Latest / CMMC Compliance Guide / How It All Began: The CMMC Compliance Guide Podcast Origin Story

Transcript

How It All Began: The CMMC Compliance Guide Podcast Origin Story · CMMC Compliance Guide

• 0:21
  Austin: Another week, another episode.
• 0:23
  Austin: It's Austin and Brooke here with the uh CMMC Compliance Guide Podcast.
• 0:30
  Austin: Brooke, have you ever wondered how in the heck I roped you into all this when you're not much of a limelight person?
• 0:36
  Brooke: Well, just about every time we do one of these, uh, but I think that's about what we're fixed to talk about.
• 0:40
  Austin: Yep, that's it.
• 0:41
  Austin: That's it.
• 0:42
  Austin: And let's address the uh the elephant in the room, how we're matching today.
• 0:46
  Austin: That was an accident.
• 0:47
  Austin: We didn't intend to do that, but here we are.
• 0:49
  Austin: We're just sticking with it.
• 0:50
  Austin: I just wanted to try out our new shirts.
• 0:52
  Austin: I did too, yeah.
• 0:54
  Austin: Great minds think alike, I guess, right?
• 0:56
  Austin: Absolutely.
• 0:57
  Austin: Oh man.
• 0:58
  Austin: Um, well, uh I was reading a book and um and it was addressing podcasts, and it said, hey, if you're starting a podcast, you should tell people how you started, because they're probably wondering that.
• 1:12
  Austin: So that's what we're doing.
• 1:14
  Austin: Origin story.
• 1:15
  Austin: Yeah, origin story.
• 1:16
  Austin: All right.
• 1:17
  Austin: So um it all started, and we kind of got a phone call from a local machine shop, and um they do pretty much exclusively aerospace stuff, right?
• 1:27
  Austin: You know I'm talking about um fighter jet parts and allegedly stuff like that.
• 1:33
  Austin: Um, and uh ended up changing the direction of our business.
• 1:37
  Austin: Um and that's how our journey to CMMC and NIST 800-171 uh compliance began.
• 1:42
  Brooke: Absolutely.
• 1:43
  Austin: So um I was knowing that, uh I was hoping you can kind of explain how cybersecurity compliance entered the d entered the DOD supply chain.
• 1:54
  Brooke: Sure, sure.
• 1:54
  Brooke: And I I wish I had a picture we could put back here, you know, with uh I have a presentation that shows these things.
• 2:01
  Brooke: But um uh if you look at PV up exactly what it should have.
• 2:05
  Brooke: So uh so if you look at our joint strike fighter, uh uh China, this is my favorite one to show, but anyway, there's more than this example.
• 2:14
  Brooke: There are several examples, but uh if you look at our joint strike fighter, um China a few years ago released uh their new fighter that looked amazingly like our joint strike fighter.
• 2:25
  Brooke: It's not a coincidence, isn't it?
• 2:26
  Brooke: I wonder how that happened.
• 2:28
  Brooke: So but you can you can look, they've got uh Humvee look alike, they've got uh uh some other several other things, right?
• 2:36
  Brooke: And so um they didn't they didn't necessarily do this by breaking into any of the all the big guys.
• 2:43
  Brooke: Not not that they haven't ever had any breaches or anything.
• 2:45
  Brooke: I'm not saying that, but um it's they didn't just break into Lockheed Bell or whoever it might be.
• 2:53
  Brooke: Uh really what they do is is uh they break into um you know mom what we call mom and pop or small small businesses, small and medium businesses who don't have as much resources to to uh spend on cybersecurity as the bigger guys do, right?
• 3:08
  Brooke: And so they broke into their uh they gathered a bunch of their uh citizens up and said, hey, we've got this puzzle, we've got these little widgets that we need you to put together and see what we have.
• 3:18
  Brooke: So uh so they did.
• 3:20
  Brooke: So um but that's how it all started.
• 3:23
  Brooke: Did Lockheed or excuse me, the government said, uh, you know, we've we've got to stop this because really what China just did, uh what China is doing is they are leapfrogging decades of RD and billions and probably trillions of dollars in RD to catch up with us.
• 3:41
  Brooke: And we're just giving it to them in in a matter of speaking, but we're just giving it to them.
• 3:46
  Brooke: So uh the DOD wants to stop that, and really it's for our safety and security, it's to protect our war fighters.
• 3:52
  Brooke: It's you know, there's a lot of good reasons to do this.
• 3:54
  Austin: Aaron Ross Powell And they're outsourcing their uh research and development to us.
• 3:58
  Brooke: Yes, absolutely.
• 4:00
  Brooke: Absolutely.
• 4:01
  Brooke: Just get a few hackers together and uh you know you got your research and development done.
• 4:04
  Austin: Right.
• 4:05
  Austin: Yeah, yeah.
• 4:05
  Austin: You didn't need to spend those billions and trillions of dollars, no.
• 4:08
  Brooke: No, not at all.
• 4:09
  Austin: Smart strategy.
• 4:11
  Austin: They're good at it.
• 4:11
  Austin: Yep, absolutely.
• 4:13
  Austin: So that goes for you know, really all the nation states.
• 4:17
  Austin: Yeah.
• 4:18
  Brooke: China's just it's just so glaringly obvious with China, you know.
• 4:22
  Brooke: Uh and it's and it's not just the DOD.
• 4:24
  Brooke: It I mean, it is they steal all sorts of technology from us, and they have for a really long time.
• 4:30
  Brooke: So anyway, that's why that's where this comes from and what the what the DOD is trying to protect.
• 4:35
  Austin: Trevor Burrus, Jr.
• 4:36
  Austin: Well, now that we are gonna put this on the internet, you can no longer go to China anymore.
• 4:39
  Austin: So I guess they got that off the I think I just got banned.
• 4:42
  Austin: Yep.
• 4:43
  Austin: So I wouldn't go.
• 4:45
  Austin: Um might not come back.
• 4:48
  Austin: Um so we we got that phone call uh from that aerospace machine shop and they found us uh via Google.
• 4:56
  Austin: Google.
• 4:58
  Austin: I've been having trouble talking all day, so I'm glad that today we're recording.
• 5:03
  Brooke: Yeah, Gouda.
• 5:03
  Austin: It is good uh on a burger.
• 5:06
  Austin: Um melt it over patty, but absolutely, but it is, it is.
• 5:12
  Austin: I'm good at those uh getting off topic.
• 5:14
  Austin: So anyway, we got that phone call.
• 5:17
  Austin: Uh they found us on the Google via Google.
• 5:19
  Austin: Yep is what I was trying to say.
• 5:21
  Austin: Um and uh basically it it came from you know their their buyer at Lockheed um is who they allegedly worked for.
• 5:30
  Austin: Uh and allegedly, yes.
• 5:32
  Austin: And uh I think maybe possibly maybe possibly.
• 5:35
  Austin: Um and uh it basically said that they needed to comply with NIST 800-171.
• 5:41
  Austin: Yes.
• 5:41
  Austin: Right.
• 5:42
  Austin: And so we didn't really fully understand what it was at the time.
• 5:46
  Austin: Uh I mean we're familiar with NIST.
• 5:48
  Austin: We were doing cybersecurity, that's how they found us actually, uh just searching cybersecurity and asked if we'd help, and we said we'll figure it out.
• 5:58
  Austin: So um that was back in 2017.
• 6:01
  Austin: Uh that's kind of when NIST 800-171 uh all started.
• 6:05
  Austin: It's not really when it started, but that's kind of when they were really pushing for it.
• 6:11
  Austin: So um can you explain kind of how we we uh took the time to research and figure out and and our partnership with Bo and and how all that went down?
• 6:21
  Brooke: Uh sure, sure.
• 6:22
  Brooke: So um as you said, we've always tried to lean real heavily into cybersecurity because frankly, uh there's there's a lot of risk there.
• 6:32
  Brooke: And if we don't protect ourselves and protect our clients well, uh that that's that's risk for us, and their risk is also our risk.
• 6:40
  Brooke: And uh as a as business owners, uh it's hard to just accept that risk and not do anything about it.
• 6:46
  Brooke: And so uh we're able to sleep a little better at night when we when we provide better cybersecurity.
• 6:52
  Brooke: So we already did that.
• 6:53
  Brooke: And and uh so when we looked at NIST 800-171, uh we read through it and we were like there were a couple of onerous things in there, but you know, really we looked at it and thought, gosh, this is this is everything that we want all of our customers to have.
• 7:08
  Brooke: This is our like our well, our full stack.
• 7:11
  Brooke: Oops, sorry, uh my hand went off screen, I see.
• 7:14
  Brooke: So uh anyway, this is our full stack uh uh in a matter of speaking in in our industry parlance, but uh what we want our all of our clients to have is what m it's what helps us sleep better at night, right?
• 7:27
  Brooke: And uh because it keeps them safe, keeps us safe.
• 7:29
  Brooke: So we we really kind of really realize that.
• 7:32
  Brooke: Um so uh but we we did um we did also realize that a big part of that is is uh it's it's you know partly cybersecurity technology, uh, and and a lot of it is policy and procedures and and how you implement everything, right?
• 7:51
  Brooke: And so we realized that.
• 7:52
  Brooke: And uh being a person that uh you know I just like to get down to brass tacks and uh I like to get things done and be done with it.
• 7:59
  Brooke: I don't like to write policies, I don't like, you know, all that kind of fun stuff, although I do a lot of that these days.
• 8:06
  Brooke: But uh we partnered with uh we we knew a gentleman through some other contacts uh uh named Bo Birdwell and he commanded uh in his previous life.
• 8:17
  Austin: Uh I realize I should have written all of this down so we didn't get it wrong.
• 8:22
  Brooke: Um and I didn't.
• 8:23
  Brooke: So Am I addressing another question ahead of time?
• 8:25
  Austin: No, no.
• 8:25
  Austin: Uh I'm just realizing we may get his credentials wrong.
• 8:28
  Brooke: Um I think there I think I've got him right.
• 8:32
  Brooke: But anyway, I think believe he's a commander of a a cyber squadron.
• 8:36
  Brooke: Uh all that is public information, so I'm not telling anything.
• 8:38
  Brooke: I can't plus he he didn't tell us anything that he couldn't tell us.
• 8:42
  Brooke: The stuff he could tell us was pretty cool, but anyway, he commanded a cyber squadron that did offensive-defensive uh capabilities for the United States.
• 8:49
  Brooke: Um and he was he is very credentialed and very capable and and uh rose up through the ranks.
• 8:56
  Brooke: Uh he did that in the Air Force.
• 8:58
  Brooke: Uh just a awesome, awesome individual, and uh and just a great guy too.
• 9:02
  Brooke: I love Bo to death.
• 9:03
  Brooke: Um and so he uh he got out, went into the private sector, uh, worked for um a company, uh a large, large company, uh decided that uh he heard about this NIST 800 171 thing coming, and it was actually gonna start happening.
• 9:19
  Brooke: And uh so he decided he wanted to start his own company, um, started it, and uh he was doing he was doing the implementation basically of uh or doing the policies and procedures, gaps analysis, all that kind of fun stuff, and then setting everybody up with a POAM basically for NIST 800-171.
• 9:39
  Brooke: And uh so that's what we needed and what we wanted, and so we partnered with him, and we also helped him develop uh policies, you know, like you know, Bo, that's you're thinking along the lines of a 30,000-person company or you know, whatever it is.
• 9:55
  Brooke: Let's bring this down a little bit and then and uh look at, you know, uh talk about small and medium business.
• 9:59
  Austin: You know, how can we make this feasible for a machine shop?
• 10:02
  Austin: Yes.
• 10:03
  Austin: Exactly.
• 10:03
  Brooke: You know, 50 employees or 50 employees, 100 employees, five employees.
• 10:07
  Brooke: You know, how are you going to do this for those organizations?
• 10:09
  Austin: You know, but also make the government happy.
• 10:10
  Brooke: Aaron Ross Powell And also make the government happy, right?
• 10:12
  Brooke: So there and there's a way to do that.
• 10:13
  Brooke: But we discussed all this, talked about how you know how the policies should be and how you know what what to implement and all that kind of fun stuff.
• 10:21
  Brooke: So uh I really enjoyed working with Bo and really enjoyed helping him get his company off the ground.
• 10:26
  Brooke: Uh I don't know if if I'm jumping ahead or not, but uh we ended up at uh we ended up he he decided that starting a small business uh wasn't for him and uh he wanted to go back and work uh in the corporate world, uh which is understandable because running a small business and growing a small business is not the easiest thing in the world.
• 10:47
  Brooke: So uh so he did for some crazy reason we want to do that.
• 10:51
  Brooke: But um anyway, he decided he wanted to go back in the corporate world and we were able to uh basically purchase uh um come into a business deal with him to use the the the product and everything that he created, so um, so which we really appreciate.
• 11:06
  Brooke: And so that's that's where we came in and uh we started doing the other part of that that I said we didn't like before.
• 11:13
  Brooke: The other thing Bo helped me realize is that oh, this is doable and I can do it, and I can do it and and enjoy it, you know.
• 11:22
  Brooke: So the uh so the gaps analysis, the SSP, the policies, the POEM, all that kind of fun stuff, you know, we do that all the time these days.
• 11:31
  Brooke: So there's a very long-winded answer uh to that question.
• 11:35
  Brooke: Hey, but it's the answer, isn't it?
• 11:37
  Brooke: Yeah.
• 11:38
  Austin: So I mean, yeah, that uh That's great, thank you.
• 11:42
  Austin: So I mean that's we basically after that went back to that um aerospace machine shop and um and they're still customer to this day and they are um and we took what we learned um with them and and now we're doing it um you know for for you know anyone in the DOD supply chain that that needs their their CMMC um not done for them because we can't do everything for them but done with them.
• 12:12
  Austin: Right.
• 12:12
  Austin: Um so and so we're we're kind of um you know their guide, their Sherpa on the uh trek up the uh up Everest, the compliance mountain.
• 12:22
  Austin: Good way to put it.
• 12:23
  Austin: Yeah.
• 12:23
  Austin: Um and so that was basically the idea for the podcast is you know, um, you know, we we've got people paying us to to do this with them and be their compliance guide.
• 12:34
  Austin: And so we're like, you know what, we could go put this out in the internet and share the secrets and um help people uh educate and tell everyone everything we know.
• 12:44
  Austin: Um and because um, you know, it's uh it's hard to find information out there, and especially for compliance and CMMC sp in particular, all the information you find is super technical and hard to read.
• 12:58
  Austin: Yes, it is.
• 12:59
  Austin: Yeah.
• 12:59
  Austin: So we're hoping to be that intermediary and um and help help with that.
• 13:05
  Austin: Absolutely.
• 13:05
  Brooke: And you know, just to build one more uh on what you just said just now, um you know it's it's hard to understand this kind of technical.
• 13:13
  Brooke: The other thing it is, is when you look at the 110 controls and the 320 objectives that make up uh NIST 800-171, uh revision two, um, when you look all that up, uh that's fine to read all that, but then guess what?
• 13:27
  Brooke: It refers back to other documents like NIST 853, and so you have to then go read those to get some context and understand what they're getting at.
• 13:37
  Brooke: So um, so there's a lot of reading, a lot of research.
• 13:41
  Brooke: Um Bo helped us understand that and helped us get through it, and and uh is that a lot of that just drives me crazy.
• 13:47
  Brooke: Just put just put it right there.
• 13:48
  Brooke: I just need to know, just bullet point it, you know.
• 13:51
  Brooke: But uh anyway, so uh there is a lot to that, to reading those controls and objectives and and understanding what's behind them too.
• 13:59
  Austin: Absolutely.
• 14:00
  Austin: A lot of time, a lot of legwork, a lot of reading, um enthralling reading that you don't want to do right before you sleep, right?
• 14:07
  Austin: It will put you to sleep.
• 14:08
  Austin: Yeah, yeah.
• 14:09
  Austin: Um uh so yeah, I mean that's uh that's basically the creation of the podcast itself.
• 14:15
  Austin: You know, that's our our journey, and then uh, you know, we created the podcast for that reason.
• 14:20
  Austin: Um and you know, our our mission with this podcast is to help um, you know, the the CNC machine shop trying to get into DOD work or the small business that um you know has been passed down to generation to generation and and now it's in the sun's hands to um figure out this new issue um and and keep uh all those employees um at the at the shop employed and and that that family business going.
• 14:50
  Austin: Um and or even just uh you know the larger company that uh quality guy or um compliance manager that doesn't know where to start but have been put in charge of it.
• 15:01
  Austin: So that's that's who we're here to help.
• 15:03
  Austin: So I guess what I'm trying to say is um you know if we could start from scratch uh and figure this out, you can too.
• 15:19
  Austin: Uh and and that's why we're here uh and we're we're trying to be here uh to make it as easy as possible for you.
• 15:26
  Austin: So uh I also just want to encourage our listeners um to to reach out in the comments, um, text us, um, email us, uh, give us a call, all of our information is available.
• 15:38
  Austin: You'll see it uh below, you'll see it on our websites.
• 15:42
  Austin: Um uh please, please reach out and ask your questions.
• 15:47
  Austin: Um we'll answer them here for free um when you might have to pay for uh a compliance person a lot of money to get them answered.
• 15:54
  Austin: So get them to us um and we'll feature them here on the show.
• 15:58
  Austin: We'd like we'd love um to get those answers um out there for you and so everyone else can learn um from your question too, because chances are if you're having that question, everyone else probably is too.
• 16:10
  Austin: So uh be brave enough to ask it, please.
• 16:14
  Austin: Um and um make sure you uh make sure you uh what is it happen?
• 16:20
  Austin: What happens whenever you follow somebody on a podcast?
• 16:23
  Austin: I'm losing my mind right now trying to think of the word follow us.
• 16:27
  Austin: Um you know the word I'm talking about.
• 16:29
  Austin: Wow, this is making us look really good right now.
• 16:32
  Brooke: I don't know.
• 16:32
  Brooke: I'm not real good at social media, just follow us on the yeah, yeah.
• 16:35
  Austin: Do the thing that yeah, that you uh subscribe.
• 16:39
  Austin: That's the word I was looking for.
• 16:40
  Austin: That's a yes, yeah.
• 16:41
  Austin: Subscribe to the podcast, please, and get notified.
• 16:44
  Austin: Um anyway, uh, and uh I think that's pretty much what we've got.
• 16:49
  Austin: Um we've got uh some uh new podcasts coming up.
• 16:54
  Austin: Um uh we're I think we might have a conversation with an assessor.
• 16:58
  Austin: Um, so I don't know when that's gonna be, but um, we're gonna actually have a certified assessor sitting down um uh and talking to us and kind of spilling the beans on how they're going to assess and certify um uh companies like yourselves.
• 17:15
  Austin: Um and so if you've got any questions for an assessor, um it might be a good time to submit because here in the next couple weeks we'll have we'll have him on the show.
• 17:23
  Brooke: Absolutely.
• 17:24
  Brooke: Yeah.
• 17:24
  Brooke: Um I talked to him, he was excited about being on, and and uh and and I, you know, I've I went through and got some training myself.
• 17:33
  Brooke: I was got some assessor training.
• 17:34
  Brooke: I'm not a I'm not a CCA, I'm a CCP, uh, but I did get some assessor training because I wanted to know for our clients how all this is gonna shake out and what it's gonna look like, you know.
• 17:44
  Brooke: Uh so um but it it it's good to listen to me tell you what assessors will do, but uh after all, you know, I'm I'm not an assessor.
• 17:53
  Brooke: I I didn't do I didn't get that so I can be an assessor.
• 17:57
  Brooke: I got it so I could understand, I got that certification so I'll know how better to implement and and how to answer questions and what they're looking for.
• 18:04
  Brooke: But uh so it'll be good to have an assessor on and talk to him and ask him some questions and uh hear it from from the horse's mouth, you know, uh if you will.
• 18:13
  Brooke: Uh so uh so yeah, it'll be good.
• 18:16
  Brooke: He's a good guy, uh very knowledgeable, so it'll be good to have him on.
• 18:20
  Austin: Yeah, absolutely.
• 18:21
  Austin: And uh we're also gonna be at um all the CMMC events.
• 18:24
  Austin: Um we're gonna be there as a a vendor and as uh attendees.
• 18:27
  Austin: So um we're gonna go uh learn all that stuff so that way you don't have to go fly out to DC and all these places, and then we're we're gonna try to do a show from um a show from the show uh and and just kind of tell you guys what we're learning there um and and distill that to you and actual information.
• 18:45
  Brooke: So But if you do happen to come, look us up.
• 18:47
  Brooke: We'd be happy to talk to you there at the show.
• 18:49
  Brooke: Uh we'll both be there, probably have uh another person or two there, and and um uh we'd absolutely love to talk to you.
• 18:56
  Austin: Awesome.
• 18:57
  Austin: I think that's it.
• 18:58
  Austin: You got anything else?
• 18:59
  Austin: That's it.
• 19:00
  Austin: All right.
• 19:00
  Austin: Thank you guys.
• 19:01
  Austin: Like, subscribe was the word, uh and we'll see you next time.