Latest / The Decision Advantage / Demystifying CMMC: What Defense Contractors Need to Know

Transcript

Demystifying CMMC: What Defense Contractors Need to Know · The Decision Advantage

• Brian: Welcome to the Decision Advantage, a fusion intelligence podcast by Fernant Consulting. I'm Brian LeClaire, and today I'm joined by two guests, Jason Palmer, president of Palmer Computer Services, and the CEO and founder of Fernand Consulting, Dr. Don Hersey. Welcome to the show. Ferndon Consulting: I Jason Palmer: Hello. Brian: Don, you've been on the show several times before, so our listeners already know all about you. But before we dive into our topic today, it would be great if we could learn a little bit about you, Jason. Jason Palmer: Hi, my name is Jason Palmer. I am a CPA with a lead CMMC certified assessor credential. I have over four hundred hours of assessment time as both C C A and lead C C A. Brian: Great, right. Well today we'll be talking about CMMC and how it impacts business leaders and defense contractors. Don, what are we trying to protect and how has securing this data become such a critical priority? Ferndon Consulting: Thank you, Brian. And thank you for helping me have an opportunity to talk about one of those things I I truly do care about, which is operational security. CMMC is well, it it's a framework that is there to protect CUI information. CUI information is not classified information, but it is stuff that's not supposed to be accessible to everybody. So it's not stuff you can place online. It's not going to be found on the internet. And the government wants to make sure. That this is protected. Intellectual property, plans, and a lot of other things end up being CUI. And the CMMC standards are there and they were created to help protect the CUI information. Everything from base schematics. So, like if you need to blow mow a lawn and the lawn is on a base, you need to know the size, the dimension, the boundaries. So CMMC has been there to protect that information that's supposed to be controlled. and not classified, but sometimes it's been very interestingly required for someone who maybe runs a lawn mowing service or one of those types of of s services for the federal government. Brian: So it's a very all encompassing. Ferndon Consulting: It has become all encompassing, which is part of the reason why there's been so much confusion in the implementation of a standard that is for something that is generally at a greater scale. So it was designed more for large entities, large companies, not for lawn care services, just to keep that analogy going. Brian: So Jason, bringing you in here, where does CMMC stand right now? What is the current landscape of the implementation? Jason Palmer: So unfortunately, when the new CIO came in to the DOD, they paused the program and put out a sixty some odd day request for information. They were supposed to come back to us with a report circa September eleventh. Some people say that if you count 60 days using government math, that might be as late as October twenty eighth. But no matter what, in the early days of the request for information, the CIO DOD's office was very chatty online about we're working on it, we're getting comments. We're making deals, we're selling cars. Everything looked great. We're really excited about it. Then in the last few weeks they've become radio silent. Essentially, the CMMC requirement for a level two third-party certification is temporarily on pause. That would have been part of what was known as phase two and phase three, kicking in approximately November 2026 and November 2027. The remarkable thing about this is that all of the contractors, if they look at their contracts, are still required to meet the NIST 800-171 standard, essentially CMMC. So it is now a self-assessment program only. What is unfortunate and frustrating for all of us is the entire reason why CMMC was put in place was because self-assessment was deemed to be no assessment. Many companies felt they would never get audited, they would never get checked, no one would ever look. They could report any score they wanted to the DOD Spurs system and not get caught. You've seen recently in the newspaper that the Department of Justice has been out there doing false claims act prosecutions. They're few and far between. It is my understanding and this is approximate that the DIBCAC, the organization inside the DOD that would responsible for doing the auditing, has done maybe three hundred and fifty some odd assessments on their own. The CMMC ecosystem, since it was first put in place in the last fifteen to eighteen months, since it became official through 32 CFR and 48 CFR, has issued over 2300 level two certificates. So you can see the demand and the need is high for the third party assessment ecosystem. But to directly answer the question, the system is temporarily on pause, but contractors are not relieved of their obligations to meet the level two or level one CMMC standards. However, in November 2028, pause notwithstanding, contracting officers have the option of putting back the third-party certification or the self-assessment option in every contract, and that is per the regulations. What is interesting to note, and what is what's most surprising about the entire CMMC program, is back in an earlier National Defense Authorization Act, Congress had explicitly said within one year, which was many years ago. The DOD was supposed to put in a third party assessment system. CMMC is that system or was supposed to be that system, but is now once again on pause or in discussion. Brian: Right, so a lot of confusion there. and and because of that, there seems to be a lot of pushback. Don, from your perspective working with other organizations, what are you hearing from contractors and Jason from from your seat, what are some of the pain points driving the pushback? Jason Palmer: The problem is that the SBA did a hit job on the CMMC program. They said that the root of all evil is CMMC third party assessment. The third party assessment is actually the least expensive and the smallest possible aspect of CMMC. Quite candidly, for small organizations, a CMMC level two certification might cost as little as twenty five thousand dollars, the average being forty to seventy five thousand. Unless you're a really large company, it doesn't go up much higher than that. What People are complaining about is they're saying, it's going to cost me over a hundred thousand or two hundred thousand dollars to get CMMC compliant. Yes, but that's actually the cybersecurity requirements that you should have been doing for the last ten years since the Executive Order one hundred three one five six came out that said, Hey, you guys need to be compliant and protect CUI, then not called CMMC, just protect C UI per the NIST framework. So the money that they're talking about is if you don't have MFA, if you don't have encryption, if you don't have an incident response plan, if you don't have risk management framework, if you don't have vulnerability scanning, if you don't have endpoint protection, the list goes on and on. These systems cost time, energy, and money to put in, and theoretically, even for a small business, it could cost as little as ten or twenty thousand, or it could cost as much as a hundred thousand. So that's where the that's where the misinformation and pushback is coming from. is they're throwing the actual assessment piece, the last five percent of the process under the bus is saying, it's because of the audit that we have all these exorbitant expenses when in fact you should have invested this money years ago and been fully compliant so that at best it's like, we need to drop another twenty five to fifty thousand dollars for certification to keep our millions of dollars worth of contracts a very small price to pay in terms of the cost of doing business to prove to not only to the federal government but also to your primes That the supply chain is secure. Brian: So Don, what are you hearing from the contractor side of things? Ferndon Consulting: Right. So Jason's perspective is extremely practical. One of the challenges that a lot of the contractors have been having, it's less the larger ones, it's more the smaller ones. So the smaller you are, the harder it is to have a different individual assigned to each task to be able to hit all of these checked boxes. And then also to even understand what they all mean. It's like it has to do with your bandwidth. Say you are, I believe they were saying that in the United States we have a gazillion different. manufacturers, but we start breaking it down. The preponderance of our manufacturers, and I'll talk about these because I have a special passion for them as well, is that our manufacturers, they they they create everything that helps us to move, right? But many of them are small shops under 20 people. Now if you have a shop that's under 20 people and needs to be compliant with this incredible list, this checklist, right? They don't have the additional funds to be able to bring on someone To start going through and translating it all. Their expertise is in manufacturing. It's not in cybersecurity. They don't have the background, the the cognitivity framework, even, because that's not their area of expertise. So, because of that, we've had a lot of people who, well, I think I understand it, so I'm gonna check the box. This is actually part of the reason why we had so many people who self-attested to being compliant. They're like, I think, I think I understand. Well, no, according to another standard, you don't. Hence there being a bit of a pushback. a lot of the pushback has come from the smaller ones. Now a lot of these smaller ones were like, okay, we're going to become compliant because we really care about supporting our our United States federal requirements. We we want to support the defense industrial base. So they sought compliance and they encountered a lot of contractors and consultants who consider this more of a a money making machine. So they weren't sending the best and the brightest who had good understanding of what the manufacturers needed or their the way their systems could work. They sent people who could check boxes, who could check off the list. And this didn't really help because you'd have systems. Like one story that I heard about was someone invested over $100,000, and it was a fairly small manufacturer, over $100,000 to get himself to MMC level two compliance. went to get himself checked off. He had the people come in and assess him. He failed after be paying all that money. He paid for people to come back again. Again, more and more money he spent on this. And then he passed, and then he was hacked and had ransomware attack. All of this happened like within a month after actually getting it finally done, he had that happen. So where's the breakdown? He he was seriously on the struggle bus, and he just being the general term that I was using for this organization and company. But those types of horror stories are the ones that proliferate. And it's those types of horror stories where I spent 200, 300,000, $500,000 to try and do this because well. So the person who's coming in as the consultant, they say, Well, you know what, I don't understand your systems as they are and I'm not gonna try. So I'm gonna say you need to have all of these new ones. So let's rip out everything you got and replace them. Let's reset your whole system. And then you also have people who have like a manufacturing floor and they're told they need to secure that entire floor. Whether or not they actually do, that's part of the checklist. so do you have to secure absolutely everything or just everything that's touched? And there was not as much flexibility with some of the experts who came in to help prepare for this assessment. And Jason, I'd love to hear your thoughts as well on some of that too. Jason Palmer: I just want to push back on that a little bit and say general IT consulting or cybersecurity consulting is really the issue there. It wasn't necessarily that it was CMMC specific, although they may have gone to registered practitioners or registered practitioner organizations. And yes, the quality of the ecosystem, all of the IT security systems, is well, your mileage may vary, so I definitely agree with you there. But the issue that I would take is that it appears from what you're telling me that they had limited to zero cybersecurity upfront. And or unfortunately they just got a bad consultant. I'm not really sure which. But again, if you look even at the brilliant of the basics that the DOD is pushing now, most of that is the kind of stuff that you see in the USA today or that they publish during cybersecurity month, which this happens to be in October, about things like using MFA encryption, firewalls, host based access controls, zero trust and the like. And so I question just exactly how close to zero are your manufacturing clients. in terms of any cybersecurity or any even competent IT help. Ferndon Consulting: I do not know. And that's part of the frustration too is because we hear these stories and these stories proliferate, but you don't understand the true baseline. Jason Palmer: Mm. Ferndon Consulting: And maybe they they didn't have the best cybersecurity, that it wasn't up to these levels. How much can they afford if they're in rural areas? What's the exposure? What's the socialization of these concepts? So I don't know what those baselines are and where they came from. I just know the horror stories have been abounding. Jason Palmer: So I do want to add one more thing, and one of the things that I want to focus on is the fact that it's called the Cyber Maturity Model Certification for a reason, because it's a maturity model. And let me use passwords as an example. With limited exception, the standard does not tell you how complex your passwords need to be or exactly even what they should look like. And so if we're going down the maturity model route, you may start with a complex password, which is usually part of almost any standard. But then you may add in a second factor of authentication, which might be SMS text messaging. You eventually might graduate to an authenticator app, which would be some kind of multi-factor or biometric authentication as well. You're moving up the maturity food chain. In CMMC, our job is to simply confirm that what you say you're doing is what you're doing. So if all you can support is a complex password with an SMS message and that's your version of multi-factor authentication. So be it. We are just validating that what you are doing, whether it is the best practices that could possibly be done, we're not affirming best practices. We're affirming what it is you're doing that is your effort along the maturity model line or along the maturity bell curve. And so I think a lot of people get caught up when consultants come in and say, well, you have to use this or you have to use that. It's like, no. Should you use the best possible tools available? Yes. Should you use the best possible tools you can afford? Yes. Should you use any tool at all that at least helps you meet the standard? Absolutely. So any one of those three answers meets the requirement. It's not about, we have to rip and replace. So to your point, it's unfortunate that the consultants who you've experienced have not been able to come in there with a broad based understanding and say, how closely to what you have matches the standard or is acceptable to the standard? Brian: Is there any certification or such for these consultants that are coming in? How do companies find these consultants? Do we do we know? Jason Palmer: So, yes and no, there is the registered practitioner and registered practitioner organization testing and training. That is a self-training module. If you get a CCP, a CMMC certified professional, or a CMMC certified assessor, they go through advanced training. However, more importantly, they are required to have an underlying credential from the eighty-one.40.3 workforce list. And so that would mean they would most likely have something like a CISSP, the granddaddy of all credentials, or they'd have a CISA, like a certified information system auditor, or if they were just a CCA in an intermediate credential, they could have a security plus or a network plus from Comp TIA. And then of course if you're a lead CCA, you have something from the advanced credential like a CISSP, you would have a minimum of three years of cybersecurity audit experience and five years of managerial experience. And in fact, I will tell you that I have been tasked or tapped by a number of readiness firms who specifically want to work with CCAs and L C C A's, specifically to avoid the problem that Don is describing, where people that are just hanging a shingle and saying, I understand the CMMC requirements on paper, but I don't have any actual practical experience on the assessment side of understanding what the bar is that needs to be met. That's where I think a lot of the problem comes in. And unfortunately it's the same issue you see with managed service providers. I'm sure we have all seen, as has many of Don's clients, where there are those that are reactive. So only if something breaks will they actually fix it. And then there are those that are proactive, which means that when firmware c updates come out, once a quarter they're doing firmware updates. Once a week they're doing Patch Tuesday. Once a week they're doing vulnerability scans. Once a month they're meeting with management and reviewing any tickets and things like that. We need to shift from reactive to proactive and that is where some of the certifications come in in the eighty one forty dot three list because they're more managerial. How do you manage the security technology as opposed to just technically perform it from a syntax perspective? Brian: so obviously we've just been talking about the burden on the companies, but what what kind of burdens do C three PAOs have to deal with and what are some of the unique challenges on your side? Jason Palmer: So I am an assessor. I work for C three POs. Think of C three POs like big accounting firms. There's only a certain number of firms in the country that can do financial audits. There's a select number of firms right now bubbling around 100 that can do third party assessments for level two. I am an assessor, I'm one of less than 700 lead assessors, one of less than another five hundred regular assessors who can actually do the work. Most of the challenges we face is that clients are not ready for all the reasons that that are pain points for Dawn and for her clients. I would say early on in the assessment process, more than one and three became what they called a stop and mock. You would start doing the assessment, you would realize there was a huge disconnect between what the standard required and what the client had prepared for with or without a consultant, and then you would find out that there was no way they were going to be trending met, and therefore you decided to pause the assessment, or I should say pause the official level two assessment and turn it into what they call a mock or simulated assessment. A mock assessment is where you completely go through The entire set of 110 controls, 320 objects, except you are marking trending met, trending not met as a dry run. And then the client can go back, take that report, go work on the areas that were trending not met, and then come back hopefully a month or two later and say we're ready, and then you start the real assessment. It becomes a full level two assessment that is hopefully trending met. The number one issue really is the clients are not ready. The second issue is there are some administrative details that were being addressed in the request for information, which is that the standard requires that they assign three assessors to an engagement. And as Don pointed out, the average manufacturer is ten, twenty people. You don't need three people involved. You don't need a CCA and a lead CCA. One person can do the job. There's always been a quality assurance component. To any audit or assessment, which there is in CMMC. So the third person is that quality assurance assessor. And then there's an entire review committee, just like there is in financial statement issuance, where once the field work is done, another whole team reviews it and another whole team reviews it before a partner signs off, or in this case before the C3 APO signs off. So I would say that the number one problem is clients not being ready. The second is the staffing, and the third is the price pressure. And to Don's point, Some of the C three POs, your mileage may vary, some are more checkbox oriented, and some really do a thorough job. So just as an assessor, there's a quality issue, as there are in all industries across the board. Choose your assessor carefully. Brian: So right, right. Ferndon Consulting: Well, to that end, could I just even ask Jason, if you were a small manufacturing firm or a landscape firm, how would you recommend finding a good assessor? Like who how do you actually even find someone who's qualified and who has a good reputation who who would actually do a a solid job and and be honest and work with you rather than tell you what to do in their own framework of understanding? Jason Palmer: So I think you've kind of hit the nail on the head when you say these people are landscapers or manufacturers first, not necessarily contracting officers and expert at reading requests for proposal or vendor proposals. That is probably the number one issue. I would say first and foremost is talk to your associates in the industry through your trade groups and see who's used which assessors and what experience they've had. All of the assessors are listed on the Cyber A B marketplace. It's a directory just like any other directory, and you can start at the top and go all the way down. Certainly there are a lot that advertise. What I would say is the safest thing to do is to stay with one of the top 15 or 20. It's pretty obvious because they're the ones that have the largest presence on LinkedIn. They're the ones that have the largest presence at the CMMC and DOD contracting conferences. So those are the ones who you'd be pleasantly surprised. The largest ones are not only the most expensive because they realize they need to be competitive. So Yes, a lot of them are attuned to doing the large, large, large contractors, but many of them can do assessments in that maybe thirty five, forty thousand dollar range and still do a fully qualified, competent job that will meet the standard. But more to the point I would say be very careful of the ones that are advertising assessments. We get it done in a day, we get it done in two days. We're only fifteen thousand dollars, we'll beat any price. All the same things you look out when contracting for anything else you'd want to look out when contracting for a C three PO. But candidly, the best way to do it is if you've had a friend who's been through one, certainly attend some of the manufacturing and DOD contracting conferences where you can talk to people and get referrals. And last but not least, certainly talk to the MSPs that you're working with because chances are if they're in the DOD space, enough time has passed, almost two years, where People know people and people know who's doing a good job and people know who's doing a bad job. And just like the Better Business Bureau, look and see who has complaints filed against them, which become public record after a point of time. Brian: So it definitely sounds like there's a there's a large burden to to to get through this. But I'm I'm wondering maybe you both can address this. Do you do you feel that politicians and lawmakers who are pushing for the policies as they stand now completely understand what they're asking for? Or do you think or I guess do you wish they understood more? Ferndon Consulting: No, I don't. and the reason why I will say that is just a couple of weeks ago I was at a a manufacturing event, and one of our fantastic congresspersons is a fantastic congressperson, always proactive and out there, and an advocate for for these. It was a manufacturing one, so it was an advocate for manufacturers, and someone brought up a CMMC. And this congressperson, to not do any identification, was like, I know it's the worst thing ever. I'm doing my best to stop it. And it starts going down that. And I'm like, no, please, no, it's not that we need to stop it. And though the principles behind it are fine. And so, like that person's automatic reaction was, I know it's bad. We're trying, I'm trying to stop it. And that reaction right there made me realize the nuances are must not be understood. because and th this comes from my background, If we say, hey, we need to remove this accountability for CMMC level two, like you were saying, is because we didn't have outside people coming in, and these people they're experts in their field, they're not experts in cybersecurity, cyber resilience in this area, when we remove the outside assessment and confirmation that someone's at that level, often people are not at that level, which ends up making these hardworking manufacturers the ones we want to preserve, or be they other things, landscape, what all of the people who are laboring. They become the weakest link in in the greater government information ecosystem. And that makes them more targetable. And and that's what we don't want. We want to take care of them. We want to preserve them. We want them to be safe. Jason Palmer: I have to agree, the politicians do not really understand what CMMC is. They don't understand that even if CMMC didn't exist, that all the contractors would still need to comply with the seventy twelve components of their contracts where they have signed on the dotted line that said they will keep their data compliant. One of the other big problems is the fact that without going into details of the particular policy names. There are some new regulations that it will be affecting DOD contractors and government contractors regarding incident response reporting. There is no alignment, though there is supposed to be. Does that mean that if I do a CMMC quality incident response report, that that's going to meet the new requirements from CISA? Probably not. And so if the politicians and the lawmakers and the regulators all had their act together, they would say, hey, let's agree on a uniform standard for incident report responding so that you don't have to have One for the DOD, one for the SEC, and one for CISA, and one well, just because why not have an extra one? So that's really the problem is that there's a lack of alignment of the regulations. And remember, Congress themselves said back in the NDAA that the DOD should be putting in place a third party assessment program. Well, this is that third party assessment program for them to sit come out and say it's the worst thing ever means they really don't understand that all it is is a validation that you are doing what you said you were going to be doing. And therein lies a key part of the problem. I will add one more thing. You know that the DOD CIO's office came out with the brilliant to the basics. Well remarkably if you look at the brilliant of the basics against the framework, it's actually much harder. And without getting into some nuance, it actually has things that supersede and exceed things in the MFA category and password protection and certain encryption requirements. Things that they think are like common sense, which by the way, all of them are, are significantly harder to do and add about twenty percent more requirements than are actually in CMMC. So if you can't do CMMC, doing brilliant to the basics is gonna be even harder, even though they thought, this is gonna be so much easier. But it's not. Also, brilliant to the basics has no validation requirement of any kind. It is a best practices suggestions, and I will finish where I started, which is that if companies had been basically cybersecure from day one, we would not be having this conversation. Brian: Well that does seem like a good place to end unless either of you have any closing comments. Jason Palmer: I do actually. To the manufacturers who may be watching this, understand that CMMC is essentially a documentation project. If you have a competent MSP, if you've been in business for a number of years, chances are you actually do have most of the cybersecurity you already need. In other words, you probably have endpoint protection antivirus, you probably are using a complex password. You might even be using multi-factor authentication. You're probably using some level of encrypted Wi-Fi. You probably are already locking up all your documents at night. What you haven't done is you haven't documented the process. Areas where you may need some additional documentation, you probably need to focus on writing a real incident response plan. Maybe you've never really thought about risk management. You probably do when you're buying a new piece of equipment. You probably do when you're trying to figure out how to machine something. What are the risks of doing it one way or another way? Well, the same types of pro problems and processes exist in dealing with cybersecurity incidents. These are not that difficult to add on. And I would say that most of the companies are probably 70% of the way there and just need a little bit of documentation. Now, the reason I call it a documentation project is because once you're finished with the documentation and critically think about those processes and procedures that you're doing, you're going to magically realize you've just improved your cybersecurity health. Because maybe you weren't using the best MFA, but now you're using a better multi-factor authentication tool. Maybe you're going to improve your passwords. Maybe you're gonna up your logging information. Maybe you're gonna get some kind of dashboard from your S MSP that shows you the next time someone tries a phishing attack. Maybe you'll be training your staff better in how to protect against unauthorized wire transfers or someone sending a fake invoice to be paid, or even someone trying to get to grab copies of your plans or data. So the byproduct of CMMC is it ups your cybersecurity game. So that's another way of looking at it, is looking at CMMC as a roadmap as to how to get more secure and protect your data and protect the national supply chain. Brian: Great. Anything else, Tom? Ferndon Consulting: No, I think Jason covered a whole bunch of it. Brian: He certainly did. Ferndon Consulting: yes, he definitely did. And I'm hoping that we'll be able to get some of the URLs and maybe some of those informations that Jason put out so we can put that in the notes here so that if someone's actually looking for, hey, where do we actually again find that list of the the companies who can do the assessment so we can actually bet them according to what Jason was saying, the top fifteen. We can even put that in the notes so someone knows exactly where to go. Brian: Yeah, that sounds perfect. Jason Palmer: Absolutely. I will provide you with a link to the Cyber A B marketplace and to a few key reference sites online where contractors and manufacturers themselves can go read about the standard and have it explained in plain English. Brian: Okay, well those will be Ferndon Consulting: We like plain English. Brian: in our notes. Ferndon Consulting: Thank you. Jason Palmer: Thank you. Brian: All right, well thank you. So thank you for tuning in today and a reminder that all of our podcasts are available on YouTube, Apple Podcasts, Spotify, and other services. You can find links to all of these and more at podcast.fernton.com. I am Brian LeClair, and this has been another episode of The Decision Advantage.