austin: Um and then he realized, you know, he's got this big, you know, um uh on the back of their property, just a big gaping hold, you know, to um they got a fence on the front but on the back.
• 29:39
  Austin: And he's like, well, I have to build a fence now.
• 29:41
  Austin: And I was like, well, it's one way, you know.
• 29:44
  Austin: Um and so uh it just at that point, you know, when he realized that the enclave that he was talking about and wanting, um, you know, started to, you know, creep into the actual physical, you know, uh part of the building, into the property, into the fence line, you know, he just kind of realized the full breadth of scope and um and it kind of overwhelmed him because you know he he was looking to get into defense work and uh he was trying to figure out you know if uh this is something he wanted to do or not.
• 30:13
  Austin: And I hope I didn't ruin his day, but uh nonetheless, uh I you know he he uh we were able to get him in the right direction.
• 30:21
  Austin: So yeah, it can it can be um understanding um what your scope is uh and um what what an enclave actually includes, especially for someone like a manufacturer is um is is more than what you might see online or advertised um out there.
• 30:39
  Austin: So absolutely.
• 30:41
  Austin: So let's talk about the role goal uh that everyone has, um, and that is passing an assessment.
• 30:46
  Austin: Making a hundred and ten.
• 30:47
  Austin: Right.
• 30:48
  Austin: Exactly.
• 30:49
  Austin: So what separates the companies that pass their assessments from the ones that don't quite get there?
• 30:56
  Brooke: Uh what separates the uh 110 from 109 and blow?
• 31:01
  Brooke: Uh um you know most of the time.
• 31:07
  Brooke: It so uh a lot of things we already talked about, right?
• 31:11
  Brooke: Uh a lot of times it's documentation, you know.
• 31:14
  Brooke: Uh you've got to pay attention to details, you've got to spend a lot of time doing this, and you can outsource a good bit of it, right, to somebody else to help you.
• 31:25
  Brooke: You still have to be part of it.
• 31:27
  Brooke: You still have to understand everything.
• 31:29
  Brooke: The assessors will ask you, you know, how this control is is put in place, and you'll have to be able to come up with some sort of answer that's close to not close to, that is right, you know.
• 31:39
  Brooke: Uh you may be able to lean on the other people to fill in and to help out and all that kind of fun stuff.
• 31:46
  Brooke: But they'll expect you to know these things, right?
• 31:48
  Brooke: And uh at least know the high-level part of it.
• 31:51
  Brooke: Um and what's in your policies, right?
• 31:54
  Brooke: And so uh you can read.
• 31:56
  Brooke: So read those policies.
• 31:58
  Brooke: Uh you know, the last homework we we give people uh, you know, that we're working with is uh all right, now we've gone th we've done this, we've implemented it, we do our uh quarterly and annual reviews, and we do this and that.
• 32:12
  Brooke: And now you need to go back and uh uh I know you've reviewed this stuff, but you need to go back right before the assessment.
• 32:20
  Brooke: You need to read through every single policy, you need to read through every single control, every single assessment objectives, look at all the stuff that's uh associated with it and make sure that you understand it all and and that you you that's all jumbled around in your mind.
• 32:37
  Brooke: Because what I can tell you is when you get to that assessment, uh you're you're nervous.
• 32:41
  Brooke: You're you know, it's our our mock, you know, uh I was a nervous wreck.
• 32:47
  Brooke: And I I found myself not being able to think and and going, I don't even remember where to go look for this, you know.
• 32:54
  Brooke: And I just have to ask you know, our engineer, I hey, you know, I it needs you to show this, you know.
• 33:02
  Brooke: And uh and he's like, oh sure.
• 33:04
  Brooke: Uh oh yeah, yeah.
• 33:05
  Brooke: Okay.
• 33:06
  Brooke: You know, and so um first when you go through, you know, for your your mock is gonna be a if I encourage you to do a mock.
• 33:13
  Brooke: So assuming you do that anyway, you're gonna be a nervous wreck.
• 33:16
  Brooke: Uh at least you'll start out like that.
• 33:18
  Brooke: Um you know, by the second day and third day it'll be better.
• 33:22
  Brooke: But um I can tell you my my stomach still hurt on the third day, but you know.
• 33:28
  Brooke: Um so really um you know you need to you need to know your documentation, right?
• 33:36
  Brooke: Uh all of it, your SSP, your policies, your assessment objectives, you need to know all that.
• 33:41
  Brooke: You need to be up and current on it and and have that fresh in your mind, you know.
• 33:46
  Brooke: If you just if you just reviewed it three months ago, good on you.
• 33:50
  Brooke: You have to, but um uh or you have to review it.
• 33:53
  Brooke: But if you just reviewed it three months ago, great.
• 33:55
  Brooke: But that's three months ago, you know?
• 33:57
  Brooke: So uh you've been doing other work things since then, so go back and review it.
• 34:02
  Austin: Get rid of your weekend plans before the Monday they come in, you know.
• 34:05
  Austin: Yeah, right, right.
• 34:06
  Brooke: You know, the other big thing that that uh that catches people is that they can't show where they have reviewed these things.
• 34:14
  Brooke: They can't show where they have, you know, um reviewed the system security plan.
• 34:20
  Brooke: They can't show where they've reviewed the um uh all of the logs that are all the events that are supposed to be logged.
• 34:28
  Brooke: They can't, you know, they can't show that they've actually done that.
• 34:30
  Brooke: Oh yeah, yeah, we did it.
• 34:32
  Brooke: Okay, great.
• 34:33
  Brooke: I trust you, but you know, trust but verify.
• 34:37
  Brooke: So let me let me see where where have you reviewed this.
• 34:40
  Brooke: So a lot of people fall down there.
• 34:42
  Brooke: Um and you know, if you just got this implemented and and went into your you know mock assessment, uh great.
• 34:51
  Brooke: But I would encourage you to have your first review so you can show that you reverred you've reverred reviewed everything.
• 34:59
  Brooke: Uh I would encourage you to have that review uh and review everything you have to review right before that mock.
• 35:05
  Brooke: That way you can say, yes, we started, we got all this in place and we started it.
• 35:09
  Brooke: Uh otherwise, if you've been doing this, that's wonderful.
• 35:12
  Brooke: But you've got to have, you know, a ticketing system helps, you know, it can send you reminders, pop up tickets, you know, go do a vulnerability scan, go do this, go do that, you know, and uh and then enter it into your system.
• 35:25
  Brooke: You got documentation there.
• 35:27
  Brooke: You may have a GRC platform, you can upload it to that.
• 35:30
  Brooke: Um so uh that that ongoing evidence, they'll they'll want to see that, right?
• 35:37
  Brooke: Um and if you don't have it, that that may be a sticking point, especially if you can't produce anything that shows that you reviewed it.
• 35:44
  Brooke: You know, that that will be a sticking point.
• 35:46
  Brooke: Uh they c they can understand if it's your first time doing it, uh and you just completed that right before the the the assessment.
• 35:55
  Brooke: Um but again if you say it's been in place for a year, where's are your reviews?
• 36:01
  Brooke: Right.
• 36:02
  Brooke: So that's another thing that catches people.
• 36:04
  Brooke: Again, another thing that uh that catches people is is just the congruency between the the policies and the the statements and and the implementation.
• 36:14
  Brooke: You know, make sure that matches.
• 36:17
  Brooke: Uh if you know uh I've seen that I've seen them complain about uh you know, well your your uh your policy says that your password history uh is at least five, you know.
• 36:33
  Brooke: You had it set to twenty-four, and you're like, well, yeah, that's that's better, you know.
• 36:38
  Brooke: And it's at least, you know, and they're like, well, yeah, but it doesn't match.
• 36:41
  Brooke: And you can argue that point, you know.
• 36:44
  Brooke: Um but do you really want to have to argue small points like that?
• 36:49
  Brooke: You know?
• 36:49
  Brooke: So if you've got it set at 24, your password history at 24, just put in your policy 24, right?
• 36:56
  Brooke: Um unless there's a reason to leave it like that, you know.
• 37:00
  Brooke: Um, and then you have to think about all your different systems, you know, Active Directory, Intra, uh you may use Kahua or uh JobBoss or you know, whatever it may be.
• 37:13
  Brooke: You gotta think about all the different systems that you use, Prevail or or whatever, and you know, what about you know the users in there?
• 37:21
  Brooke: What about the the log in there?
• 37:23
  Brooke: What about all that kind of fun stuff?
• 37:24
  Brooke: So don't forget those things.
• 37:27
  Brooke: Of course, that's part of scope.
• 37:29
  Brooke: So I guess I'm saying scope is part of the pro is part of the problem too.
• 37:32
  Brooke: Back to scope.
• 37:33
  Brooke: Yeah, that's right.
• 37:35
  Brooke: But but most problems are documentation related.
• 37:39
  Austin: Awesome.
• 37:39
  Austin: Well, thank you, Brooke.
• 37:40
  Austin: Well, I think we've got a meeting run too, so we're gonna go ahead and wrap it up there.
• 37:44
  Austin: Um thank you guys for joining us today.
• 37:46
  Austin: If you have questions about what we covered, please reach out to us.
• 37:50
  Austin: We're here to help fast track your compliance journey.
• 37:54
  Austin: Text, email, or call in your questions, and we'll answer them for free here on the podcast.
• 37:59
  Austin: You can find our contact information at cmc complianceguide.com.
• 38:06
  Austin: Stay tuned for our next episode.
• 38:07
  Austin: Until then, stay compliant, stay secure, and make sure to subscribe.