Latest / CMMC Compliance Guide / What Actually Happens During a CMMC Level 2 C3PAO Assessment, Day by Day: Evidence, Hot Wash, Certificate, and What If You Don’t Pass

Transcript

What Actually Happens During a CMMC Level 2 C3PAO Assessment, Day by Day: Evidence, Hot Wash, Certificate, and What If You Don’t Pass · CMMC Compliance Guide

• 0:21
  SPEAKER_01: Hey there and welcome to the CMMC Compliance Guide Podcast.
• 0:25
  SPEAKER_01: I'm Austin and I'm Brooke from Justice IT Consulting, where we help businesses like yours navigate CMMC and NIST 800-171 compliance.
• 0:35
  SPEAKER_01: We're hired guns getting companies fast tracked to compliance.
• 0:38
  SPEAKER_01: But today, we're here to give you all the secrets for free.
• 0:42
  SPEAKER_01: So if you want to tackle it yourself, you're equipped to do so.
• 0:45
  SPEAKER_01: Let's dive into today's episode and keep your business on track.
• 0:49
  SPEAKER_01: Today, we're walking through what an actual C3 PAO assessment looks like.
• 0:55
  SPEAKER_01: Start to finish and what to expect.
• 0:58
  SPEAKER_01: So let's dive in.
• 0:59
  SPEAKER_01: Alright, Brooke, real quick and at a high level, can you give us the 60,000-foot view of what a level two actual certification assessment from an actual C3PAO, you know, like the Hemgall, right?
• 1:15
  SPEAKER_01: The end zone most people are shooting for.
• 1:19
  SPEAKER_01: What at a high level does it look like?
• 1:22
  Brooke: Well, just at a you know, a high, I don't know, 30,000 foot level or whatever it might be, uh you know, it you start off, you've got to plan and prepare for it.
• 1:32
  Brooke: And if you're already, even if you're already ready for an assessment, you still gotta go through, uh, you know, get all your uh document, get all your uh evidence, all your artifacts updated, make sure you have your latest screenshots, make sure you have the latest logs, make sure, you know, all that stuff.
• 1:48
  Brooke: Make sure all that stuff is the latest and and and you know ready to go.
• 1:53
  Brooke: Um and you want all that, you want all that ready to upload and ready to give to the assessors because the more they have available to look over all those artifacts, all your policies, all your SSP, your plans, all that fun stuff, along with all the screenshots and logs and everything else, the more of that they have to look over and validate what they see, uh, you know, with all the documentation and screenshots and everything, the fewer questions they're likely to ask.
• 2:22
  Brooke: So that's always a good thing.
• 2:24
  Brooke: Uh but preparation, no matter how ready you are, but preparation is going to take some time.
• 2:29
  Brooke: Then you have uh you get ready, they'll ask for an upload.
• 2:33
  Brooke: Um, you know, uh they generally will ask for an upload at least of your SSP and a list of the evidence you have.
• 2:42
  Brooke: A lot of times they'll just ask for you to upload it all, and so you upload all of it.
• 2:46
  Brooke: Um and or give them access to your GRC if that's you know the uh let them let them know that that's a if that's a possibility, let them know that's a possibility.
• 2:55
  Brooke: And and we have had a uh an assessor, you know, uh say that's what they'd like to do.
• 3:01
  Brooke: So um, but most of them seems like preferred that upload.
• 3:05
  Brooke: In any case, go to phase one.
• 3:07
  Brooke: Phase one, you know, is just verifying that you know everything's there, verifying that your scope is right.
• 3:13
  Brooke: Uh, and then that is the off-ramp.
• 3:16
  Brooke: Uh, in case you're not ready for uh phase two, that's your off-ramp to say, you know what, they'll they'll tell you, I don't think you're ready, or you can tell them after all these questions, I don't think I'm ready.
• 3:27
  Brooke: You know.
• 3:27
  Brooke: Um they'll usually tell you.
• 3:30
  Brooke: They'll usually tell you, I don't think you're ready, uh, and I think you ought to delay, and and uh we need to reschedule.
• 3:36
  Brooke: So you can reschedule it rather than failing the assessment or not doing well if it's a mock, you know, not doing well in the mock.
• 3:43
  Brooke: Um and then phase two is uh actually sitting down for uh you know somewhere between two and five days, who knows, with an assessor, uh, all day long uh and going through each and every single assessment objective.
• 3:59
  Brooke: Looking at each one, um, looking at the evidence, all that kind of fun stuff.
• 4:03
  Brooke: And then um phase three is uh them uh circling up, going through everything, making sure they got everything, make sure all their I's are dotted, T's are crossed.
• 4:15
  Brooke: And then during that phase three, they'll also, you know, if if it's a certificate and you passed and everything else, uh, or you I guess it's not a call it pass, pass or fail.
• 4:24
  Brooke: So you met everything, got 110, then they'll upload your uh at that point they'll give you a certificate that you can't share publicly, and then they'll uh they'll upload everything to EMAS, which also flows over into the uh into Spurs.
• 4:42
  Brooke: At a high level, I probably talked way too much, but at a high level it's how it works.
• 4:47
  SPEAKER_01: You're good.
• 4:48
  SPEAKER_01: No, I appreciate the uh going over that and then gives us a good picture.
• 4:52
  SPEAKER_01: All right, so you just explained um you know the the high-level assessment process.
• 4:56
  SPEAKER_01: So let's say um, you know, um a contractor has uh already submitted all of their artifacts of evidence and their documentation and everything to their assessor, and um they're ready to proceed to the next call and um and you know start an assessment or have that first engagement or meeting or whatever it is with the assessor.
• 5:19
  SPEAKER_01: What is that and what does it look like?
• 5:22
  Brooke: Sure.
• 5:22
  Brooke: So uh let uh let me back up just a little bit.
• 5:25
  Brooke: So uh when you uh start an engagement with an assessor, you know, and sign and give them a down payment and all that kind of fun stuff, you'll at some point you'll get a schedule of events.
• 5:38
  Brooke: You know, you'll get it on the calendar, and level one will start this day, left excuse me, not level one, phase one will start this day, phase two will start this day, phase three will start this day, and uh those are generally a week apart.
• 5:51
  Brooke: Um, but uh probably a week to uh uh 30 days before the level one starts.
• 5:59
  Brooke: Phase one.
• 6:01
  Brooke: I keep saying level one.
• 6:02
  Brooke: I'm stuck on levels instead of phases, yes, thank you.
• 6:05
  Brooke: Uh probably uh a week to uh 30 days before phase one starts, um they'll request that you upload uh all your documentation, right?
• 6:15
  Brooke: Uh and so uh so you'll have to upload that.
• 6:18
  Brooke: That's what we were just talking about a second ago.
• 6:20
  Brooke: Uh and then phase one will start.
• 6:22
  Brooke: And phase one, uh you'll before that kicks off, probably just before it kicks off, you'll have a scoping uh an in-brief meeting.
• 6:32
  Brooke: And so that's just a we kind of hit on this a second ago.
• 6:35
  Brooke: But they um if you've really documented it really well and they it makes sense, they'll ask you to just sometimes you know, most of the time, they'll ask you just you know, just so we think we know what we're looking at here, and everything agrees.
• 6:49
  Brooke: Can you just explain it to me?
• 6:50
  Brooke: And you explain it to them, and they're like, Good, all looks good.
• 6:53
  Brooke: I don't have a problem with the scope.
• 6:55
  Brooke: Or they might ask more questions about the scopes.
• 6:58
  Brooke: But point is they want to know that you have your scope nailed down very, very well before you go into that uh assessment, because that's what everything is about, is what you've scoped in and what is appropriate and what's right.
• 7:12
  Brooke: Uh, if you've not done that correctly, you know, then that's one of those things they may say, hey, you know what?
• 7:19
  Brooke: I don't think you've got the scope defined well.
• 7:21
  Brooke: I think you're not ready, and I think you need to push.
• 7:25
  Brooke: And so uh, but that in scope uh and br uh uh that scoping and in-brief call happens just before the phase one week, um, usually.
• 7:35
  Brooke: And so that phase one week uh is for them to review all that information, all the documentation, all the screenshots, uh, everything you uploaded.
• 7:44
  Brooke: For us, it's generally somewhere around it could be more, it could be a little bit less, uh, but it's somewhere around 400 pieces of documentation, right?
• 7:53
  Brooke: Um, and so they go through all that, they look at it.
• 7:57
  Brooke: Um, you know, some assessors, they're they're people, right?
• 8:02
  Brooke: So some assessors are gonna go through it in detail, some of them are just gonna kind of touch on it.
• 8:07
  Brooke: Um, some of them may go through it in detail and then ask you detailed questions.
• 8:12
  Brooke: But some assessors may go through it in detail and and after you've uh explained a few things to begin with, and then they might, you know, they'll say, All right, we've already seen this, we've already seen that, we've already said, you know, they may go through and and do all that.
• 8:25
  Brooke: But that's what phase one is for, is for the invitative review it.
• 8:28
  Brooke: So really, before uh any testing begins, before phase two starts, they go through all that.
• 8:33
  Brooke: You've uploaded all the documentation and everything.
• 8:35
  Brooke: That's that's where that that all begins.
• 8:38
  Brooke: Awesome.
• 8:38
  Brooke: Appreciate that.
• 8:39
  Brooke: So at some point they're actually gonna have to look under the hood, right?
• 8:42
  Brooke: Yeah, unfortunately, yes, that has to happen.
• 8:45
  Brooke: So uh that happens in phase two.
• 8:47
  Brooke: Um, you know, phase one, I guess you could say they looked a little bit under the hood because you gave them all your documentation.
• 8:52
  Brooke: Uh, but now in phase two, um you generally uh will start off, most of them still start off at uh well I take that back.
• 9:01
  Brooke: I was gonna say they all start off at 3.1.1, uh, but not necessarily.
• 9:06
  Brooke: So um but they start off with whatever control you'll you'll have a schedule of events uh and they tell you what controls are gonna go over, you know, how the day goes.
• 9:15
  Brooke: You know, you'll get a 10-minute break here, a 15-minute break there, you break an hour for lunch, and at the end of the day, you'll break for 30 minutes and then come back and do a you know day of the hot wash and all that kind of fun stuff.
• 9:27
  Brooke: But um, you know, how they actually how they actually do this is they go through each one of those uh assessment objectives.
• 9:37
  Brooke: They don't necessarily uh ask you about the control statement, you know, because all the assessment objectives really are are what matters and what cover that control statement, right?
• 9:46
  Brooke: Because the control statement really would should just be a summary of all the details that are in the assessment objectives.
• 9:52
  Brooke: So they'll ask you, you know, how do you identify all your authorized users?
• 9:57
  Brooke: Uh well, I have an authorized user list.
• 9:59
  Brooke: That's over here.
• 10:01
  Brooke: You know, how do you identify all your processes acting on behalf of a user?
• 10:05
  Brooke: Well, I have a have you know processes list, or we put those on the authorized user list, however it may be.
• 10:12
  Brooke: And so you go through each one of those, they'll ask you about it.
• 10:15
  Brooke: Uh they'll ask, they may, they will ask to see um, you know, your authorized user list, your authorized device list, and all that kind of fun stuff.
• 10:25
  Brooke: And uh then the next controls are how do you limit to you know authorized users?
• 10:31
  Brooke: Uh well you know, we use intra-ID and Prevail, and this is how they work.
• 10:36
  Brooke: And you know, well, you know, how about can you show us uh can you show us intra ID to see that it matches uh see that it matches your uh authorized user list, you know?
• 10:49
  Brooke: So here they are.
• 10:51
  Brooke: We can show you side by side or however however that may be, you know, uh and so you show them how that works, right?
• 10:58
  Brooke: Um so there are uh three methods to how they uh review these things, and it's uh interview, uh examine, and test.
• 11:08
  Brooke: So um test may be, you know, um they have you log in, for instance, and make sure that the log on display message comes up, you know, something like that.
• 11:20
  Brooke: Or they may have you uh, you know, run uh run a uh privileged process as a regular user to see that it's blocked, you know, something like that.
• 11:31
  Brooke: So they'll test that, uh they'll interview and ask you questions, uh, they'll examine the documentation, stuff like that.
• 11:38
  Brooke: So that's that's how they go through it, and that's how they step through each one of those, and it is every single one of the 320 assessment objectives that they go through.
• 11:48
  Brooke: Now, if you've done your work well, you've documented well, uh, and I may be getting a little ahead here, I'm sure.
• 11:54
  Brooke: But um the uh if you've done everything well and documented everything well um and given them sufficient and accurate uh documentation uh and and examples, you know, of you know, tests, I should say I guess maybe, but um, if you've done that, they may get to, you know, uh some other there's a lot of overlap uh in uh in the NIST 80171.
• 12:23
  Brooke: So they may get to other controls and say, okay, we've already seen your authorized user list, we don't need to see it again.
• 12:27
  Brooke: We've already seen intra, we don't need to see it again, we've already seen, you know, so they've they very well may do that, or they may ask to see it again.
• 12:35
  Brooke: Uh most assessors that we're that we've been uh you know that we've uh done this with have said, you know, we've already seen that, we don't have to see it again.
• 12:44
  Brooke: So um if you if you put everything together and are in good place and and got everything in line, you know that there's uh a good bit of this that is that is seems a little redundant.
• 12:57
  Brooke: So it does sometimes.
• 12:59
  Brooke: Yeah, absolutely.
• 13:00
  SPEAKER_01: So you said earlier that um you know a lot of sessors start off at 3.101.
• 13:05
  SPEAKER_01: They may not, right?
• 13:06
  SPEAKER_01: And then you also just mentioned that um, you know, if if they feel like they've seen your authorized user list 10 times, they may have to be like, hey, hold up there.
• 13:15
  SPEAKER_01: You know, we're gonna have to see all this again.
• 13:17
  SPEAKER_01: Um so you know, my question is so they just approach everything randomly that week, assessment week, you know, or is there a structured process for how your assessor is going to move through all the requirements?
• 13:30
  Brooke: Well, see, they have this dartboard and they I'm just kidding.
• 13:33
  Brooke: Uh so uh it really is structured, even if they don't go 3.1, 3.2, 3.3, uh, it really is structured.
• 13:41
  Brooke: They'll do something that makes sense, like they'll do access control.
• 13:44
  Brooke: So that's always a beating to get through, but it sets the stage really good for other things, right?
• 13:50
  Brooke: And so they may do access control first and then go to identification, authentication next, uh, and and so forth and so on.
• 13:57
  Brooke: So they'll structure it in a way that makes sense where where the uh families build on each other, they rely on each other, and uh so they'll make it make sense that way.
• 14:07
  Brooke: Uh if they don't follow it, you know, like I said, by numbers 3.1, 3.2, they will go through a whole family.
• 14:14
  Brooke: So they'll start access control and go 3.1.1 all the way through 3.1.22, right?
• 14:19
  Brooke: Or go through the whole thing.
• 14:21
  Brooke: Uh, but they may mix and match those families to what makes sense and what builds on each other.
• 14:27
  SPEAKER_01: So there's multiple assessors in each assessment.
• 14:30
  SPEAKER_01: Does one play like play like good cop, the other play like bad cop?
• 14:33
  SPEAKER_01: And how does that work?
• 14:34
  Brooke: Well, I was gonna I thought you were fixing to say does one play solitary while they're waiting?
• 14:37
  SPEAKER_02: Oh yeah.
• 14:40
  Brooke: No, they uh generally they switch off on things that they have um uh they share responsibility.
• 14:48
  Brooke: So uh one will be uh responsible for a set of controls, another will be responsible for uh another families.
• 14:55
  Brooke: One will be responsible for a set of families, another will be responsible for another set of families, and so they'll switch off doing it that way.
• 15:02
  Brooke: Um and they're they're almost always there on the call, both of them.
• 15:06
  Brooke: Uh, and then usually the assessor will say, you know, the one that's asked but that's in charge of those that family will say, Hey, assessor number two, before we move on, do you have any any input?
• 15:17
  Brooke: And they'll most of the time they'll say, No, no input.
• 15:19
  Brooke: Sometimes they'll ask questions, you know.
• 15:22
  Brooke: Um, but most of the time there's no extra input, but they do ask a lot of times, um, whether they have any input or not.
• 15:31
  SPEAKER_01: Okay.
• 15:31
  SPEAKER_01: Well, say it's 7 55 a.m.
• 15:34
  SPEAKER_01: on the first day of your assessment on Monday morning, you come in.
• 15:38
  Brooke: And your stomach is just really rolling and turning.
• 15:41
  Brooke: Yeah, I don't know.
• 15:42
  SPEAKER_01: I was gonna say that you're you're highly caffeinated, your blood pressure is high, and your confidence is a little low.
• 15:48
  Brooke: Um, how does uh how does that how does an actual day like uh generally, uh what we've seen, at least the ones we work with, uh we generally do uh eight to four.
• 16:02
  Brooke: We're central time, uh, so it generally ends up eight to four for us.
• 16:07
  Brooke: Uh but they'll they'll also work with you and ask you on you know, do you mind if we start on, you know, when they're putting everything on the calendar, do you mind if we start at eight o'clock your time and wrap up for four o'clock?
• 16:19
  Brooke: You know?
• 16:20
  Brooke: Um you know, and that's usually fine.
• 16:24
  Brooke: We say that's great for us.
• 16:26
  Brooke: Uh so you know, they're on the east coast, some of them are on the east coast and they'll start it'll their time it's nine o'clock, and so they go nine to five, right?
• 16:35
  Brooke: Um so you can bet by the time five o'clock rolls around for them, they're you know, they're not gonna want to stretch this out too much longer.
• 16:43
  Brooke: So they'll want to wrap it up.
• 16:45
  SPEAKER_01: But yeah, so it's you mean it you mean it's a long day for them too?
• 16:50
  Brooke: Yeah, it's a long day.
• 16:51
  Brooke: So uh, you know, you'll uh there will be a lot of talking.
• 16:55
  Brooke: Uh whoever is managing and and running the um a lot of times what we do uh we do a mix really, but uh a lot of times what we do is one person will uh talk about the policies and all that kind of fun stuff, and then the other one will do the showing the technical stuff, right?
• 17:15
  Brooke: Because we have we'll have two people on the call uh ourselves, uh helping out our OSC, our client.
• 17:22
  Brooke: Um sometimes uh sometimes just one of us runs it.
• 17:27
  Brooke: There probably is two of us on the call anyway, most of the time, but uh uh as far as the we're an MSP, I'm not talking about the C through PAO.
• 17:36
  Brooke: Uh anyway, we'll we'll run it with them.
• 17:38
  Brooke: So uh you do a lot of talking on your side as the OSC or the person in charge of all that, right?
• 17:45
  SPEAKER_01: Um whereas the IT provider for the OSC.
• 17:48
  Brooke: It's the IT provider for the OSC.
• 17:50
  Brooke: And and then of course the uh you know the C through PAO, the assessor, they've they do a good bit of talking and asking questions and all that kind of fun stuff.
• 17:58
  Brooke: So, you know, it'll run eight to four, you'll have you'll break an hour for lunch usually, um, and then you'll probably have a couple of 10-minute breaks you know in the morning, a couple of 10-minute breaks in the afternoon, and then at some point in the afternoon they'll wrap it up.
• 18:13
  Brooke: Um and if you uh if everything is met and they don't see anything trending not met, they'll say, you know, hey, assessor number two, I think everything is met, trending met.
• 18:30
  Brooke: Um, I don't think there's any need to go do a hot wash and come back.
• 18:33
  Brooke: What do you think?
• 18:34
  Brooke: And uh, you know, they may say, Oh, I agree, I don't and everything's good.
• 18:38
  Brooke: Uh so if that's the case, you're doing good.
• 18:41
  Brooke: Uh, but sometimes there is, you know, hey, uh, we need to go have a hot wash and come back in 30 minutes.
• 18:47
  Brooke: So you may at 3 30, you know, they they may stop it, go do their or at 3 o'clock, they may stop it, go do their hot wash, come back at 3 30, and then go through and talk about the uh the items that are trending not met, uh, or any extra documentation requests, which in essence would be a control trending not met.
• 19:07
  Brooke: Um so they'll do that at the end of the day, and so that way you have a chance to say, All right, I do have that documentation, and uh I I can show you, and I'll show it, and then they'll say, That'll be tomorrow's call.
• 19:21
  Brooke: That'll be the first thing tomorrow's call.
• 19:23
  Brooke: So that's kind of how the day wraps up there.
• 19:25
  Brooke: And then you start the next day.
• 19:27
  Brooke: Uh all the ones we've been on uh really have been wrapped up in in two and a half days uh or so, give or take a little.
• 19:37
  Brooke: Um there has been, you know, if they have to go on site, sometimes that that adds a little bit extra to it to you know go on site and look around, but nothing much.
• 19:47
  Brooke: Uh, you know, we have gotten done, gone so fast, they were like, you know, really we could we could finish up in you know two days or less, but uh we really need to have time to make notes.
• 19:59
  Brooke: So do y'all mind if we do this?
• 20:01
  Brooke: It ends up being two and a half days anyway.
• 20:04
  Brooke: So um, but the assessors, and the only point there is that the assessors do need time because they've got to document everything, right?
• 20:12
  Brooke: I mean, absolutely everything.
• 20:14
  Brooke: So uh they've got to have time to make those notes, they've got to have time to go in there, type everything up, uh, look at it together, make sure they agree on it, and all that kind of fun stuff before they turn it over to their um quality assessor at the end of the week.
• 20:28
  Brooke: So there's there's some time for that.
• 20:30
  Brooke: So you can scream through those pretty quick, but they still need time to do their job, and so they may tap the brakes a little bit.
• 20:36
  SPEAKER_01: By scream, do you mean uh quickly?
• 20:38
  Brooke: You are quickly in quickly in pain.
• 20:41
  Brooke: Well, hopefully it's not in pain.
• 20:43
  Brooke: If it's in pain, that's not a good week.
• 20:45
  Brooke: So the only pain you should have, hopefully, going through these assessments is your is being nervous and your stomach being upset because you're worried about it.
• 20:54
  Brooke: Other than that, the pain should be fine, you know.
• 20:56
  Brooke: And that that usually, if you're in good shape, that usually gets better after the first couple of hours.
• 21:01
  Brooke: You know, you're like, oh, I think we're doing okay.
• 21:04
  Brooke: I can settle down.
• 21:07
  SPEAKER_01: Well, you know, I think you touched on this a little bit, but uh, let's talk about the realities of uh assessment, uh, assessment day.
• 21:14
  SPEAKER_01: You know, I'm a guy, um, you know, I like my structure.
• 21:18
  SPEAKER_01: I like to caffeinate from 6 a.m.
• 21:19
  SPEAKER_01: to 9 a.m., you know, or so, like to hydrate from 10 to 5, and then sometimes I like a beer at 6, you know, and then don't get me skipping my lunch because I'll get cranky.
• 21:30
  SPEAKER_01: So um, you know, when when am I gonna have pea breaks and when am I gonna get to eat?
• 21:34
  SPEAKER_01: You know, how does that work?
• 21:36
  Brooke: Uh that's that's the breaks we're I was talking about.
• 21:38
  Brooke: They schedule those in uh and they say, you know, you get an hour for lunch, this is where we're gonna take it.
• 21:44
  Brooke: They don't necessarily schedule the uh um the other breaks, but uh they'll generally do a break between families or something like that.
• 21:54
  Brooke: Or if it's stretched on like access control may have stretched on for a while, they'll say, Hey, why don't we take a break and 10-minute break and come back, you know?
• 22:02
  Brooke: So uh so yeah, you'll get a couple of 10 minute or 15 minute breaks in the morning, a couple in the afternoon.
• 22:08
  Brooke: Uh you definitely have time to go grab well, depending on how long it takes you to go grab lunch, you might they'll give you an hour.
• 22:17
  Brooke: No two hour lunches.
• 22:18
  Brooke: No, not two hour lunches.
• 22:19
  Brooke: They they'll give you an hour, uh, you know.
• 22:23
  Brooke: And then they'll I mean we've had them say, Hey, we're going so quickly through this.
• 22:27
  Brooke: If y'all want to take a 30-minute lunch, I'll bet we can get done early today, and we'll say, Heck yeah, let's get done early.
• 22:35
  Brooke: I'm fine with that.
• 22:36
  Brooke: So anyway, but generally it's it's all worked out.
• 22:39
  Brooke: You'll have that hour lunch and you'll have a couple of uh breaks in the morning, a couple in the afternoon at least.
• 22:44
  SPEAKER_01: Well, no, I'm I'm satisfied, thank you.
• 22:48
  SPEAKER_01: Because you might worry.
• 22:51
  Brooke: You'll get done in time to go have your beer afterward, don't worry.
• 22:54
  SPEAKER_01: There we go.
• 22:54
  SPEAKER_01: I'm happy.
• 22:55
  SPEAKER_01: I'm happy.
• 22:56
  Brooke: And if you want to make a really good fun assessment, you could probably break out the bottle under your desk and pour you some uh pour you some whiskey real quick, you know.
• 23:04
  SPEAKER_01: Well, if it's a painful assessment, that might be the thing you have to do.
• 23:08
  SPEAKER_01: So we've talked about how uh a day in an assessment goes.
• 23:13
  SPEAKER_01: Um you know, how does the week actually wrap up for assessment week?
• 23:19
  Brooke: Uh so um what what happens uh you at the end of the week, you wrap everything up, uh get done with the last controls.
• 23:30
  Brooke: Hopefully, you know, you found out that you know there's everything's trending met.
• 23:36
  Brooke: You're looking great, you know.
• 23:38
  Brooke: Uh if there are some things that are trending not met, you'll know about them.
• 23:41
  Brooke: You know, uh that last day you'll they'll do the hot wash, and then uh they'll schedule a uh they'll schedule another meeting with you to go over everything and tell you exactly where you're at.
• 23:53
  SPEAKER_01: So they don't like to say you're gonna be not met or you're gonna be a Matt.
• 23:57
  SPEAKER_01: They like to use the verbiage you're trending.
• 23:58
  Brooke: Oh yeah, everything is trending.
• 24:00
  Brooke: You're trending not met.
• 24:01
  Brooke: You're trending Met, you're trending that.
• 24:03
  Brooke: Uh well, uh not too many things.
• 24:05
  Brooke: You're either trending Met or not Met, I should say.
• 24:07
  Brooke: So um, and by the way, again, I know we talked about this on uh on other uh podcasts, but don't mark anything not applicable.
• 24:17
  Brooke: It's all applicable.
• 24:18
  Brooke: Uh you can say that wireless is not in scope, for instance, uh, you know, but don't say it's not applicable.
• 24:24
  SPEAKER_01: Well you're making the point about um, you know, for example, you don't want to mark something non-applicable, right?
• 24:29
  SPEAKER_01: So one of the other um points of confusion or uh just things that people don't understand um is what evidence actually is, right?
• 24:42
  SPEAKER_01: And what constitutes evidence um and documentation as well.
• 24:47
  SPEAKER_01: But um, so let's talk about that.
• 24:50
  SPEAKER_01: What constitutes evidence?
• 24:52
  SPEAKER_01: What are assessors actually looking for?
• 24:54
  SPEAKER_01: What's gonna pass muster?
• 24:56
  Brooke: Yeah, so um as far as the and we're just talking about evidence, we're not talking about your general documents you need, like your SSP and your policies and plans and procedures.
• 25:05
  Brooke: We're not talking about those at this point.
• 25:07
  Brooke: Uh so the evidence you're gonna need, it's gonna be things like uh a visitor log showing that you reviewed it.
• 25:13
  Brooke: So we take our visitor log, I've got a ticket that pops that tells me, hey, time to review your visitor log.
• 25:19
  Brooke: And uh so go grab the visitor log, look at it, make sure everything's kosher there, um, which may not be a good thing to say, but every make sure everything's good there.
• 25:29
  Brooke: So uh anyway, and uh I sign it and date it, scan it in, upload it to my GRC tool, uh, and there's the evidence we need, right?
• 25:38
  Brooke: And so that needs to be done, you know, whatever basis you say you do these things on, uh, that needs to be done on that on that case, right?
• 25:47
  Brooke: Um the uh or it may be you know uh vulnerability scan.
• 25:52
  Brooke: Here's a ticket to pop for a vulnerability scan that pops every month, or whatever it may be, uh that we do vulnerability scans and go through and address all the vulnerabilities.
• 26:01
  Brooke: Here's all the proof that we did that.
• 26:03
  Brooke: Here's a you know, print it out to a PDF and upload it to your upload it to your GRC tool.
• 26:09
  Brooke: Um, here's a screenshot showing that our users and intra ID uh match what's in uh the user uh authorized user list, right?
• 26:19
  Brooke: Um here's the ones that are admins, and that matches the admins that are in that user list.
• 26:25
  Brooke: Or we have a tendency of using the um that authorized user list as a uh maybe not a one-stop shop, but as a for a lot of things, right?
• 26:36
  Brooke: Um depending on the size of the organization, that makes sense.
• 26:39
  Brooke: Uh so it's where you list all your users, who has access to CUI, uh, who doesn't, who has who's uh has privilege access and who doesn't, uh, who has physical access and who doesn't.
• 26:51
  Brooke: Uh that's where you list all that.
• 26:52
  Brooke: They're just different columns, right?
• 26:55
  Brooke: Uh that may not work for every environment, but for small businesses, uh, you know, 10 to 50 users, or 50 and less, I should say, I guess even for one, it works.
• 27:05
  Brooke: But uh anyway, for uh for that number of you know, 50 or less users, that generally will work fine unless you've got a complicated environment.
• 27:14
  Brooke: Um so uh but you know, make sure you make sure all that is listed there.
• 27:21
  Brooke: Make sure that you have screenshots proving what is on that authorized user list or whatever other kind of list you have.
• 27:28
  Brooke: Um we have a uh key log, right, where we uh serialize our keys and and they get handed out, and so that that's all recorded.
• 27:40
  Brooke: Um you know that is signed and updated, uploaded uh, you know, once a quarter, um, or when a new employee starts or when leaves or something like that.
• 27:51
  Brooke: Um they want to see your onboarding and offboarding procedures or checklists.
• 27:55
  Brooke: They want to see a procedure, right?
• 27:57
  Brooke: You know, when we went through ours, I was like, well, we don't have a procedure, we have a checklist.
• 28:01
  Brooke: You know, let's let's look at your checklist, you know, and they really wanted to see a procedure, but I'm like, I'm not gonna write out a big giant long procedure document.
• 28:11
  Brooke: I'll here are the items we gotta do, here's the check boxes, we check it off when we've done it, and that verifies that we've done it instead of uh this long drawn-out procedure, right?
• 28:22
  Brooke: In any case, uh they'll want to see that, right?
• 28:25
  Brooke: That you have some kind of onboarding and offboarding procedure or checklist or something uh that you follow to make sure everything gets done, right?
• 28:34
  Brooke: You you hand keys out or an off-boarding, you get keys back, uh, you grant access or you boke access, whatever it may be.
• 28:41
  Brooke: They want to see that, right?
• 28:43
  Brooke: Um, your firewall rules, right?
• 28:48
  Brooke: They'll uh you can do you can export your firewall rules or you can do screenshots to prove that you know you you have everything set like it should be.
• 28:57
  Brooke: Uh if you get screenshots, just make sure you include all the relevant stuff.
• 29:01
  Brooke: So firewall rules, sometimes it's hard to get all that nice and neat in a little screenshot.
• 29:08
  Brooke: You know, but uh if you do that, that's great.
• 29:11
  Brooke: You should be a really big monitor.
• 29:13
  Brooke: Really big monitor, yeah.
• 29:14
  Brooke: I think you actually got a really big monitor and down there, big curved ones, and it's uh it's pretty cool.
• 29:19
  SPEAKER_01: We had three miles of an Excel sheet in front of them.
• 29:22
  SPEAKER_01: Beautiful.
• 29:23
  Brooke: You have to turn 180 degrees to see all of it, but yeah.
• 29:26
  SPEAKER_01: If I get if I get two or three more of them, I can just have a circle and just spin it around.
• 29:30
  SPEAKER_01: That's right.
• 29:30
  SPEAKER_01: Yeah, where wasn't that?
• 29:31
  SPEAKER_02: Yeah.
• 29:32
  Brooke: My neck will start hurting.
• 29:34
  Brooke: Right.
• 29:35
  Brooke: Um so uh yeah, that I mean that's we can go over.
• 29:39
  Brooke: I mean, like I said, there's when we get done, it's close to around 400 pieces of documentation we upload, including all the policies and everything.
• 29:48
  Brooke: But um, so there's a lot.
• 29:50
  Brooke: I can keep going over things, but those that's the kind of things that people want to see, that assessors want to see.
• 29:55
  Brooke: Uh they want to see proof that uh what's in practice matches what your documentation says.
• 30:02
  SPEAKER_01: I think every time uh we go through an assessment, um, our lead engineer, um, I think I see him age by another year, you know.
• 30:10
  SPEAKER_01: After he gets all that evidence done.
• 30:11
  SPEAKER_01: So hopefully, uh hopefully he stops aging because that would be it's a good thing he's a young guy.
• 30:16
  SPEAKER_01: So, you know.
• 30:18
  SPEAKER_01: I was gonna say for uh you know the for evidence, for example, there's little things like visitor log.
• 30:23
  SPEAKER_01: We just had um someone today, um, you know, uh a vendor stop in and um he had three people with him and need to drop in for like literally 30 seconds to our office.
• 30:33
  SPEAKER_01: Um he's like, I just gotta do this.
• 30:35
  SPEAKER_01: And we're like, cool.
• 30:36
  SPEAKER_01: Good sign in your visitor log.
• 30:38
  SPEAKER_01: Oh, just be real quick.
• 30:40
  SPEAKER_01: Yeah, okay, sign in.
• 30:41
  SPEAKER_01: Do we need to do all three of us?
• 30:42
  SPEAKER_01: Yes.
• 30:43
  Brooke: Are all three of you gonna come in?
• 30:45
  SPEAKER_01: Yeah.
• 30:45
  Brooke: You don't have to.
• 30:46
  SPEAKER_01: All three of you if the rest of you stay out there.
• 30:48
  SPEAKER_01: You're welcome to wait outside.
• 30:50
  SPEAKER_01: So um, but yeah, I mean, it literally took him more time to fill out the visitor log than do what he needed and leave, but but we did it, you know.
• 30:58
  SPEAKER_01: I mean, it's important you have that evidence because otherwise you don't have the evidence.
• 31:02
  SPEAKER_01: And same thing.
• 31:03
  SPEAKER_01: Like my wife comes up here, you know, for lunch or something, you know, to meet me, um, and she comes through the doors and um, you know, signed in.
• 31:13
  SPEAKER_01: Uh doesn't matter.
• 31:14
  SPEAKER_01: She's married to me, right?
• 31:15
  SPEAKER_01: It doesn't count, right?
• 31:17
  SPEAKER_01: Exactly.
• 31:17
  SPEAKER_01: So, I mean, uh that stuff matters.
• 31:20
  Brooke: It does.
• 31:21
  Brooke: You know, we uh uh when we went through our assessment, we went through a mock assessment first, and then we went through an assessment.
• 31:28
  Brooke: And so we had two visitor logs that we had uploaded, but for the second one, uh for the actual certification assessment on her, we don't get a lot of visitors uh that actually come in the door, right?
• 31:38
  Brooke: Uh we get stuff delivered, but they don't come in.
• 31:41
  Brooke: And uh so uh uh uh we had one one visitor on the visitor log that was uploaded to the uh to the uh GRC tool.
• 31:52
  Brooke: And uh so of course that was the first one we uploaded or we opened up when we were talking to the assessor, and they're like, Is this the uh only visitor you've had?
• 31:59
  Brooke: And we're like, well, believe it or not.
• 32:01
  Brooke: We'll go to the cameras.
• 32:03
  Brooke: Yes, it is.
• 32:03
  Brooke: Yeah.
• 32:04
  Brooke: Uh but to be fair, you know, we did uh the the I think the mock assessment was a month prior.
• 32:10
  Brooke: And uh so it was one one visitor within a month that you know, for the last time we'd uploaded that.
• 32:16
  Brooke: It's about on par for us.
• 32:17
  Brooke: Which is about on par, yeah.
• 32:18
  Brooke: Yeah, you know, every time I I walk in the front door, I look at the visitor list and it's like, yep, that same one person still there.
• 32:25
  SPEAKER_01: I know I I tell everyone to keep things clean around here, um, you know, in case a client stops by or something.
• 32:31
  SPEAKER_01: And um, I don't have much of a leg to stand on because they never come, you know.
• 32:35
  SPEAKER_01: Right.
• 32:36
  SPEAKER_01: So but we got you know, one one a month, you know, two drops in.
• 32:39
  SPEAKER_01: So let's say that the assessment went well and you're getting recommended for a certificate.
• 32:47
  SPEAKER_01: How does that work?
• 32:49
  Brooke: Well, once you uh get done celebrating and uh jumping up and down and clapping and everything else, uh they uh uh they'll say we're recommending you for a level two certification, then it goes through their process, and uh you know the quality assessor has to go through everything to make sure nothing's missing.
• 33:09
  Brooke: We haven't ever had anything that's missing.
• 33:11
  Brooke: I I guess there could be.
• 33:12
  Brooke: Um, I don't know what would be, but uh uh maybe there's sometimes some documentation maybe didn't come through uh clear or was corrupt or something, maybe.
• 33:23
  Brooke: Uh but the quality assessor has to go through everything, make sure all the documentation is there that they need, that it's in the proper place, that it's uh you know in good condition and everything before they upload it, right?
• 33:35
  Brooke: And so once they uh once they turn it in, once they get all that done and turn it in, uh they and the um the then the C through pao okay's it and they turn it in as is met or excuse me as 110 uh and the C through PO certified.
• 33:51
  SPEAKER_01: Then you've got uh couple weeks or a couple days of just painstaking waiting to hear it, or how does that yeah, it's like you know, when are when is the uh when are we gonna get our certificate?
• 34:01
  Brooke: When is uh because that gives you a little certificate, right?
• 34:03
  Brooke: Uh that you're not supposed to show publicly.
• 34:06
  Brooke: Uh at least not supposed to put publicly on your website.
• 34:09
  Brooke: You can show your client, uh, you can say, oh, look at here, look what we got.
• 34:13
  Brooke: Don't take a picture.
• 34:16
  Brooke: But um uh so they'll issue a certificate uh from them saying that you know you got it.
• 34:23
  Brooke: Um and um and then the painstaking process is waiting for it to show up in EMAS, right?
• 34:30
  Brooke: Or excuse me, waiting for it to show up in Spurs.
• 34:33
  Brooke: And uh of course um matters if you've logged into Spurs before and actually done that.
• 34:40
  Brooke: And if you haven't logged into Spurs, uh then uh get ready for uh a long product.
• 34:47
  Brooke: Well, it may not be long, maybe I'm just dumb, but but you have to get access to P I E E and then you have to ask for the right access for this and that, have to ask for access to you know the Spurs score and all that kind of fun stuff.
• 35:03
  Brooke: Uh so you it isn't just go sign up and then you can see it.
• 35:08
  Brooke: Uh so uh if you haven't signed up in Spurs yet, if you're uh if you're already doing business with the DOW, you probably have.
• 35:19
  Brooke: But like for us or people that that haven't tried to go get that contract yet, they may not have uh signed up in Spurs yet, and they may not have anything in there, may not, you know, may not have any of that going, so that that may take some time.
• 35:35
  Brooke: So but uh you know, waiting on that certificate to show up and and all that kind of fun stuff is the is waiting on pins and needles because you're like they could still they should still come back and say something, right?
• 35:47
  SPEAKER_01: It's not here until it's here, right?
• 35:49
  SPEAKER_01: Right.
• 35:50
  SPEAKER_01: Well, and how does it show?
• 35:51
  SPEAKER_01: Because I'd expect like a lot of pomp and circumstance, like someone like Uncle Sam, you know, uh jumping out of a rope of a black hawk helicopter, dropping down to your front door.
• 36:01
  SPEAKER_01: That is exactly how it works.
• 36:02
  SPEAKER_01: Show up saying it show up to your front door with a big old certificate, like Publisher's Clearinghouse does with that check, and you know You know you pay enough for this crap, but you know, they should do that, you know.
• 36:14
  Brooke: They should absolutely 100% do that.
• 36:16
  Brooke: I like that.
• 36:16
  SPEAKER_01: I mean, for a bunch of effort as you go through, I mean, I think that's the least they could do.
• 36:20
  Brooke: No, you just uh one day you just uh get this secure email in your uh in your inbox and and uh and it shows up and you're like, oh great, here it is.
• 36:29
  Brooke: Yep.
• 36:30
  Brooke: Then you go, woo.
• 36:31
  Brooke: Yeah.
• 36:32
  Brooke: Uh so yeah.
• 36:34
  Brooke: Um it's exciting when you get it, but there's no pumping circumstance.
• 36:38
  Brooke: It'd be it'd be nice for all that, and then like I said, as much as you pay for these things, they ought to do that.
• 36:45
  Brooke: But uh yeah, it just shows up in a secure email.
• 36:48
  Brooke: It's generally uh, I think a PDF, I don't even remember.
• 36:52
  Brooke: Anyway, and and you open it up and it's a certificate and it's digitally signed and all it jazz.
• 36:57
  Brooke: And uh so uh then you share it with your team and everybody goes, yay.
• 37:01
  SPEAKER_01: So I'm gonna tell everyone else that we got our certificate.
• 37:05
  SPEAKER_01: That's how it worked.
• 37:05
  SPEAKER_01: You could see an absolute blackout co doctor.
• 37:08
  Brooke: And it was it was a black, you know, a blackout helicopter, so you couldn't really see it that well.
• 37:13
  SPEAKER_01: You know, yeah, yeah.
• 37:14
  SPEAKER_01: Nobody else noticed it.
• 37:14
  SPEAKER_01: All the stealth equipment right now.
• 37:15
  Brooke: Yeah, all the stealth equipment, right?
• 37:17
  Brooke: Exactly.
• 37:17
  Brooke: It's very stealthy.
• 37:18
  Brooke: Uh you only noticed it because you knew it was there, and then yeah, nobody else really saw, but yeah, it's all up here.
• 37:25
  SPEAKER_01: It's those beers after six, that's what does that showed up at seven o'clock, right?
• 37:30
  Brooke: Mm-hmm.
• 37:31
  SPEAKER_01: So let's say um maybe your assessment didn't go well, you got a conditional or flat out fail or whatever.
• 37:37
  SPEAKER_01: Um, what are the typical things that uh someone that is finds themselves in that scenario?
• 37:44
  SPEAKER_01: What are the typical things that went awry for them to uh get there?
• 37:48
  Brooke: Yeah, so if you don't if you don't uh end up with uh uh a fully met um, you know, everything's not fully met, and you have something that uh can be Poaned, uh, because remember, not everything can be Poanned.
• 38:03
  Brooke: Most just can't, right?
• 38:04
  Brooke: Yeah, I mean it's all the easy stuff that can be Poanned, so it's anyway.
• 38:09
  Brooke: Uh and that was one of the one of our things in the in the uh response to the RFI that that we put in was hey, you want to make this cheaper, make people not feel like they have to go through a mock first, you know, to make sure they're in good shape before they get assessment.
• 38:22
  Brooke: Make the public you could poem anything except not having an fixing it, okay.
• 38:28
  Brooke: Yeah, yeah.
• 38:29
  Brooke: Fail it, fix it, give six months, give a year, something, and and uh do that.
• 38:33
  Brooke: That's the way it should be, and that way you have time to come back and fix stuff.
• 38:37
  Brooke: And then at that point, if you don't fix it, then you lose your contract.
• 38:41
  Brooke: Right.
• 38:42
  Brooke: Um, but for now, until that ideal world comes.
• 38:45
  Brooke: Yeah, we'll see if it does until that comes.
• 38:49
  Brooke: Uh what happens at this point is if you don't uh meet everything and you do have things that can be poemed, uh, then you have 180 days or roughly six months to to uh clean those up and to fit and to get those met and then uh you show all your evidence.
• 39:04
  Brooke: Uh you schedule a time with the assessor.
• 39:07
  Brooke: Before that six months is up, don't notify them on day 180.
• 39:12
  Brooke: Uh let them know everything's ready, and uh you need to schedule a time uh for them to look through it, and they'll look through it.
• 39:19
  Brooke: Uh I've never actually been in that position, but I do know they review everything that you've closed out.
• 39:26
  Brooke: They may do another session with you to do what exactly what they did in the uh during phase two, you know, uh depending on exactly what they have to go over.
• 39:37
  Brooke: If it's just some documentation that you have to clear up, um, you know, maybe you didn't have the documentation and you need to create it, you know, maybe that's maybe that's something simple they can look at and go, you know, you're good.
• 39:50
  Brooke: Um problem is all the hard ones, all the five-pointers and three-pointers, can't be poemed, and a lot of the one-pointers can't be poamed.
• 39:57
  Brooke: So there's a limited number of things that could be poemed, and again, those are the easier ones.
• 40:03
  Brooke: So uh I do know uh I've heard of, I don't know anybody, but I've I've heard of people that actually, you know, got a conditional and then they went and finished it up.
• 40:13
  Brooke: So um maybe they focus so much on the hard stuff that they just didn't get some of the easy stuff done.
• 40:19
  Brooke: I don't know.
• 40:20
  Brooke: But you do have that 180 days if you can have if you have items that can be poemed.
• 40:25
  Brooke: If you don't, uh and you fell one of the one of the items that or more uh that can't be poemed, then you've got the you generally the you have 10 days to provide uh like if it's documentation that you have and you just didn't have it ready or you couldn't find it, or the person who has access to it was sick, you know, or whatever that day.
• 40:52
  Brooke: Um uh or maybe you have access, but the person who does it all the time, uh, you know, uh they weren't there that day, and uh you looked and looked for it and couldn't find it.
• 41:04
  Brooke: And so if you do have the evidence or whatever it may be, and then can go back and provide it to them, you've got 10 days to do that.
• 41:11
  Brooke: Um you can't go create documentation and create everything and then give it to them.
• 41:17
  Brooke: That's not what that 10 days is for.
• 41:19
  Brooke: So that's what that if you if you don't have that documentation at all, that's what the poem 180-day period is for.
• 41:26
  Brooke: So um two different things there.
• 41:29
  Brooke: Uh, but uh you know, if you don't if you don't fall within that 10 days and something you can't clear up some documentation that you already have and you just can't find, for instance, uh, then at that point if it's something that can't be poem, then you just spell an assessment.
• 41:45
  Brooke: Unfortunately.
• 41:47
  SPEAKER_01: And that's why you do them on.
• 41:49
  Brooke: Yeah.
• 41:50
  Brooke: Yeah.
• 41:50
  Brooke: Yeah.
• 41:51
  Brooke: That's why we, you know, especially this first round out of the gate, and you know, everybody's everybody's environments are are a little bit different, you know.
• 42:00
  Brooke: Uh at least for us, because we try to we try to customize how for how that client does business, you know, and not just say, here's a little box you have to work in, and I don't care about your current processes working this way, you know.
• 42:14
  Brooke: Um who knows might be better to go in that route, but uh doesn't fit everybody.
• 42:19
  SPEAKER_01: So let's go back and let's say you're you're that person again that's uh blood pressure is high and confidence is low, and you're uh you got an assessment, you know, um coming soon, you're about to have to submit your your package of evidence and documentation and everything.
• 42:35
  SPEAKER_01: Um so assessment's about to happen.
• 42:39
  SPEAKER_01: Um if you're that person, what is the one thing that you should remember about the assessment process?
• 42:46
  Brooke: Uh most people uh the biggest problem people have is uh uh the documentation doesn't match, right?
• 42:56
  Brooke: Um uh two problems really, but uh one of them is the documentation doesn't match.
• 43:01
  Brooke: Maybe your SSP doesn't match exactly what your uh policy says, right?
• 43:07
  Brooke: Um and so there's that mismatch there.
• 43:10
  Brooke: So uh just make sure that everything matches up.
• 43:15
  Brooke: Um and I I'll throw this out there uh and you can have them excluded if you don't want it to be anywhere, but uh I'll throw this out there.
• 43:27
  Brooke: Uh you know, uh that is a good uh for a good clean business tenant where your uh AI is all in you know uh regulated and doesn't leave your tenant, uh your information doesn't relieve your tenant.
• 43:41
  Brooke: Um that is a good spot for AI to go through and check and make sure everything lines up.
• 43:46
  Brooke: You know, here's my SSP, here's all my policies and plans and procedures.
• 43:50
  Brooke: You know, does everything match up?
• 43:52
  Brooke: You know, well, no, here you say uh seven days, and here you say ten days.
• 43:58
  Brooke: Or here you say um, you know, you refer to vice president, and over here you say senior official, or you know, stuff like that.
• 44:07
  SPEAKER_01: Yeah, no, that's a great point.
• 44:08
  SPEAKER_01: And we'll not think no, I don't there's no reason to exclude it.
• 44:11
  SPEAKER_01: But uh so there's a lot of people make the mistake um of thinking that AI can solve their entire um compliance.
• 44:22
  SPEAKER_01: Problem or documentation in totality, right?
• 44:26
  SPEAKER_01: But it's really not the best use of it, nor really how AI um it's not at even necessarily its its best skill set, right?
• 44:37
  SPEAKER_01: But like the more crap you feed into it, the better it gets, right?
• 44:41
  SPEAKER_01: So if you can feed it a completed um provided like you said, it's all compliant and you're um not using a free version of deep versus something, you know.
• 44:52
  SPEAKER_01: Um you can you if you can have um you know a compliant AI run through and and double check you, you know, editor and um you still have to know what you're doing, no, because AI, as we know, will hallucinate, right?
• 45:08
  Brooke: AI will get some things wrong, and you have to know to challenge it, right?
• 45:11
  Brooke: Um you can't just trust it.
• 45:13
  Brooke: Um so but it is good to find those inconsistencies, it's good to find um and it actually it formats documents better than I format them by far.
• 45:26
  Brooke: I can tell you that.
• 45:27
  Brooke: Um but uh I have a tendency to do things, you know, instead of making all pretty formatting, man.
• 45:35
  Brooke: I just I get in there where it looks good, it looks alright, and and but AI can go in there and format it a whole lot better.
• 45:42
  Brooke: So uh, but it's good to help you find those inconsistencies, and you do have to you do have to prompt it well, and you do have to explain things well.
• 45:50
  Brooke: Um you also have I what I would do if you use AI to help you out and make the make these things uh uh check for inconsistencies and stuff, uh don't ask where there's something me to control or not.
• 46:05
  Brooke: That is it'll get that wrong.
• 46:06
  Brooke: I guarantee you it'll get that wrong.
• 46:08
  SPEAKER_01: Yeah.
• 46:09
  SPEAKER_01: There's far too much nuance in the combination of scope, environment, controls, assessment objectives, and all the other things that um just AI is never gonna get.
• 46:20
  SPEAKER_01: Even you give it uh a couple more years, I don't think.
• 46:24
  SPEAKER_01: You know, I could be wrong, but um, it's not gonna be able to solve the compliance problem.
• 46:29
  SPEAKER_01: There's just far too much nuance.
• 46:31
  SPEAKER_01: So yeah, um, and but people make that mistake as they front-load their compliance problem with AI solving it, whether by making documentation or giving guidance, and there's huge blind spots, um, and it just does not work, uh, especially in the hands of someone who's not familiar with compliance or IT, and that's oftentimes the person that is trying to use AI to solve it.
• 46:55
  Brooke: It's a good tool uh to use, uh, but as a tool, and you have to know what you're doing to use it.
• 47:01
  Brooke: Um, and so you have to prompt it well.
• 47:03
  Brooke: Uh, a good thing to do is also to tell it don't go out to the internet and check anything.
• 47:08
  Brooke: Uh here is the level two assessment guide, here is the level two scoping guide, here is you know, all this check for inconsistencies, you know, and check for uh you know, whatever you may want to check for.
• 47:21
  Brooke: Don't ask it whether a control meets this meets a control or not.
• 47:25
  Brooke: It may be able to give you some guidance, but it did not go get certifications.
• 47:31
  Brooke: Uh it did not go get a CCP certification, right?
• 47:34
  Brooke: So um, I mean, I guess you may be able to teach that, but uh, but at that point, after you've taught it all that, you could have gone through your assessment.
• 47:41
  SPEAKER_01: So it's also uh taking all the Yahoo advice too.
• 47:45
  SPEAKER_01: Oh yeah, that's what I'm saying.
• 47:46
  Brooke: That's why I say do not tell it do not go to the internet to get anything.
• 47:50
  SPEAKER_01: You know, yep.
• 47:52
  SPEAKER_01: Um so no, I mean that's hey, that's a good idea for a podcast episode.
• 47:56
  SPEAKER_01: Um if you want to how to use AI in in you know a CNN C compliance episode, throw some comments so we get enough.
• 48:04
  SPEAKER_01: Maybe we'll invest some time because that'd be an episode that's uh hard to put together.
• 48:08
  SPEAKER_01: So we if we have enough interest, we'll do it.
• 48:11
  SPEAKER_01: But otherwise, um well, um appreciate that, Brooke.
• 48:15
  SPEAKER_01: We do have a listener question, and as promised always, guys, we we like to take listener questions and answer them uh here on the podcast if we can at all.
• 48:24
  SPEAKER_01: So uh we've got one.
• 48:25
  SPEAKER_01: Um I'm not even gonna try the username, but uh you will know who you are because you ask the question.
• 48:34
  SPEAKER_01: Um it is uh a comment on episode 73, um, and it says, I would be interested in what advice you would have for an additive manufacturing company uh that is starting off from scratch with the intentions of being CMMC2 certified.
• 48:53
  SPEAKER_01: What would the first steps be?
• 48:54
  SPEAKER_01: What costs should it be should be considered for hardware and IT setup?
• 49:00
  SPEAKER_01: Small number of employees and equipment with intentions of growing.
• 49:04
  SPEAKER_01: What roadblocks or hurdles should I be aware of?
• 49:07
  SPEAKER_01: Thank you.
• 49:08
  SPEAKER_01: Great video and info.
• 49:10
  SPEAKER_01: Out of manufacturing is usually like uh 3D printing and um if I remember correctly, uh I could be wrong.
• 49:18
  Brooke: Uh so the first thing you really need to do uh for anything, really, uh if you're looking for level two compliance or level two certification, uh is you need to start at the very beginning and you need to figure out why you need that.
• 49:32
  Brooke: Has somebody told you you do?
• 49:34
  Brooke: Is there a formal request?
• 49:36
  Brooke: Is there uh you know, DFARS contracts, what uh DFARS clauses in your contracts, which DFARS clauses are they?
• 49:43
  Brooke: You know, what what is causing you to need that level two?
• 49:47
  Brooke: Or is it just one of the primes saying, sorry, you gotta have it, you know, which is you know, which happens.
• 49:53
  Brooke: Uh so find out why you have why you need to have it, find out what kind of CUI you have and what dissemination restrictions there are, because that matters as well.
• 50:03
  Brooke: Uh, once you know what kind of C why you why it's required, what kind of CUI you have, and what if it if there are any dissemination restrictions, that tells you a lot uh in the beginning about where your environment needs to go.
• 50:15
  Brooke: So um uh so for instance if you're gonna implement Microsoft 365, that would tell you whether you need commercial GCC or GCC high, right?
• 50:27
  Brooke: Um well for CUI you can just rule out commercial.
• 50:31
  Brooke: But the point is, uh whether you have CRI or not, CUI or not would would govern what version of that you have, if that's what you're gonna uh implement.
• 50:40
  Brooke: But before you even get to tools or thinking about that, uh the next step after that would be to figure out your data flow.
• 50:47
  Brooke: Where is your where does that CUI come in at?
• 50:50
  Brooke: Or where does it come in from?
• 50:52
  Brooke: Uh customer portals, uh GovSafe, where does it come in from, right?
• 50:56
  Brooke: Uh where does it go to?
• 50:58
  Brooke: Uh what systems, what servers, what computers, uh, what cloud systems, what all what does it go to in your environment?
• 51:08
  Brooke: And you gotta be realistic here because if you download from a portal and then put it straight on your file server, that computer you downloaded from is still in scope because you downloaded it.
• 51:18
  Brooke: Even if you download it straight to a processed and transmitted.
• 51:21
  Brooke: Yes, even if you download it straight to a shared drive on the server, uh, it is where you process, store, or transmit that CUI.
• 51:29
  Brooke: That's what matters.
• 51:31
  Brooke: Uh so you got to figure out your data flow, and then you look at that data flow and you go, oh, this is a this is a mess.
• 51:38
  Brooke: You know, we need to clean this up.
• 51:40
  Brooke: Or, you know, you just roll with it, however it needs to be.
• 51:42
  Brooke: Then you figure out what needs to be in scope, um, and figure out how you know what percentage of your business is this, what percentage do you want it to be?
• 51:51
  Brooke: Do you need an enclave?
• 51:52
  Brooke: Do you need is it gonna be your whole enterprise system, or is it gonna be most of it with a few machines scoped out?
• 51:58
  Brooke: You know, what what is it gonna be?
• 51:59
  Brooke: Um, and that's where that's where that starts out is knowing what kind of CUI you have, doing the data flow, and doing the scoping.
• 52:09
  Brooke: That's where you have to start.
• 52:10
  Brooke: If you don't start there, anything you do is not gonna be worth it.
• 52:14
  Brooke: Uh it's gonna be cart before the horse.
• 52:17
  Brooke: Um as far as uh what cost should be considered for hardware and IT setup.
• 52:23
  SPEAKER_01: I can answer that one enough.
• 52:25
  Brooke: Yeah, I mean it depends on what uh you know it depends there the answer really is it depends, but go ahead, Austin.
• 52:32
  SPEAKER_01: It completely depends, um, which is is the actual accurate answer, right?
• 52:36
  SPEAKER_01: Right.
• 52:37
  SPEAKER_01: Um is it completely depends because uh I mean we could have a small five-person firm that is three times the cost of another five-person firm because the way that they decided that their scope, or maybe they didn't even decide their scope, maybe it was just mandated by whatever technology they use or or whatever.
• 52:55
  SPEAKER_01: So it's completely dependent.
• 52:57
  Brooke: Uh a lot of people don't want to change their business process, and it ends up bringing more into scope.
• 53:02
  Brooke: Right.
• 53:02
  Brooke: And you have to explain that and make sure they understand.
• 53:04
  Brooke: So, like, look, if you want to change your business process for the CUI, you can narrow it down.
• 53:09
  Brooke: Yeah.
• 53:10
  SPEAKER_01: No, yeah.
• 53:11
  SPEAKER_01: And and it also completely depends, like, well, do you have an ERP?
• 53:14
  SPEAKER_01: Do you not?
• 53:14
  SPEAKER_01: Right.
• 53:15
  SPEAKER_01: So, because that's generally an ERP, um, then you're gonna be oftentimes putting controlled data, CUI or something in there.
• 53:25
  SPEAKER_01: Um, and so now that's in scope.
• 53:26
  SPEAKER_01: And if it's cloud, then you know, it's gonna be two to four times the cost of whatever commercial version, if they even have a compliant version.
• 53:33
  SPEAKER_01: If not, you're gonna have to migrate it out um into another compliant cloud version.
• 53:40
  SPEAKER_01: Compliant something.
• 53:41
  SPEAKER_01: Or their offline on-premise version, which is always much more expensive because you have to buy servers, you have to pay for the labor, all the licensing, and their licensing.
• 53:52
  SPEAKER_01: Uh, there are no very common um you know, vendors like that was, you know, some of the licensing is like$20,000 just for the software to install on the server before you ever buy a server.
• 54:01
  SPEAKER_01: So it is completely dependent, and the answer I'm gonna give by default, because it's completely dependent, is inaccurate.
• 54:09
  SPEAKER_01: So no preface.
• 54:10
  Brooke: So you're gonna give an inaccurate answer.
• 54:12
  SPEAKER_01: I'm gonna give an inaccurate answer.
• 54:13
  SPEAKER_01: But to give you an example is the absolute cheapest, um, I guess you could say, uh, as compliance could be that I've seen um uh on our customers is like if you had um a five-person firm who had not a lot of IT and not a lot of computers, like five computers, you know, um no ERP, um and you had to go, you know, you still had to go source some things, but um, you know, you're you're just in total, you're gonna be in the order of um probably fifty-sixty thousand dollars in one-time costs and some recurring amount of money in the fifteen hundred to two thousand dollar range.
• 55:02
  SPEAKER_01: Like that is gonna be the bottom rates that you could get, and most people are not there um to clarify, but you said small new business, um, and that is so that is and and that is still a lot of money, right?
• 55:21
  SPEAKER_01: Um, most businesses are gonna be far over that, right?
• 55:24
  SPEAKER_01: So um, but that is about as small as you can can get it, um, unless you were to go an enclave approach, which is still gonna be um cost, it's still gonna be in the that realm in some way or another.
• 55:39
  SPEAKER_02: Yeah.
• 55:39
  SPEAKER_01: Um, so but yeah, it it uh it often goes uh beyond that.
• 55:46
  SPEAKER_01: So that's what costs you can expect.
• 55:48
  SPEAKER_01: I mean, I could break it down individually for that customer as an example, but it's unuseful because it's completely dependent, right?
• 55:56
  SPEAKER_01: It is so um, and then if you add assessment on top of that, because I didn't even include assessment in that figure, um, that's gonna be another sixty thousand dollars at least, you know, for my plus assessment, plus you're that small of a company, you're most likely gonna have to have an IT or an RPO or excuse me, a CCP or somebody guide you through that.
• 56:16
  SPEAKER_01: So that collective cost is gonna be at least sixty thousand or over.
• 56:19
  Brooke: So most people even if you do have a uh IT firm helping you out and doing all that for an assessment, you're gonna want them on the call and you're gonna want them doing things.
• 56:28
  Brooke: So uh you got to figure that's gonna be, you know, 40 hours worth of work, and 40 hours worth work not for a level one person, but for an engineer architect compliance person, right?
• 56:40
  Brooke: So it's not a it's not an inexpensive project to for that uh for that IT firm to do.
• 56:46
  Brooke: Uh if they if they tell you they just include it with their services, I would be very worried.
• 56:51
  SPEAKER_01: Yep, yeah, I'd be worried.
• 56:53
  SPEAKER_01: Check.
• 56:54
  SPEAKER_01: It may be true, but check and be worried.
• 56:56
  SPEAKER_01: Um, but yeah, I mean the totality for like an extremely small business to get uh here we go.
• 57:04
  SPEAKER_01: The totality for an extremely small business to get all the way through assessment is not gonna be much cheaper than$120,000,$150,000 generally speaking.
• 57:13
  SPEAKER_01: And that's a small, small business.
• 57:16
  SPEAKER_01: It is off, you know, it's the it's often gonna be$200,$250 for some people.
• 57:23
  Brooke: So including assessment.
• 57:24
  SPEAKER_01: Including assessment, yeah.
• 57:25
  SPEAKER_01: And that that is specifically including the third party assessment.
• 57:29
  SPEAKER_01: It is cheaper if you have a self-assessment or testment um, you know, requirement, right?
• 57:34
  SPEAKER_01: Right.
• 57:34
  SPEAKER_01: So but oh yeah, it should be answered.
• 57:36
  SPEAKER_01: Yeah.
• 57:37
  SPEAKER_01: You know, the inaccurate, accurate answer, you know.
• 57:40
  SPEAKER_01: So follow up and ask more questions if you if you have any.
• 57:44
  SPEAKER_01: Um and uh we're happy to cover it here, so please reach out to us.
• 57:49
  SPEAKER_01: We're here to help fast track your compliance journey.
• 57:52
  SPEAKER_01: Text, email, or call in your questions, and we'll answer them for free here on the podcast.
• 57:57
  SPEAKER_01: You can find our contact information at cmccomplianceguide.com.
• 58:03
  SPEAKER_01: Stay tuned for our next episode.
• 58:05
  SPEAKER_01: Until then, stay compliant, stay secure, and make sure to subscribe.