Latest / CMMC Compliance Guide / Navigating the 48 CFR Rule: Essential Insights for DoD Contractors on CMMC 2.0 Compliance

Transcript

Navigating the 48 CFR Rule: Essential Insights for DoD Contractors on CMMC 2.0 Compliance · CMMC Compliance Guide

• 0:21
  SPEAKER_00: This is the the vetting odds are that uh that this is gonna be October.
• 0:26
  SPEAKER_00: So whenever they look at the final rule for 31 CFR, uh if that's the case, that puts us at the 4154.
• 0:34
  SPEAKER_02: Welcome.
• 0:34
  SPEAKER_02: Austin from Justice IT here, and today we're talking about the 48 CFR proposed rule for CNNC.
• 0:42
  SPEAKER_02: I have Brooke Justice here from Justice IT.
• 0:45
  SPEAKER_02: He is our resident compliance guru, um, and funny enough, the man at the helm of Justice IT.
• 0:51
  SPEAKER_02: So uh that makes us a compliance uh led company.
• 0:54
  SPEAKER_02: Thank you, Brooke, for coming here today.
• 0:56
  SPEAKER_02: Well, I appreciate y'all having me on and seeing what uh questions I can answer for you.
• 1:01
  SPEAKER_02: Absolutely.
• 1:01
  SPEAKER_02: Well, let's get into it.
• 1:03
  SPEAKER_02: Okay.
• 1:04
  SPEAKER_02: So uh we're getting a lot of questions for our customers with this new um change that just came out last week.
• 1:11
  SPEAKER_02: Uh, and so we thought we'd sit here and and just hit you with some questions uh that they have and that we developed here in turn of looking at the compliance.
• 1:20
  SPEAKER_02: Uh first one I've got for you is can you explain the key updates in the new 48 CFR proposed rule and how they differ from the existing regulations we already know about?
• 1:33
  SPEAKER_00: Sure, absolutely.
• 1:34
  SPEAKER_00: So uh the most critical uh update or aspect uh is that it makes CMS CMMC very real for everybody involved.
• 1:43
  SPEAKER_00: We've now got it's a proposed rule, it's not gone final, of course, but we've got a proposed rule uh that puts this in puts CMMC 2.0 in effect on contracts.
• 1:54
  SPEAKER_00: So it's real now.
• 1:56
  SPEAKER_00: So it's gonna happen.
• 1:57
  SPEAKER_00: No more putting it off, no more, you know, next year, next year, next year.
• 2:01
  SPEAKER_00: So uh so you pair this 40.
• 2:04
  SPEAKER_00: This is a 48 CFR rule, uh, puts it in effect on contracts.
• 2:07
  SPEAKER_00: You pair this with the 32 CFR rule that just came out at the end of the year, the proposed rule.
• 2:12
  SPEAKER_00: It's not final yet.
• 2:14
  SPEAKER_00: Uh, and so uh with the potential effects with uh ESPs, external service providers that it has, uh there's some uh very critical things that can that have yet to be answered uh that uh that will be answered with that.
• 2:32
  SPEAKER_00: Uh and that's a whole nother topic.
• 2:34
  SPEAKER_00: We can discuss that in another in another video uh or something.
• 2:38
  SPEAKER_00: Uh but the one other critical aspect is really nothing new.
• 2:42
  SPEAKER_00: Uh it's something that's been out there, but they uh rephrased it on, or that's they called it out in this one here as the flow down rule.
• 2:49
  SPEAKER_00: Uh so this CMMC flows down from contractor to contractor to contractor, following CUI and FCI.
• 2:55
  SPEAKER_02: Okay, yeah, that makes sense.
• 2:57
  SPEAKER_02: Okay, uh next one I've got for you is what are the most significant challenges that DOD contractors will face in complying with the new CMMC 2.0 requirements under the 48 CFR rule?
• 3:13
  SPEAKER_00: Well, the most most significant challenge will be that uh you now actually have to pass a certification to uh get your to be CMMC level two, you have to be certified.
• 3:24
  SPEAKER_00: You have to pass that certification uh and you have to do that enable to get that business.
• 3:29
  SPEAKER_00: Uh so uh the um in what we know so far, uh there's nobody who's certified yet.
• 3:36
  SPEAKER_00: So nobody's gone through those assessments.
• 3:38
  SPEAKER_00: However, uh the joint uh you can do a joint surveillance uh voluntary assessment, JSVA, uh, and so you can either volunteer for that, hence the uh voluntary portion of that, or I think some are voluntole that they can do that.
• 3:54
  SPEAKER_00: Uh so those people who go through that JSVA, uh there's a little bit of leniency there because there's still some questions about CMMC, uh, and it's the the government making judgment calls.
• 4:06
  SPEAKER_00: Uh that's not going to be available whenever the uh whenever the certification process actually comes out and is is is the law.
• 4:14
  SPEAKER_00: Uh so uh the second biggest challenge uh is uh really for small businesses.
• 4:21
  SPEAKER_00: We're a small business.
• 4:23
  SPEAKER_00: There's a lot of our clients that are you know that are small businesses, is really just for them to be able to afford this, just to afford the certification alone, the first certification.
• 4:32
  SPEAKER_00: And that happens once every three years, but it's still it's still a chunk of money to be able to afford.
• 4:39
  SPEAKER_00: Uh and to go along with that, uh the uh not only the cost of the assessment, but uh all the documentation.
• 4:46
  SPEAKER_00: There's documentation, and there's documentation, and then there's more documentation.
• 4:51
  SPEAKER_00: So those are those are uh some of the challenges.
• 4:54
  SPEAKER_02: Okay.
• 4:55
  SPEAKER_02: Awesome.
• 4:55
  SPEAKER_02: Thank you for that.
• 4:57
  SPEAKER_02: Can you walk us through uh what the timeline is for the implementation of CMMC 2.0 um from the publication of last week's proposed rule to the actual full enforcement of it?
• 5:11
  SPEAKER_00: Sure, sure.
• 5:12
  SPEAKER_00: So the uh the 48 CFR um, and remember this this puts CMMC into effect on CMMC 2.0 into effect on contracts, on new contracts.
• 5:24
  SPEAKER_00: Uh so really, if you go back to the uh 32 CFR that was released at the end of December, that's the one that defined uh CMMC 2.0.
• 5:35
  SPEAKER_00: It's still a proposed rule.
• 5:36
  SPEAKER_00: That one ought to go into effect somewhere around Q1 of 2025, somewhere around then.
• 5:45
  SPEAKER_00: Uh and so at that point, Q1 of 2025, we'll have assessments available.
• 5:50
  SPEAKER_00: You can you can schedule an assessment at that point, uh, a certification assessment and get certified, but they won't be required on the contracts until that 48 CFR goes final, which will probably, if the government holds true to their timeline, usual timeline on the way all this goes, it'll probably be the end of Q3 or maybe in Q4 when that goes live of 2025.
• 6:15
  SPEAKER_02: Okay.
• 6:16
  SPEAKER_02: And there's a bit of precedent for that because on the 32 CFR rule, is that correct?
• 6:21
  SPEAKER_02: They they actually followed through on the timeline of uh what things are supposed to happen.
• 6:26
  SPEAKER_02: Am I correct about that?
• 6:27
  SPEAKER_00: Yes, they did.
• 6:28
  SPEAKER_00: And uh so we'll we'll see whenever whenever this uh 32 CFR final rule comes out.
• 6:36
  SPEAKER_00: So the process now is we're waiting for the final rule to come out.
• 6:39
  SPEAKER_00: Right.
• 6:39
  SPEAKER_00: So when the final rule comes out, uh when it comes out, we'll have there'll be 60 more days until it goes into effect.
• 6:46
  SPEAKER_00: And so that they're expecting everybody, you know, but I guess Vegas is uh the betting odds are that uh that this is going to be October, so whenever they release the final rule for 32 CFR, and if that's the case, that puts us at the beginning of the year 2025.
• 7:05
  SPEAKER_02: How should subcontractors approach the certification process, especially those who have never been through a CMMC assessment before?
• 7:15
  SPEAKER_00: Sure.
• 7:15
  SPEAKER_00: Uh so the only people or only companies who have been through uh assessments, certification assessments, are ones who have gone through the uh joint surveillance voluntary assessment, the JSBAs.
• 7:28
  SPEAKER_00: And so we have those as a frame of reference.
• 7:30
  SPEAKER_00: Uh and really I would say if you're able to, if you think you're ready, if you think we're ready to go, we're good to go for this, I would say see if you can uh apply and go through a joint surveillance voluntary assessment of JSVA, because there's a little leniency there, and uh that's not going to be there uh for when the CMMC 2.0 really kicks in, probably the end of 2025.
• 7:55
  SPEAKER_00: We're we'll see when, but you know, that's uh that's the Vegas odds right now.
• 7:59
  SPEAKER_00: Uh but as far as the actual certification process by a C3PAO, uh that'll happen once every three years.
• 8:08
  SPEAKER_00: So this first time it's gonna be there's there's some questions around exactly what's gonna go on, exactly how it's gonna be, everything's gonna be assessed.
• 8:18
  SPEAKER_00: Uh so what I would really say is you probably need to hire an assessor uh from a C through PAO to come in and do a pre-assessment or a mock assessment.
• 8:29
  SPEAKER_00: Uh the mock assessment specifically means treating it like an assessment.
• 8:34
  SPEAKER_00: Right.
• 8:34
  SPEAKER_00: So there's there's some difference there, but uh basically get some consulting beforehand, it's probably gonna be about the same price as an actual assessment, uh, but it'll be well worth your time because if you do go through that certification assessment and you happen to fail it, uh and it's something significant that you can't fix in a in the in the correct timeline, uh then you're just done, you're out, and you have to go you have to go through that whole process again.
• 9:03
  SPEAKER_00: The uh the assessors and the C through PAO can tell you what you failed, uh, but they can't tell you how to fix it.
• 9:10
  SPEAKER_00: They can't do any consulting.
• 9:12
  SPEAKER_00: So uh you know you can go back through that again and then potentially fail it again if you didn't fix it properly, you know.
• 9:19
  SPEAKER_00: Uh so I would really, really suggest hiring somebody to come in ahead of time to do that.
• 9:25
  SPEAKER_00: It's also very worthwhile to look at organizations that are uh certified that can come in as a certified as a CMMC certified professional or a CMMC certified assessor.
• 9:36
  SPEAKER_00: Same sort of thing I was sit uh talking about a minute ago, but if they can come in and help you prepare and help you be there and not just help you with the assessment portion of it, those are really important things to do to get ready.
• 9:48
  SPEAKER_02: Okay.
• 9:48
  SPEAKER_00: It's like taking a practice test before you get it.
• 9:51
  SPEAKER_00: Oh, absolutely.
• 9:52
  SPEAKER_00: Yeah, except except this practice test is a cost a lot more.
• 9:55
  SPEAKER_02: So well, that's true.
• 9:56
  SPEAKER_00: Yeah.
• 9:58
  SPEAKER_02: All right.
• 9:59
  SPEAKER_02: So uh what role do prime contractors play in ensuring their subcontractors are compliant with these CMMC uh requirements?
• 10:09
  SPEAKER_00: So uh any prime contractor that is a contractor who gets a uh who gets a uh contract directly from the government uh is responsible to make sure that their contractors, their subcontractors, uh are all uh compliant.
• 10:25
  SPEAKER_00: Or in this case, uh we're speaking about CMMC level 2 certification.
• 10:30
  SPEAKER_00: So uh they're responsible to make sure that all of their subcontractors are CMMC level 2 certified.
• 10:37
  SPEAKER_00: What that also means is that each one of those subcontractors have to also, it's a flut the flow down rule, they have to also make sure that their subcontractors and all the contractors, people they use uh for to fulfill this contract uh that has that they have to be compliant for, that all those subcontractors have to be certified and so on and so on.
• 10:59
  SPEAKER_00: That's why it's called a flow down rule, because it all rolls downhill.
• 11:03
  SPEAKER_02: So awesome.
• 11:04
  SPEAKER_02: Okay.
• 11:05
  SPEAKER_02: So uh I think we've kind of got the housekeeping out of the way.
• 11:08
  SPEAKER_02: Uh we've talked about the easy to answer questions for the 48 CFR rule and really put um the rule in context for us.
• 11:16
  SPEAKER_02: So I'd like to go into some more uncomfortable questions that our customers have for us that are the ones they really care about.
• 11:26
  SPEAKER_02: So um let's just get it started.
• 11:28
  SPEAKER_02: So, given the complexities and costs that you've mentioned um associated with this CMMC 2.0 compliance, how would you respond to the concerns from small businesses, um specifically all businesses as well, um, that these regulations may push them out of the defense contracting market?
• 11:50
  SPEAKER_00: Well, well, I could tell you that I've not ever heard that before, but I'd be lying to you.
• 11:56
  SPEAKER_00: Right.
• 11:56
  SPEAKER_00: There are we've I mean I I've heard that from several of our clients.
• 12:00
  SPEAKER_00: And uh, you know, I'm we're uh a lot of times we're the uh bearer of the bad news, so we get the brunt of it, and uh we say please don't shoot the messenger, you know.
• 12:10
  SPEAKER_00: Uh but it's a it's a very good question and and a very real concern.
• 12:14
  SPEAKER_00: Uh so you know the DOD says that uh that it'll cost small entities uh about$107,000 for the certification.
• 12:25
  SPEAKER_00: And that's just a certification that's not to prepare for it.
• 12:29
  SPEAKER_00: Well, that's part of the part of that is preparing for the certification, but that's not uh all your services to be compliant, everything you have to do to stay compliant.
• 12:38
  SPEAKER_00: That's that doesn't include any of that.
• 12:40
  SPEAKER_00: So just for the certification assessment,$107,000.
• 12:43
  SPEAKER_00: Um after looking at their costs and talking to several uh assessors and see-through PAOs and and other people that do what we do, that's probably about right uh for small entities, and it'll go up for larger entities.
• 12:58
  SPEAKER_00: It does it it scales well, so the bigger you get, it doesn't mean if you're double the size of a small entity, you're gonna pay double.
• 13:05
  SPEAKER_00: But uh so really what a lot of our clients are saying is that they want to be ready, they want to get certified uh as soon as they can uh because they want to use this basically as a as a marketing opportunity, right?
• 13:23
  SPEAKER_00: Uh to be able to get more business, because if you're one of the first on the bandwagon to to be certified, then you're gonna you're gonna have an easier time getting those contracts.
• 13:32
  SPEAKER_00: If they if the DOD, if you can say DOD, here it is, here's my certification, and I'm good to go, guess what?
• 13:39
  SPEAKER_00: You're gonna be the easy, easy company to work with.
• 13:42
  SPEAKER_00: So for those of for those that go through that certification process uh and do that, it's a really good thing.
• 13:50
  SPEAKER_00: Also, to go back to the JSVA, that's why a lot of companies, I say a lot, there's not a lot of companies that are going through it, but the companies that are going through the JSVA and are actually voluntary, uh those companies are doing it because they want to get ahead of the ball.
• 14:06
  SPEAKER_00: Uh they want to uh be able to say, hey, look, we've gone through our GSV, JSVA assessment, and we're good to go, and we want some of those contracts.
• 14:15
  SPEAKER_00: And so that's a marketing opportunity.
• 14:17
  SPEAKER_00: Uh, you can make that money back.
• 14:20
  SPEAKER_00: Um it's work.
• 14:22
  SPEAKER_00: I'm not gonna lie, that's a lot of work, a lot of documentation, but uh it'll when you get that defense work, it's gonna be at least should be worth it.
• 14:31
  SPEAKER_02: Right, yeah.
• 14:32
  SPEAKER_02: Those are some brave souls, but they'll probably get some of the first contracts.
• 14:35
  SPEAKER_00: Yes, right.
• 14:36
  SPEAKER_00: Yes, they will.
• 14:37
  SPEAKER_00: It'll like I said, uh it'll be very easy to say, you know, here's my certification.
• 14:42
  SPEAKER_00: Uh you'll be in a database, but uh, you know, here's my certification, uh, we're good to go, and they're gonna say, Hey, Joe Blow's machine parts over here, they're certified, let you know, they they're the easy one.
• 14:55
  SPEAKER_00: Let's give the contract to them.
• 14:56
  SPEAKER_02: Right.
• 14:57
  SPEAKER_00: Okay.
• 14:58
  SPEAKER_02: Thank you.
• 14:59
  SPEAKER_02: So the next one I have for you is what are the potential consequences for subcontractors who fail to achieve the required CMMC certification by the deadline specifically?
• 15:13
  SPEAKER_00: Well, the deadline uh is gonna be at contract award.
• 15:17
  SPEAKER_00: Okay.
• 15:18
  SPEAKER_00: So uh that's what the proposed rule says, uh, that's what we've expected all along.
• 15:24
  SPEAKER_00: Um but if you don't have that certification by contract award, guess what?
• 15:30
  SPEAKER_00: You don't get it.
• 15:31
  SPEAKER_00: That's that's uh that's the ramification, that's the consequence if you don't uh if you're not certified by the time that contract is ready to be awarded.
• 15:40
  SPEAKER_00: So you won't get that.
• 15:42
  SPEAKER_00: And they uh so with an economy like it is, you know, uh, you know, I I would rather be in a boat of being able to get those contracts than miss out on those contracts.
• 15:55
  SPEAKER_00: And you know, it can be 25% of your business or 95, and that's still a significant chunk of 25 is still percent is still a significant chunk of your business to lose.
• 16:06
  SPEAKER_02: Right.
• 16:06
  SPEAKER_00: So uh it's it's a very important thing uh to be certified and to be there beforehand.
• 16:13
  SPEAKER_00: You always got a plan for those oopsies, you know.
• 16:16
  SPEAKER_00: You know, it's taking us longer to get certified than I thought it would because we've got to do X, Y, or Z.
• 16:22
  SPEAKER_00: So and depending on how many people have to uh get certified at a you know a certain time frame, there may be a crunch time and a you know a wait list.
• 16:33
  SPEAKER_00: So you can't you can't leave that to the last minute.
• 16:36
  SPEAKER_02: Right.
• 16:37
  SPEAKER_02: So I think the real risk, if I'm understanding you correctly, here is um the cost of not being prepared when this actually comes through um in terms of the contract obligations um and the timeline associated with getting ready.
• 16:52
  SPEAKER_02: Because it takes so long uh to get ready that you don't want to leave it to the last minute because then you're months uh behind the ball.
• 16:59
  SPEAKER_02: Is that right?
• 17:00
  SPEAKER_02: Yes, absolutely.
• 17:01
  SPEAKER_00: Yeah.
• 17:03
  SPEAKER_00: Bottom line is if you're not ready, the the risk is that you'll lose out on contracts.
• 17:08
  SPEAKER_00: Right.
• 17:08
  SPEAKER_00: Okay.
• 17:09
  SPEAKER_00: Okay.
• 17:11
  SPEAKER_02: So how does the government plan to enforce these new CMMC requirements?
• 17:16
  SPEAKER_02: Um, and what recourse do subcontractors have if they believe they're unfairly assessed or penalized?
• 17:25
  SPEAKER_00: Well, the uh the way to enforce these new CMMC requirements, I mean, is certification.
• 17:31
  SPEAKER_00: So uh, you know, you come in, uh the assessor comes in and certifies you once every three years, and that that is the process by which they enforce the uh CMMC guidelines.
• 17:43
  SPEAKER_00: Uh so it'll be enforced by C3PAO uh uh once every three years, uh, and then uh a principal or executive of the company, somebody, somebody imported.
• 17:54
  SPEAKER_00: It can't be a lowly IT guy.
• 17:56
  SPEAKER_00: Right.
• 17:57
  SPEAKER_00: In fact, we've said this at other times, but this is not an IT issue, it's a business issue, right?
• 18:02
  SPEAKER_00: Right.
• 18:03
  SPEAKER_00: So uh, but it's gotta uh anyway, an executive or a principal has to attest to it every year and say, you know, I promise, you know, that you know, this is that we still meet this.
• 18:15
  SPEAKER_00: So um so if you think you've been unfairly assessed, the time to address that is before the assessment is over.
• 18:25
  SPEAKER_00: And you know, it's kind of like talking to a police officer that's pulled you over for speeding or something, you know.
• 18:31
  SPEAKER_00: Uh you don't want to be a jerk to the assessor, right?
• 18:35
  SPEAKER_00: But uh, you know, you want to bring it up, say, hey, this is not the way I understand this, or whatever the case may be, and just work through it and discuss it and talk about it, you know, and see what they can do.
• 18:46
  SPEAKER_00: They can't, again, they can only assess you, they can't give you any cons any consulting, they can't help you out, right?
• 18:54
  SPEAKER_00: Um uh the time for that, uh the time for any of that consulting is beforehand, one of the pre-assessments I was talking about, or a mock assessment or something like that, is uh the time for some of that CMMC consulting.
• 19:06
  SPEAKER_00: But after the fact, uh if you have been uh if you think you've been unfairly assessed on a control or or an objective or something, then uh then you file an appeal uh with the C3 PAO.
• 19:21
  SPEAKER_00: So the C three PAO is the company who provides the assessors.
• 19:26
  SPEAKER_00: So if you've already talked to the assessor and they said no dice, you know, and they turn in the score, then you fill out an appeal.
• 19:35
  SPEAKER_00: There will be uh a formal appeal document process coming out, but uh you basically appeal to the C through PAO, they take a look at it, they talk to you, they talk to the assessor, uh, and they they make a ruling on it, basically.
• 19:50
  SPEAKER_00: Uh which kind of seems unfair because it's a company that assessed you.
• 19:54
  SPEAKER_00: Uh but uh an assessor is like a judge, you know, in a contest, sorta, not exactly.
• 20:00
  SPEAKER_00: I don't want to I don't want to degrade what an assessor is doing, but they're sort of like a judge, but you know, they can one assessor can say I can understand that, and the other assessor say no, it really means this, you know.
• 20:12
  SPEAKER_00: Uh, but you know, a C through PAO can look at it and say make a judgment call, yes, I think you're right, or no, the assessor is is right, we're gonna stick with our ruling.
• 20:23
  SPEAKER_00: At that point, uh you should be able to uh appeal to the uh cyber A B, the the board that oversees all the C through PAOs, and then they'll make a final determination.
• 20:34
  SPEAKER_02: Okay.
• 20:35
  SPEAKER_02: So there is a a process um that if needed uh to be used, a formal process to appeal, but appeals are never ideal.
• 20:45
  SPEAKER_02: Right um because I mean appeal is appeal.
• 20:49
  SPEAKER_02: It is now never guaranteed, and again, like you said, it's you're gonna be um readjudged by the same general entity that had previously um uh judged you, right?
• 21:01
  SPEAKER_02: So it sounds like to me, tell me if I'm wrong, but there might be some good legwork associated uh that that subcontractors or contractors might want to do in terms of uh uh can can they pick their assessor?
• 21:18
  SPEAKER_02: Can they interview their assessors?
• 21:19
  SPEAKER_02: Can you find your own?
• 21:21
  SPEAKER_02: What a very good question.
• 21:22
  SPEAKER_00: So uh so yes, you can uh what with you can pick your assessor and say, I want Johnny Appleseed here to uh to do my assessment.
• 21:33
  SPEAKER_00: And that doesn't mean that you'll definitely get Johnny Appeseed, but because Johnny Appleseed may be a hundred clients deep and in this, and you may need it before a certain timeline, before a certain time frame.
• 21:46
  SPEAKER_00: Which goes back to being prepared.
• 21:47
  SPEAKER_00: Being prepared, yes, exactly.
• 21:49
  SPEAKER_00: So uh I've done so the reason uh we've gone I've gone to a lot of CMMC conferences, talked to a lot of assessors, and one of the things that I'm defin uh really afraid of for us and our clients is getting one of those jerk assessors, you know.
• 22:05
  SPEAKER_00: They're just they just wanna stick it to you, you know.
• 22:08
  SPEAKER_02: No offensive assessors, but there are there's always ten percent of people, right?
• 22:11
  SPEAKER_02: People are people.
• 22:12
  SPEAKER_02: Yeah.
• 22:13
  SPEAKER_00: Yeah.
• 22:13
  SPEAKER_00: There's good people in every in everything, there's bad people in everything.
• 22:16
  SPEAKER_00: And I'm not not that they're bad, but they're uh they're very strict in the way they the way they assess everything, the way they do everything.
• 22:24
  SPEAKER_00: So um which uh so we want to look for those assessors that um not anybody that'll skirt the rules but absolutely not but people that will understand and say understand how you've done things uh have some idea of uh technology and all that kind of fun stuff um and so uh through going through this assessments or or excuse me going to these conferences and uh talking to a bunch of assessors and all that kind of fun stuff we've actually identified uh some assessors that uh we want to work with and you know we've also identified some that are are great people but we'll probably call on somebody else so uh and it's good to have a a few of them to to be able to choose from and uh so we've we've we've got a few uh we've got a few names that of people we want to work with so yes you can absolutely choose doesn't necessarily mean because of the reasons I said a minute ago that you'll get that one but right uh but yes you can choose right so uh good idea never discard any roles of course but it would be ideal uh to do the legwork be prepared get certified early so that way you can um uh find somebody that's gonna be very studious about it but also very understanding and and under and be able to interpret the rules in the proper ways so and not hold you so close to the fire with such strict uh enforcement um that it's gonna hurt.
• 23:52
  SPEAKER_00: Right exactly okay the only other thing I I'll I'll reiterate not add but reiterate uh is that along with the preparedness that we've been talking about and hammering on and several of these questions starting to be a theme I think there is a theme there so um but is to get those is is is to start early be prepared uh hire that assessor to come in and help you with the pre-assessment even if you've got uh a company like us who have uh who are certified who've gone through this been involved in it for several years uh for that first go round uh you know it's really good idea to get somebody to come in and do a pre-assessment and to bless you and say yes I think you're good and and you should they can't get nobody can guarantee anything.
• 24:39
  SPEAKER_00: In fact when you become certified by the Cyber A B uh it's specific one of them it specifically states that you can't guarantee anything.
• 24:47
  SPEAKER_00: Right.
• 24:48
  SPEAKER_00: So it's never a good idea to do it anyway but by the cyber A B rules they are forbidden from guaranteeing any outcomes which makes total sense.
• 24:57
  SPEAKER_02: Right absolutely yeah so it's preparedness.
• 25:00
  SPEAKER_02: Yes absolutely and it's a good idea to avoid anybody just to get that out there that does guarantee things because uh that might be a sign to call somebody else.
• 25:12
  SPEAKER_00: Yes absolutely absolutely absolutely okay with the phase rollout of the CMMC requirements do you think there is a sufficient clarity and support from the DOD to help those subcontractors meet the deadlines specifically I'm talking about those that are less resourced well to be fair at this point no I don't think that there's enough clarity uh in in some of these important points especially some of them uh with this proposed proposed CF uh 32 CFR rule uh with ESPs external service providers okay um so I don't think there's enough clarity but fear not because that 32 CFR rule the final rule should be out uh towards the end of this year and at that point we'll have we'll definitely have some clarity uh around that uh so as for uh dod support um so the support they provide is information overload basically there's tons of information you know how the government is they're very wordy on everything uh and uh the thought that they have uh given enough warning on compliance so they've been warning you since 2017 that you have to be compliant uh with NIST 800 171 uh so things have changed over time but really the base the base rules the base uh controls uh that you've had to comply with ever since then of 2017 uh have have not changed uh there's a few little things have changed here and there cmc program itself has changed but uh the uh controls really have not significantly changed uh we always also hear uh of grants uh and nonprofits that help with uh they can help companies um when you really look into it uh normally what that means is uh they'll help you and but you still have a lot of legwork to do uh so it's not to bash any of those nonprofits they they help you understand and all that uh but you still have uh it's not a magic bullet uh so there is that help out there uh but they you still have a lot of legwork to do you have to do all the work yeah yeah there it seems to be a lot of um um uh resources from nonprofits or even free templates or templates you can buy for um um a lower cost um but I think in terms of your paperwork uh and there's some consulting I think from these agencies and and whatnot but I think the real burden uh is the implementation of it and there's not a lot of help there from what I've seen and am I right?
• 28:15
  SPEAKER_00: Right no that's that's correct the the real burden is implementation and then to part of that implementation I'd say I was going to say the another part but really part of that implementation is documentation.
• 28:26
  SPEAKER_00: And like I said a while ago it's also documentation and it's it's more documentation.
• 28:31
  SPEAKER_00: So uh just the amount of documentation you have to provide for this and from the get-go to prove that you've been doing this right uh because this isn't a once and done thing this is something you manage on a recurring basis.
• 28:44
  SPEAKER_00: The other thing that DOD says that that they've done uh in the phase rollout to to help with uh small entities um uh is really the phase rollout itself uh they they definitely refer to that and out of the 6000 small uh or 6000 entities uh that are contractors that they have uh there's gonna be 1100 the first year so that's a very small percentage uh that have to be level two certified so that's another way that they've said that they're they've they've helped this help small business uh with this uh helped help them along with this and be prepared because only 1100 or so will have to be uh certified now how that'll actually shake out whenever you know lockheed gets their contracts and says oh yeah now we have these 52 contractors here for this one contract that that now have to be level two compliant you know we'll have to see how that actually shakes out.
• 29:44
  SPEAKER_00: Right.
• 29:45
  SPEAKER_00: But the whole point is that there's a smaller percentage the first year uh a pretty small percentage of first year that'll have to be level two certified you have to go through that assessment.
• 29:54
  SPEAKER_02: Okay.
• 29:56
  SPEAKER_00: What do you believe the biggest misconception is uh about CNMC 2.0 compliance among subcontractors uh and how they can overcome it well the main misconceptions and misunderstandings uh that I see uh are some of them are kind of subconscious I guess uh but uh really those are that uh you can do it in your spare time you can do your regular job and then you can finish this as you have time uh or you don't need to hire anyone uh which kind of goes in with that um uh or you just have to follow a checklist I just give me the checklist I just need to know what I need to do that's not a checklist sorry so uh those are the main misconceptions the fact that there are 110 controls and 320 objectives uh that make up those controls uh should help you understand uh that that your more spare time that it's more than spare time will allow this also requires some deep understanding of those controls and those objectives uh and how they apply specifically to your to your um to your instance right uh so if you hire somebody to help even though it may be expensive uh it'll help you shrink that timeline it'll help you make sure that you uh you get those controls addressed as they should be those objectives uh addressed as they should be and uh this certainly is not a checklist of things that you can do to implement and check off of course uh and and in actuality I guess we do try to make it as much of a checklist as possible uh because you want a a repeatable process right uh otherwise if everything is a hundred percent custom then it gets really expensive really fast so you want a repeatable process so it in essence you do have sort of a checklist uh but uh it's you have to apply it to each unique environment uh some people will have you know some stuff they have to keep uh on premise um that's very common in manufacturing some people will be able to put everything in the cloud uh you know and then there's gonna be a lot or who are hybrid so uh but uh we do have you know a repeatable process um and but it's it's not necessarily a checklist but it's a repeatable process.
• 32:19
  SPEAKER_00: Right.
• 32:19
  SPEAKER_02: Yeah so maybe less checklist won't cut it but a systemized approach to your business is yeah that is a very good way to put it yes absolutely I think that stands to reason because I think I filled a lot of um the the first time calls from our customers and I'm usually the the first face they see and I think the most common thing I hear um is I'm overwhelmed and frustrated and trying to do this myself and so I finally decided to to reach out.
• 32:46
  SPEAKER_00: Yes I I think that's uh probably about a hundred percent of our clients that have that have reached out to us is they tried to do this themselves and then yeah they just got overwhelmed and decided they need help.
• 32:56
  SPEAKER_02: Absolutely last question I have for you is if you could give one piece of advice one takeaway for this video to DOD subcontractors preparing for CMMC 2.0 compliance what would that be?
• 33:14
  SPEAKER_00: Don't wait.
• 33:15
  SPEAKER_00: Okay so don't wait whatever you do uh this is not a something that can happen overnight or even in a couple weeks uh you know back in the day before the certification part of this assessment you know you could be compliant in uh in two weeks you know we could come in and help you out uh we could give you your SSP your poem your uh all your policies and your plans and say there you go there's your roadmap there's what you got to do now you're compliant and uh but no that is no more uh so it's uh to you have to actually go through that poem and finish everything and uh and then now there's more documentation than you can shake a stick at that you need to you need to prepare uh so there it's a lot different in that manner than it was back when it all started uh so uh in other words a lot of work so again preparedness is is the word of the day so don't wait be prepared get prepared early and the the other thing I know you didn't ask for two things I'll take it though you know uh but the other thing really is I have to say it one more time it's it's documentation and it's also documentation and it's also documentation and it's most frankly more documentation.
• 34:33
  SPEAKER_00: So there's kind of a theme there.
• 34:35
  SPEAKER_00: Don't wait and it's a lot of documentation.
• 34:37
  SPEAKER_02: Right but at the end of the day the only thing that will prove to an auditor or an assessor um that you've been doing what you're supposed to be doing is the documentation to prove it right it is it is so absolutely absolutely yeah it's uh I know you didn't ask anything from me but uh I would like to share you you brought up um how burdensome this has become since 2017 to now um going out there and talking to other um IT providers ESPs and um implementers um uh specifically in the IT space what I hear is um we're no longer doing that so you're actually seeing a lot of service providers um in terms of uh more of the IT side exiting yes I feel just because it is burdensome now because you actually have to do things and comply um and prove it so there is you know um I've I've heard that from a lot of our um a lot of other of our friends and and uh compadres who are in this in this IT business you know they're you know we had uh we have some uh CMMC clients and we're just not doing this and they're gonna have to go find somebody else you know is it is burdensome and for small businesses it is hard.
• 35:55
  SPEAKER_00: So there's a lot of them that are saying that and this 32 CFR rule uh depending on how it treats how it ends up treating uh uh ESPs external service providers with that definition we're an external service provider but also the companies we use for services like uh sim uh for a log management and uh security operations center um you know for a lot of those businesses that we use to fulfill uh uh those parts of CMMC compliance um out of all of our vendors that we use there's only a couple of them that said yeah we're we're gonna be we're doing this and we're gonna be ready with you you know um so that means there's gonna be a change on the service provider side as far as the underlying tools and how you how you address this.
• 36:50
  SPEAKER_00: So there's gonna be some there's gonna be some big changes coming along.
• 36:53
  SPEAKER_02: Awesome thank you thank you everybody I think that's all we have um here today uh thank you for uh making it this far if you have uh and uh if you want something to take home to reference later uh so you don't have to watch uh this video again we should have down below um a report that goes over everything on the 48 CFR rule uh summarized and a little bit in detail so you can download that and uh take it with you show your boss reference it later it should all be there all right there we go