Latest / CMMC Compliance Guide / SPRS Scoring Explained in Plain English: How the 110-to-Negative-203 Scale Works and How to Fix a Bad Score

Transcript

SPRS Scoring Explained in Plain English: How the 110-to-Negative-203 Scale Works and How to Fix a Bad Score · CMMC Compliance Guide

• 0:21
  SPEAKER_01: Hey there and welcome to the CMMC Compliance Guide Podcast.
• 0:25
  SPEAKER_01: I'm Austin.
• 0:26
  SPEAKER_01: And I'm Brooke from Justice IT Consulting, where we help businesses like yours navigate CMMC and NIST 800 171 compliance.
• 0:35
  SPEAKER_01: We're hired guns, getting companies fast track to compliance.
• 0:39
  SPEAKER_01: But today we're here to give you all the secrets for free.
• 0:42
  SPEAKER_01: So if you want to tackle it yourself, you're equipped to do so.
• 0:45
  SPEAKER_01: Let's dive into today's episode and keep your business on track.
• 0:50
  SPEAKER_01: Today we're talking about SPRS scores or Spurs scores.
• 0:55
  SPEAKER_01: A number that can quietly decide whether your company is even eligible to bid on a DOD or DOW contract.
• 1:03
  SPEAKER_01: It runs on a scale from 110 all the way down to negative 200 something.
• 1:08
  SPEAKER_01: And defense contractors have already paid millions of dollars in false claim settlements over getting that number wrong.
• 1:15
  SPEAKER_01: We're breaking down exactly how that scoring math works.
• 1:19
  SPEAKER_01: What score actually counts is good enough.
• 1:21
  SPEAKER_01: What changed in the rules this year, including the July class deviation that put a CMMC phase two suspension into contracting practice and how to make sure your number is accurate before a government audit finds you, which accuracy, the most important thing there.
• 1:40
  SPEAKER_02: Brooke, thanks for joining us today.
• 1:43
  SPEAKER_02: Absolutely.
• 1:44
  SPEAKER_01: Well, let's start there.
• 1:46
  SPEAKER_01: What is SPURS or SPRS really?
• 1:49
  Brooke: Uh well, Spurs is uh everybody calls it Spurs or SPRS.
• 1:54
  Brooke: Uh it stands for uh supplier performance risk system.
• 1:58
  Brooke: Um uh it's a Department of Defense-owned uh website uh database um that is the authoritative source for the DOD to um retrieve supplier uh product performance and and risk, of course, is what the name stands for, right?
• 2:18
  Brooke: Uh anyway, it's look it's a place for them to look and see your um what you've either you've reported your score to be, or uh if you've got an assessment, it's it was uh uploaded and transferred over to Spurs for you.
• 2:32
  Brooke: Uh so uh you know what came of that assessment?
• 2:36
  Brooke: One of one of one of the way uh one of those ways.
• 2:40
  Brooke: So um the uh I think it this actually came um took its current form around 2018, so a little bit after uh well, right about the same time um uh CMC and the SNIST 800 really um took flight, I guess, uh at the end of 2017.
• 3:00
  Brooke: So uh but it started way back from uh the Navy's and I don't know how you pronounce it, but the PD rep system back to 89.
• 3:10
  Brooke: Uh but in any case, uh that's what the Department of Defense looks looks through uh to uh verify either your self-reported score or your uh third party uh third party attested score.
• 3:26
  Brooke: So um it's changed here of late, but I think we're gonna get into that.
• 3:30
  Brooke: Uh it's it's the same, it just it's it's harder now, uh ostensibly.
• 3:35
  Brooke: So I think we're gonna get into that in a minute, but that's basically what Spurs is.
• 3:39
  SPEAKER_01: Well, that's another thing I never realized um until recently, uh not being uh you know uh a direct compliance person myself, but uh I didn't realize that your third-party um assessments actually ended up in in Spurs or SPRS.
• 3:55
  Brooke: Yes.
• 3:56
  Brooke: Uh they do.
• 3:57
  Brooke: And so uh whenever you get an assessment, uh they upload that to EMAS, uh, and uh from there it gets uh sent over to Spurs and shows up as a uh third-party validated um uh score for you as opposed to self uh self-assessed.
• 4:15
  SPEAKER_02: Very cool, very cool.
• 4:17
  SPEAKER_01: Well, let's get into the the next thing that uh typically uh is confusing people and it's it's obvious why.
• 4:25
  SPEAKER_01: I mean they they have uh you know a score that can go from 110 points to negative scoring, um, you know, which is uh all the way to to negative 200, which is uh a confusing concept for people to grasp.
• 4:39
  SPEAKER_01: Um and um it is not the easiest just to uh to grab uh and understand why.
• 4:46
  SPEAKER_01: So um can you break down what that 110 point plus scale, or I don't know what you want to call it, but it's not just a hundred point point scale or 110 point scale goes you know further down than that.
• 5:01
  SPEAKER_01: So I don't know, is it 300 plus point scale?
• 5:03
  SPEAKER_01: Who knows?
• 5:04
  Brooke: Yeah, 313.
• 5:05
  Brooke: So that's uh negative 203, actually, all the way to 110.
• 5:09
  Brooke: So yeah, it's uh you you there's a scoring methodology uh that you can download, but most everything will show you.
• 5:18
  Brooke: I don't know about most everything, but um we'll show you what the uh points are for each of those controls.
• 5:25
  Brooke: And on each of those controls, mind you, there are between one and one in one in five or six uh uh assessment objectives all the way up to, I think there's 16 on one of them.
• 5:39
  Brooke: Uh what is A through O.
• 5:41
  Brooke: Is that 16 of them?
• 5:42
  Brooke: So uh anyway, so there's there's either one or multiple assessment objectives that goes into each of those controls.
• 5:49
  Brooke: And if you miss one of those assessment objectives, you you that control is not met.
• 5:55
  Brooke: And so whatever points are assigned to that control, uh you start off at 110.
• 6:00
  Brooke: So if you miss a five-pointer, then you take five points off of that, and now you have 105.
• 6:05
  Brooke: Uh, if you miss one, if you miss a three-pointer after that, now you have a 102, and so on and so forth.
• 6:12
  Brooke: Uh so there's uh as you start, like I said, you start at 110, you start deducting for everything that's uh every control that's not met.
• 6:22
  Brooke: And again, a reminder that if one of those assessment objectives for that control is not met, then that control is not bad.
• 6:30
  Brooke: Uh, you don't get partial credit for any well, I'll take that back.
• 6:33
  Brooke: You do get partial credit uh for the FISP validation, it's either five or three points.
• 6:38
  Brooke: So aside from that one, uh you don't get any partial credit.
• 6:43
  Brooke: Uh so there are um got some notes here.
• 6:47
  Brooke: So uh five-point deductions cover 43 requirements, uh three-point deductions, there's 14 requirements, and then the one-pointers are 51 of those requirements.
• 6:57
  Brooke: And I think on those, there are uh quite a few of those one-pointers uh that you can't POAM, you can't put on a POM, and you can't put any of the three-pointers or any of the five-pointers on a POM.
• 7:08
  Brooke: So if you miss any of those, uh then you you you can't report your score.
• 7:15
  Brooke: Uh, if you miss them on an assessment, uh uh which are the I guess the assessments are not paused, but the requirement uh for the certification assessment is paused on contracts.
• 7:27
  Brooke: But if you miss one of those on a on a um certification assessment, uh then it's just over, unless you know they give you a little bit of time if it's just uh Passfail.
• 7:38
  Brooke: Yes, pass fail.
• 7:39
  Brooke: Uh so they give you a little bit of time to say, you know, hey, yes, I did have this documentation, it's right here, I just couldn't find it at the time, you know.
• 7:47
  Brooke: So they they give you a little bit of time for something like that, but if you're just actually just failing it and you don't meet it uh for whatever reason, uh then that it's just over.
• 7:57
  Brooke: You're you're you failed it.
• 7:58
  Brooke: So um, and so if you take all that in consideration and look at what the things you can poem, they're all the uh all of them are one-pointers, which are the which are the easier ones to implement.
• 8:12
  Brooke: So um yes, it it could be likely, it could be you could miss some of those one-pointers, but you're more than likely, it's more likely to miss a five or a three-pointer, because those are tougher ones to uh to negotiate.
• 8:25
  Brooke: So um, in any case, you start off at 110, you start deducting points for every control that's not met.
• 8:32
  Brooke: And uh, if you're not careful, you can end up negative, and um uh you could even end up at a negative 203.
• 8:38
  Brooke: Some, you know, when we go do gaps analysis uh for people, uh, and um we say, here's your score, it's uh it's a minus 163, they're like, how did that happen?
• 8:50
  Brooke: You know, it's like well, it's because most of it's documentation that you're missing.
• 8:54
  Brooke: And there's there's documentation is part of most controls on there, and so if you don't have the cop the that documentation uh available in a line, then it's then you miss that control.
• 9:10
  SPEAKER_01: So you start with 110, but the deductions don't actually map to the 110.
• 9:16
  SPEAKER_01: So it's like all the deductions added up don't equal 110, they eyqual negative 203, right?
• 9:21
  SPEAKER_01: Is that kind of how that works?
• 9:23
  Brooke: Go figure that out.
• 9:24
  Brooke: Yeah, yeah.
• 9:24
  Brooke: Somebody come up with some awesome math there.
• 9:27
  SPEAKER_01: Well, it it seems like the intention of the scoring is um you really should be perfect.
• 9:32
  SPEAKER_01: And uh for anything that you're not perfect on, you get outsizedly, you get um, you know, dinged on outsized, uh, more than you know, is proportional to um the score of 110.
• 9:46
  SPEAKER_01: So I think I think the point of their scoring system is well, you just better be perfect.
• 9:51
  SPEAKER_01: I mean, that's kind of what it sounds like to me.
• 9:53
  SPEAKER_01: You know, they they want you to do it.
• 9:56
  Brooke: You know, that's one of the things that we put in our uh response to the RFI uh for the pause, is that the whole poam thing, uh not the the non-POMable uh thought is just stupid.
• 10:11
  Brooke: And that's why that's why people go out and buy mock assessments because they're afraid of uh missing one of the five-pointers and one of the three-pointers that's not obvious to them, you know.
• 10:23
  Brooke: Uh, whereas if you could poam, if you just had to have a minimum score, uh, you know, 88, like like is current, you know, and uh you had a six months to a year, you could poam anything, but uh, you know, you had six months to a year to um to cover that.
• 10:40
  Brooke: Uh, and then they come back, and at that point, you either keep your contract or lose your contract at that point.
• 10:46
  Brooke: So um, I mean that would be the better way to go about it, but um I'm not the government brainiac that came up with this thing.
• 10:54
  SPEAKER_01: So well, yeah, it it seems like uh it'd be a lot less intimidating to to go spend your um you know forty, sixty, seventy thousand dollars or whatever on assessment if if uh you had the chance to to fail something, but you know, have it looked at three months later after you fixed it, um, and and you know have that uh item addressed and then but within a time frame, but that's not the way it works.
• 11:23
  SPEAKER_01: It's uh it's more or less at the moment and how it sits, it's uh it's a pass fail, and the number of things you can really um uh get wrong is like you said, it's more of like uh I just couldn't find it at the time or my my computer is glitching out, and you know, uh we had an issue uh when we were doing the assessment or something.
• 11:44
  Brooke: So um you know we actually had that happen during assessment.
• 11:47
  Brooke: Um we were going to uh remote onto uh our client's computer to help them run a help them run a uh uh an admin privilege command to show that it was blocked and it couldn't be run, and uh and we couldn't connect to it.
• 12:03
  Brooke: I mean we we do this every single day.
• 12:06
  Brooke: You know, that's what our job is.
• 12:07
  Brooke: We connect to computers all day long, every day, and uh, you know, fix problems and everything, and we couldn't connect to that one person's computer during an assessment, of course, you know, and uh that wasn't a big deal because at the end of the day or the next the next morning we came back to it and said, here you go.
• 12:26
  Brooke: Because at the during an assessment, uh at the end of the day, they have a hot wash uh saying, you know, here's here's where we're at, and then the next morning you can say, All right, this this one where you said we we missed, or or like we we couldn't address it because we couldn't connect.
• 12:43
  Brooke: Um you know, we uh uh you know, we you say we need to go back and address that one, and they let you do that.
• 12:50
  Brooke: So anyway, we cleared it up the next morning, but it was embarrassing not being able to connect to that computer for whatever reason.
• 12:57
  SPEAKER_01: Yeah, I mean that's the way it goes.
• 12:59
  SPEAKER_01: I I sat down for uh a Zoom call the other day um on time and everything else, and my battery backup at my my desk just uh immediately started screaming and lights and and sounds and everything, and I was late for the call.
• 13:13
  SPEAKER_01: You know, it's uh you know, that's just how things go sometimes, right?
• 13:17
  SPEAKER_01: But uh the assessments count for that, not for you know, you not having sufficient.
• 13:23
  SPEAKER_01: So um, so uh I think the one thing that we did miss um that we we see a lot when we do our gaps analysis um or assessments, you know, whatever you want to call them, um, is that if you don't have um you know an SSP, um yeah yeah so a lot of people fill out their SPARS score, SPRS score, um, you know, and lacking documentation or an SSP because they have the technical implementation in place.
• 13:51
  SPEAKER_01: Um and so they think that they can answer, you know, their their spurs score according to that.
• 13:58
  SPEAKER_01: Um in reality, whenever you are scoring yourself and then reporting it, you have to account for the fact whether your documentation is in place and sufficient, sufficient enough documentation.
• 14:11
  SPEAKER_01: It can't just be a template you've got sufficient current.
• 14:13
  SPEAKER_01: Right.
• 14:15
  SPEAKER_01: So one thing that surprises people a lot is um, you know, we come and give them their score and it's just not scorable in A, you know.
• 14:24
  SPEAKER_01: Um, and they go, what's that about?
• 14:25
  SPEAKER_01: You know, I've got you know this, that, and the other, and we go, well, uh that's just not how it works, right?
• 14:33
  Brooke: Yeah, so that you're right.
• 14:34
  Brooke: That one uh there is one control 3.12.4, I believe it is.
• 14:39
  Brooke: Um, and if you miss that one, uh that is your SSP.
• 14:43
  Brooke: And if you don't have your SSP complete, uh I mean you've got to have it complete, not that you just have one and you have a few things filled in.
• 14:51
  Brooke: Uh so if you if you don't have that SMM SSP system security plan uh finished up and and complete, then you just miss that one and you miss the whole, you fail the whole test.
• 15:03
  Brooke: But when you're getting a certification assessment, that's phase one, and they say, you know, we need to see your SSP and know that you have this stuff, right?
• 15:13
  Brooke: And so you give them that.
• 15:14
  Brooke: And if they look at your SSP and say, Yeah, this is not complete, you're not ready.
• 15:19
  Brooke: And so they'll they'll stop the assessment there and won't go on to phase two.
• 15:23
  SPEAKER_01: Which if you ask an assessor or a C through PAO, um, they'll say that's where most uh assessments get derailed and rescheduled is that that phase.
• 15:32
  Brooke: A whole yeah, that that is a very common thing for assessments to get rescheduled from that from that uh phase one.
• 15:39
  SPEAKER_01: Yeah, and so I'd I just think this is really important that people just you can say it 10 times and people just don't get it.
• 15:45
  SPEAKER_01: Um and so that's why I wanted to uh and I don't mean that in a negative way, it just is what it is.
• 15:50
  SPEAKER_01: Um so I really wanted to call that out and make sure that people realize that because the you know the real life or legal implication of it is if if you had reported a Spurs score, you know, SPRS score, um self-tested or put it in the website, you know, at any point in time and it says 88 or 60 or 110 or potentially even 100 negative 163 or something, um and you don't have your documentation, um, then that's still, you know, um the the basis for a false claims act.
• 16:26
  SPEAKER_01: Uh right.
• 16:27
  SPEAKER_01: I mean, because you you misrepresented yourself.
• 16:30
  SPEAKER_01: Even if you gave yourself a low score or didn't do 110, you have misrepresented yourself, and that is what makes a false claim, not um not anything else, right?
• 16:41
  SPEAKER_02: Right.
• 16:41
  Brooke: Yeah, absolutely.
• 16:43
  SPEAKER_01: So the next note that I had that I wanted to hit on, but I think we've kind of addressed it, but I'll just ask it for the sake of clarity is um can a company be missing just you know one or two controls and still end up with a really bad score?
• 16:58
  Brooke: Uh depends on what you mean by a really bad score and just one or two controls.
• 17:03
  Brooke: One or two controls won't put you into a really bad score range because at the end of the day, well, unless one of those is one that we just talked about, 3.12.4, the SSP.
• 17:14
  Brooke: If you're missing that one, yeah, that's that's uh that's bad.
• 17:18
  Brooke: But if you're missing a couple of five pointers, um that does put you, you know, at a hundred, right?
• 17:23
  Brooke: 110 minus five minus five is is gonna be a hundred if I did my math right.
• 17:28
  SPEAKER_01: Uh don't ask me.
• 17:31
  SPEAKER_01: Uh you I people talk math, and I start going, well, you know.
• 17:34
  Brooke: Right.
• 17:35
  Brooke: So uh so no, it won't put you just missing a couple won't necessarily put it put you in a bad spot, but uh those those five pointers and three pointers add up quick.
• 17:45
  Brooke: Um so and you can see uh a two five pointers and one one-pointer puts you under 100 already, right?
• 17:54
  Brooke: That puts you at 99.
• 17:55
  Brooke: So uh it it decreases really quick.
• 17:58
  Brooke: And it it is not when we're doing those gaps analysis and and getting everybody's and then fleshing out the SSP and the policies and POAM and stuff before we get to really to implementation, it is common to see those scores in the negative 63, negative 70, negative 50 range.
• 18:21
  Brooke: That is not uncommon at all.
• 18:23
  Brooke: And it shocks people.
• 18:24
  Brooke: And you know, we look at our little chart of everything, a little pie chart, and it shows a whole bunch of red all the way around it, and they're like, I how did that happen?
• 18:32
  Brooke: Well, it happened because you you just didn't know, you know.
• 18:37
  Brooke: And um, so uh so yeah, that there's those do add up quick to your point.
• 18:44
  Brooke: Um, and not necessarily two of those being missed, but not very many of them being missed can put you under an 88 pretty quick.
• 18:53
  Brooke: Uh, an 88 is a minimum score you're you can have uh to post your score.
• 18:58
  Brooke: Um, and the minimum score that you want to have uh for you know uh for primes or or uh the government looking at your uh score to figure out if they want to give you a contract or not.
• 19:11
  Brooke: Um in fact, we just had one of our clients here recently um uh tell us that the the Navy said that they um they needed to uh get their score and it needed to be at least an 88 for them to even be even consider giving them a contract.
• 19:29
  Brooke: And so um luckily they were there, but um you know anyway, bit I found that very interesting that the Navy just came right out and told them that, you know, which I guess shouldn't necessarily be that interesting, but it but it is so to me.
• 19:47
  SPEAKER_01: So I think you would just address this um in kind of in part, uh uh on our last question, which is uh what score do you actually need to bid or hold a contract?
• 19:59
  SPEAKER_01: Um and that's what everyone always wants to know, right?
• 20:03
  Brooke: Yeah, uh you know, there's nothing well, I guess actually, uh now uh you really do need an 88 uh to be able to bid on a contract, uh, but there's um there's no uh you you really need to have at least an 88, and you can't have any of the non-POEMO items POE end.
• 20:28
  Brooke: Um uh if you do, and I we don't enter our own score into SPRS.
• 20:34
  Brooke: We've never had to.
• 20:35
  Brooke: I just go off of what clients tell us.
• 20:38
  Brooke: Um so uh from what I understand, uh this may be uh there may be too uh caveat to this, but from what I understand, a change they made just recently, um you have to put in uh when you report a self-assessment, uh you have to put in what uh what controls were met, what were not met, uh, and then you know your minimum score has to be at least an 88.
• 21:04
  Brooke: Um if you're trying to put in a non-poemable item as not met, uh then it won't let you submit your score.
• 21:12
  Brooke: I think there may be two different parts of that.
• 21:14
  Brooke: There may be a NIST uh section and a CMMC section.
• 21:19
  Brooke: I'm not real sure.
• 21:20
  Brooke: Um, but in any case, you really need to have an 88 uh to be able to uh to be able to bid and to be able to uh uh absolutely win a contract, right?
• 21:31
  Brooke: Um and if you do have that, uh you've got six months to clear that up.
• 21:38
  Brooke: Um whenever you report that, um, you do have six months to clear that poem up and get it to a hundred.
• 21:45
  Brooke: Uh excuse me, a hundred percent with a hundred and ten, that would be.
• 21:50
  Brooke: Uh you have to get your poem, you have to get all your poem items cleared out within six months.
• 21:56
  SPEAKER_02: Yeah.
• 21:57
  SPEAKER_01: Yeah, and it's you know, um we're not lawyers here, you know, uh just caveat everything we're saying with that, but um, you know, it's a lot of these like government forms and and stuff, um, and I think Spurs and Espirus tend to fall in that um category when people fill it out sometimes.
• 22:19
  SPEAKER_01: Um they can do feel like uh you know we'll just fill it out to my best of my ability and and I'll be fine, you know, just you know whatever seems right, you know, or um but you know for Spurs this this stuff really matters because um you uh you are putting you oftentimes what you're putting in there you don't realize what you're committing to right um and it's by saying or representing yourself in that portal with a certain score and and other things you are telling the government and there's definitions out there you can you know find them exactly what you're doing um and you know that's not necessarily stated on you know the website whenever you do it in full in in its entirety right should they yeah I think they probably should you know make it a little easier and cleaner and better and easier to understand.
• 23:16
  SPEAKER_01: I don't think the government is ever ever uh really good at making things clear you know yeah yeah there there's a reason there's a whole industry for filling out your taxes right I mean it's uh you know uh it's a whole thing so that uh postcard entry for your uh to fill out your taxes right since I was in high school yeah it's uh it's been a couple years back just you know uh I'm not gonna be that mean I was gonna say just a century or two but I won't be that mean.
• 23:47
  Brooke: I think you just were well you know that's how I could be mean without not you know not seeming mean right yeah yeah so no no um yeah so it's uh you know it it's it is important that you pay attention and you know what you're doing and you know what you're signing up for whenever you do this because we have had people um you know that uh you don't really realize what they've done and then you know if you've if you've said it then you you have to do it right so um and and maybe if you've said it and you're not doing it you might want to do it pretty damn quick you know uh you know we've had we've had clients that said you know we do their uh gaps analysis and get their poem and everything done and and they're at whatever it may be, you know, uh a 20 or a negative 50 or something like that and they say well you know and then we have the implementation plan and everything they say well we reported 110 you know we really need to be there how how quick can we get there?
• 24:57
  Brooke: It's like well that's an issue.
• 25:01
  Brooke: So uh so you got you got to be careful especially uh with all these false claims acts investigations and everything uh coming about you just you just got to be careful and make sure that your score is accurate and and that uh well because you're legally representing that you are meeting those controls that you have that score that you actually did a self-assessment and they're not gonna accept the fact that you looked at it and went check check chick check yeah you know they're not gonna say you know if you say well I didn't know I was supposed to do blah blah blah they're gonna say well it's it's here in the simple language we described right here what you're supposed to do you know um so you it's it's up to you to make sure that your score is correct and accurate.
• 25:48
  Brooke: Yeah and I brought this up um before and I'll bring it up again because you know I guess it's been a couple episodes since I have but um you know whenever you you you hear the news or you know we see someone getting arrested for this that or the other and it's some big crime you know or it's uh you know um you know embezzlement or some um big crime or um you know headline worthy like big deal makes them look like a really bad person or giant criminal right um and then oftentimes you like if you don't follow that trial all the way through you know from arrests and and um then being accused of it uh whatever you call that um uh charged I guess for it all the way through to the actual trial and what actually sticks and most of the time a lot of that stuff come comes off right um the the big you know hard hitter uh uh charges unless it's just late and clear as day but most of the time if you were to follow that trial and this is just you know an example all the way through um to the end what they typically end up getting people on most of the time um they may not have originally got them on the big you know um big you know racketeering charge or whatever it is or you know I don't know um and uh what they do get them on is well you said this to us but what we actually found out when we did our investigation is it was actually this or you know and so they get them on misrepresentation or essentially lying to the government right um and so and then that's what they um uh hit them over the head with and and and get them into trial or get them in jail or or use that to have them you know plea something right um so my point with that just is uh like the the real risk is um your misrepresentation right um that because that is like if you were what the the governments want to if you were to be worried about uh a false claims act or the legal liabilities you're signing up for some people aren't and that's fine if that's you then that's not me that's not me but some people aren't worried about it they're just like well if it happens it happens you know um you know and I'll I guess go to jail you know I don't know what they say if it happens it happens but anyway um you know if but if it is something you're worried about then then that is like your your highest risk right um because that's what people get gone on all the time is misrepresentation so you really want to pay attention to that because that is probably the most important thing um and all of it comes back to documentation and can you prove you know um that whenever you submitted that score that you had the you know uh you're you're doing the things that you're saying you're doing right right absolutely yeah and those you know most of the time it's a whistleblower uh and I don't remember what they um they call them they're not enablers but uh anyway um the people that report uh the whistleblower um the whistleblowers that report these things um one they get a cut of the of whatever the fine is so the person that uh yeah the person that turned in honeywell you know they get twenty or thirty percent of uh two point whatever million dollars so they they get a little they get a nice little haul there uh for turning somebody in so they gotta remember pay off your house you know yeah gotta remember that uh but uh that that kicks off an investigation and you're right and and that investigation they start looking and saying uh you know here's all the controls here's what you said you were doing uh you said you had 110 but yet most of these we can't find any evidence for you know um or it looks like you just phoned them in you know you don't have you don't actually even have a a a real authorized user list you know what happened to that you know so yeah that's um that's big deal and and whatever they find in that investigation that you're gonna you know if it's something that's uh truly you thought it was this and you had it covered but it's really this there's a likelihood that if you made a if you made a good effort to actually do it correctly then you're gonna be fine.
• 30:20
  Brooke: But if you didn't make that effort and a lot of people don't like you said that was what we're talking about people just putting a score in where they just kind of guess at it uh you know that that's what gets you in trouble not the not the legitimate not that the legitimate tribe won't get you in trouble but at the same lot less of a chance of getting you in big trouble than just phoning it in absolutely absolutely well that you know that's why we we don't think we've said in a while but we always say documentation documentation documentation right because that's that's what they want and that's what they're looking for.
• 30:53
  Brooke: Yep I need to find that shirt and wear it again.
• 30:56
  Brooke: There you go yep absolutely need to do a reorder um you know and get uh get some fresh threads you know right okay so there have been um next thing I want to cover is there's been a lot of changes um you know in 2026 um all the way from February July September um and so I just want to cover those real quick and then also just want to note we're recording this on uh the 16th of September and we have not heard anything after the 60 day pause um you know uh from the DOW or uh do you know and uh shock we all thought that we were gonna get a you know um no pun intended but a bomb dropped you know on Friday some sort of guidance some sort of you know uh we we upset the apple cart pretty big so here's what we're planning you know something yeah we got not a Nada not a thing not a thing not a peep nothing so with with that in mind you know we we have this you know pending maybe they'll address it maybe they won't um you know pause that they they did but there's also been other changes right and so can you know as we're sitting here waiting for them to say something um you know can we address where we're at with with the changes that have happened sure sure uh so uh really um what happened was uh right after so we all know about the memo that they released and the announcement that they made that said um the certification assessments cost way too much they cost half a million dollars or more and uh we only have a hundred assessors neither of which was correct but I digress um uh yes uh what they're come everybody keeps conflating compliance with certification you've got compliance and then the certification that was meant to validate that compliance right and so they say certification costs too much all these C through PAOs you know they're just out to get rich this that and the other uh and so the DOD said we're pausing the certification requirement on uh contracts right that's what they did on July uh third 13th um so um fast forward uh 60 days they said it's a 60 day pause uh so uh it's August 13th uh September 13th and really when you do the math I think it was September 11th actually was was uh was 60 days uh but however you measure it um if you say the 13th then that's on the weekend and so the 14th was a Monday uh we still don't have anything but a few days after uh they announced that pause in dramatic fashion um at least you know maybe not for the 345 million other Americans that don't pay attention to CMMC but for everybody that does pay attention to CMs you know so it was dramatic fashion right so but they did release a um a class deviation and that class deviation let me uh and actually it was an update I got some notes here to make sure I get the uh dates and everything right so actually they they issued a uh the first class deviation uh in February um as part of a broader FARS and DFARS over overhaul um they're trying to bring FARS and DFARs into alignment and everything we saw that then and we're like oh well this is you know this is just um a proof and an example that they're trying to bring this all together uh you know across the whole government and make it make it the same maybe not everybody under CMMc but under the COI some sort of COI rule and make it uh make it make that part the same across all the government right so that's what they did in February.
• 35:07
  Brooke: So uh July they made the announcement they uh they updated or revised uh that class deviation uh so there it's the same class deviation 2026 00025 um and so uh if you refer to that class deviation now you've got to say which revision you're talking about so which uh you know I don't know which is what's better to do and but this is by law this is the way they did this right to get it everything legal and and all that kind of fun stuff so the one that they released uh in July on July 16th um basically said uh it put in writing uh what the memo uh put into law uh or into this class deviation what uh what was gonna happen um what the memo said was gonna happen or what they announced right so in other words it directed the uh contracting officers uh to uh take out uh either remove or revise third party requirements and new and existing solicitations and contracts um and then with existing contracts cleanup of the next option exercise I believe is what it said um so then they issued another revision uh on September 3rd just a few days ago uh that that initially people looked at and said oh my god here's proof they're putting it all off and you know well that class deviation didn't really change anything from the July 13th as far as CMMC is concerned uh it added some uh it added some things to it you know Chinese equipment that you can't buy and stuff like that so uh there was some housekeeping things like that that it that they that they put in that revision so they're now they're on revision three that was issued September 3rd but really the meat of it for as far as CMMC is concerned uh was on uh uh july sixteenth so uh that really just put uh put into effect what the memo said the memo said that you know they're gonna put off these uh assessment certifications being required on contracts and that's what that uh class deviation said uh in on July 16th um so the really what that means is you need to look at your contracts and figure out what's actually in your contracts if there's been any updated language come out from your prime or the government about that contract uh and all that kind of fun stuff so uh if there was a certification requirement in it um it probably is not there anymore but don't trust us go look talk to your contracting officer or the program manager whoever you might need to talk to talk talk to them and make sure that you know what you have there look at your documentation look at your contracts look at your POs and make sure you know what's in them uh you you really uh you really need to do that rather than say well Brooke said on this podcast that uh you know we didn't have to worry about the certification so uh and then again some primes from what I understand uh still want you to get a certification uh because uh that reduces their risk a lot so uh once once you have that third party validation that you're meeting all those 110 requirements and you're good uh then they can trust that as opposed to you saying yeah I did a self-assessment and I think I'm great you know so um the the third party validation is a lot more uh carries a lot less risk yeah I mean it's still a third party validation right and there's a lot of you know things that come with that right um so and uh uh you know having someone else come in and and validate your compliance status um is a lot easier to trust than you saying oh sure I'm compliant you know um so that that is always true that's why third party financial audits you know uh and et cetera always happen right um there's always a third party audit and and then it still carries the uh you know the to what extent it it provides you this it still is there you know you you could argue what to what extent it provides you but a competitive advantage right um so uh but so that that is is all there what what it is um you know and important um you know like you had mentioned the the contracting officers or your your buyer at a prime or something um you know not trying to disparage anybody but sometimes you know you said ask them sometimes they'll tell you one thing and the next week they say I know I told you this but it's different today and you now you have to do something.
• 39:56
  Brooke: So they're you know if if you find your spot as a defense contractor or you know a subcontractor to a prime or something and and you hear one thing from your um from your buyer uh or whoever um just know that um that that is like sometimes the best you can get but but know that if you have a a DFARS requirement in your contract um or or these you know other things um that that say that you are supposed to be compliant or you're downstream of something that is uh know that you know again go check your contracts and this is a broad sweeping statement not a lawyer but know that you're still on the hook for the compliance right so and and le legally speaking right so it's your your best situation um is to just be compliant and and essentially have 110 um regardless of whether you get a certification to validate that or not you know that's another another question that is what's up for um discussion right now but but know that your you know your risk tolerance you know may be different from person to person company to company but know that you still have that requirement and you should be um compliant with it so and so you're your best off your your best position the um for you to be in is to just be compliant with all the 110 controls and implement it as if someone was watching because it today your buyer could want to say one thing and next week you know you could get a new email from them you know um absolutely and who knows you know the other thing that I'll add is the the changes I was talking about a minute ago about the the class deviations and everything else you know uh at some point so in 2028 November 10th of 2028 um the law still says that CMMC certif or CMMC level two certifications are going to be required on all contracts it still says that they can't get away from that unless they just completely break the law which you know maybe it's happened before that's the reason but court cases happen yeah that is required by law and so to do something about that they have to go through rulemaking again and uh which I understand the class the class deviation is their way to uh because they left themselves the loophole that you know program managers contract officers have uh have the ability to push off that CMMC certification requirement in contracts uh included or not or included in an option year or something like that they have that ability right so that was always in there that's really all they have to do and that's what that class deviation said is directing them to do all good it didn't have to be in such dramatic fashion but I digress we won't go back there again um so that's all they had to do but again uh in 2028 all this goes into effect and you you got that that switch flipping then so next I mean we're in 2026 we're towards the end of 2026 right and so 2027 is next year and then the next year is what 2028 so uh there and rulemaking is not quick right uh it takes over a year uh just in general timeline it takes over a year um you know for um for a rule to be proposed uh and then from there uh go to a final status and all that kind of fun stuff that it it takes over a year to do that so expect to see some sort of rulemaking announced at some point um who knows when uh early mid next year or something you would think um and so there'll be a proposed rule this is what we're gonna do you know maybe hey we're gonna scrap all the NIST 800 171 we're gonna go with uh brilliant at the basics campaign you know uh even though it's not defined very well but uh and it ostensibly uh brings more things into the fold rather than saves money but hey uh anyway the uh who knows what they're gonna do I would I would assume suspect that there's still going to be some sort of third party validation, although they might see how they can tweak it and make it better and work on that through rulemaking.
• 44:31
  Brooke: You know, hopefully they get rid of hopefully they get rid of the uh no poemable thing.
• 44:36
  Brooke: Hopefully they get rid of the whole FIPS thing and hopefully they get rid of the FedRAMP requirement, you know, uh or at the at the very least of right allow FedRAMP 20 uh 20x, you know.
• 44:49
  Brooke: But, you know, if they can do those three things uh and then back off on the number of assessors that is required, who knows?
• 44:57
  Brooke: I mean that'll that'll go a long way to help it out.
• 44:59
  SPEAKER_01: Absolutely.
• 44:59
  SPEAKER_01: I mean there's there's definitely problems with um CMMC and how it's implemented.
• 45:04
  SPEAKER_01: I mean you you'll find a lot of people out there that are very evangelical about CMMC, you know, and they're like it's beautiful, it's perfect, it's you know, and um and anyone that says any otherwise is just wrong.
• 45:15
  SPEAKER_01: You know um yeah that's not us for um there's problems with it you know and it's it's hefty it's a burden and there's certainly some things that could be fixed about it.
• 45:26
  Brooke: And you just mentioned a lot uh of of good ones so um hopefully that that stuff does does make it easy easier um or they address it at some point but um coming back to um yeah yeah exactly right uh uh coming back to spare scores um you know uh say you you go you report it you put it in the website blah blah blah um then well but who sees it only you and certain government resources can see it no other primes can see it no nobody else can see it no private companies nobody else um it is not a database for primes to look through and go I want to choose that one you know they they can't do that um the government has said and people have asked for that I can't tell you how many times you know especially primes uh but other people that do stuff subcontracting you know or that need subcontractors I need a list of people that's that are level two certified you know that's great you're not gonna get one from the government and ostensibly they don't want to make that easy for the Chinese to see right I mean and I'm calling out the Chinese but they don't want it that easy for anybody else any of our adversaries to see you know who's who's on that list who's not you know there's that's a lot of good intelligence right now go and start scraping websites for the people that say hey you know you can advertise the fact that you're level two certified you know uh so I guess you can go scrape websites and find it that way it's not secret information uh but they just don't want to make it easy so uh anyway to go back to who can see it you can see it uh if you have a uh in the whole um cage code HLO highest level owner hierarchy and all that if you have an HLO they can see your score because you're part of their company um but uh and then some select uh uh contracting uh folks in the government can see it outside that no primes no other private businesses at all can see that score unless you screenshot it and send it to them right but you know um daddy government can so that's you know that's what matters right right exactly I I used to say uncle Sam but now I say daddy government I think it's just more fitting yeah so let's say you're a contractor um and you know you're interested in submitting a Spurs score or SPRS score um how do you actually do that good good good question uh so uh first of all you've you need a uh cage code and uh you've got to go to sam.gov and register there and uh request cage code um for us uh I will tell you for us you know it says uh do you do business with uh the Department of Fence or whatever or are you planning to we're not we we got denied for a cage code at first so I had to say yes we're planning on doing business with with the Department of Defense because I guess we are because we're doing work for uh companies so I was like right out of the gate as a downstream contractor you know so right out of the gate they're making me lie about this you know and uh I've got to get you know I need to get a certification so we so because of our clients that depend on us but you know I can't even get a dang cage code so in any case uh you know yes uh you know I do want to or I do some work uh for the defense department and uh you know I need a cage code so um anyway you get a cage code through sam.gov um and after that it's through the PIEEE the procurement integrated enterprise environment anyway you go to P I P I E.
• 49:27
  Brooke: I just fell asleep when you said that sorry well yeah uh you register there you have to add you have to it's confusing you have to go and add ask for the the right pieces to it and um they're they're actually pretty quick about it uh I found I was worried that it was gonna stay in limbo for a while uh but we actually got got in and got access pretty quick uh I had to go back in and ask for the right access on a couple of different things uh but that is where you go in and your your spurs the spurs system is part of that uh PIE is based on a PIE I believe so uh but that's how you get to it that's how you register for it that's a very high level uh I don't have step-by-step instructions sorry uh but you you've got to start off with that cage code and the unique ID that comes with it uh they say you've got to have that UID and well it's it it comes with getting a cage code so you know to be fair I don't think the government has step-by-step instructions either so there actually is some decent step-by-step instructions for uh on Spurs to look to look there and see how to do it but it's I say decent they're decent for the government so uh that's where you know I was able to figure out oh you know this is what this means I got to go back and do this.
• 50:44
  Brooke: So uh yeah I didn't have to search for some uh you know figure out where to ask for the right uh access to uh for the Spurs stuff but in any case that's where you go and get all of it you do have to start with a cage code you can't can't do it without a cage code and you got to start there.
• 51:03
  SPEAKER_01: Well appreciate that and uh if that doesn't help you I'm sorry.
• 51:10
  SPEAKER_01: This is one of those things where you know um you can't do overnight it's gonna take several you know uh potentially weeks you know and uh you just kind of got to start and just bang your head against the wall until you you get through it.
• 51:23
  SPEAKER_01: So yeah absolutely so um you know we're just kind of wrapping up the episode and I always like to uh when we wrap it up we've talked about a lot we've hit a lot of tangents and rabbit trails you know along the way so um you know if you if you were to sum up just you know one maybe two but one thing from this episode for our listeners um what what would it be?
• 51:52
  Brooke: Uh that uh SPRS is the home where uh Spurs SPRS is the the home where uh your score is reported at and where the government looks and that's your that is the uh the authoritative place uh for them to go look and for you to report it uh you've got to make sure that that is correct uh because it is a that is a legal thing that you are um that you are submitting uh it's not just some you know checkbox you can throw up there and not worry about uh you've really got to do the assessment and know what you're doing when you do the assessment uh to to grade yourself right now if you get a certification uh they upload your score for you and you and you don't have to worry about it um but uh that sprs score uh is very important um if you do have a if you're not if you don't have 110 and you have you know 88 89 and you uh you have a poem then you do have once you report that you've got six months to close out that POAM uh before you know if you told your uh Prime for instance yeah we've got a 88 and we've got a POM and it's supposed to be closed out uh December 31st and so you know January 1st they come and ask you hey how's it going?
• 53:16
  Brooke: Do you have 110 yet and you say well no I've got a 95 and say well why did you you know why did you have to push this off well I had to push it off because of this they said and they said okay well those days are gone uh you've got six months so um that six month timeline is important uh it is important to get all this done it is it is important to uh you either hire somebody on board or hire outside help to come in that knows what they're doing that understands CMMC to help you with that score to and to help you get over that finish line.
• 53:50
  SPEAKER_01: Awesome well I appreciate that Brooke and and your time as always and and to you the listeners at home or in your office or on your drive home appreciate you as well.
• 53:59
  SPEAKER_01: If you have questions about what we covered please reach out to us.
• 54:03
  SPEAKER_01: We're here to help fast track your compliance journey feel free to text email or call in your questions and we'll answer them for free here on the podcast.
• 54:12
  SPEAKER_01: You can find our contact information at ZMZ compliance guide dot com.
• 54:18
  SPEAKER_01: Stay tuned for our next episode until then stay compliant stay secure and make sure to subscribe