Latest / You've Been Heard / 409- Permission to Play w/Nathan Kaufman

Transcript

409- Permission to Play w/Nathan Kaufman · You've Been Heard

• 0:09
  Speaker A: Welcome back to you've been heard everyone. And today we've got Nathan Kaufman. And Nathan, you've been doing a lot of stuff around cyber security and actually getting an organization compliant for business with the US government. The I believe that's where CMMC really comes into play as being compliant for doing business and requirements for the DoD to make sure that all contractors, subcontractors and sub subcontractors are all being very aware so that nobody accidentally introduces vulnerabilities. But we'll get into all of that in just a minute. But for the moment, why don't you tell us a little bit about who you are, where you came from and how you found yourself being the head geek and cybersecurity guy for infrastructure and stuff. Sure.
• 1:03
  Speaker B: So I have 25 years experience in IT, my way up from desktop support all the way through being a director of IT. Started in 2000 as a MSP consultant. Before they were called MSPs, they didn't really have that name back then. We got a certified in 2001. Yay. I'm a lifer and I worked across many organizations at 10 person ISP. I worked at, AT&T. I got laid off twice from AT&T and decided I'm done with AT&T. I've done a lot.
• 1:37
  Speaker A: Why you do that?
• 1:39
  Speaker B: Yeah, like why would I want to keep going back? And so like I've done carve outs, divestitures, mergers acquisitions, done complex regulatory compliance, and I built two IT departments from the ground up. Yeah.
• 1:53
  Speaker A: And actually on LinkedIn stalking that I was doing, I noticed that at the last organization, or at the current organization that you're at, you did exactly that. You built it from the ground up. So talk to me a little about what it's like going into an organization. How large was the organization when you came in and what's the user base and what kind of scenarios did you have there to deal with to build it from the ground up? Because most everywhere I've been, it's. There's something's already in place.
• 2:23
  Speaker B: Yeah, it was an interesting place. They were about 60 software engineers. They all had Linux as their primary operating system, laptops, various ages of the laptop. They had maybe 20 office staff. Between manufacturing and admin stuff. They had no active directory. When I got there, they had SSH open to the Internet. Yeah. Directly into a Synology NAS, which was their primary server, OpenVPN. And so there was pretty much everything you can think of not to do. A flat network, multiple different switches. They were using ubiquiti equipment, which isn't too bad, but it was out of date and not patched. And so there's just a big hot mess. And they know. And they had to be CMMC compliant in two years. So they needed somebody to come in the new technology, knew the government regulations and get them compliant in two years so they can keep the business alive.
• 3:22
  Speaker A: Wow. The number of challenges behind all of that. How large again, was the user group?
• 3:27
  Speaker B: It was roughly 80 employees when I was brought on. And I was a director of it, but a director of one at the time.
• 3:35
  Speaker A: Yeah, director of it, me. And okay, so like, I've looked at trying to do CMMC and get to level one and just trying to mark off each of the check marks that's on that list, let alone level two within two years and the challenges or the opportunities that you had with that. So, wow, where'd you start?
• 4:04
  Speaker B: So during the interview process, I met the two engineers that were kind of the IT people at the time. And so my jaw dropped, probably in the interview after talking to them about the technology. But they knew the state of the environment. They were doing things the wrong way. So I think it was refreshing that they were able to have somebody ask them a bunch of questions. The last part of the interview was five hours long. I went on site and pretty much interviewed with every executive, took me out to lunch, all that fun stuff. Obviously I got the job. And so I started with kind of a good understanding of where I come in. I did work with other departments, pretty much understand what the current state was. Get to know, like, all the key players, the different staff, like, who to talk to. Like, oh, that guy's got some hidden weird thing under his desk and he does all this stuff and it's like, that's great. That's critical business application that we should probably not have in a dying desktop under your desk. Go start building. Right? Yeah, like, yeah, that's great. Get access to all the equipment, get in there, kind of deep dive, see what's going on, just identify all the gaps they got, create a plan, and then work on executing step by step what the plan needs to be. I identified. I needed to bring on a direct report pretty quickly. Um. Cause I couldn't do it all myself. Work with vendors to kind of like, you can't do all of that in two years, no matter. Like, it's not possible without getting outside consulting and help and stuff like that. And then community location or multiple locations. So during this whole process, they had one location to start and. And then they decided to acquire another company in the middle of all this, they bought another company in Canada. It was kind of just ignored for the most part until later down the road. So they were doing their own thing. I had to stand up the infrastructure where I got brought on. And then they bought a company. They had one IT person out there, so they have three entities altogether. It was a divestiture, merger and acquisition. So they were carving off from a parent company. We had to stand up all their stuff migrated over, get it all integrated, plus standing up the IT organization. And then I got that done in nine months. I asked for a year, and that was quite the experience. It was challenging. Got active directory migrated. They had no antivirus at the place I was brought on to. So I mean, literally like everything you can think of to go wrong or not do right, they were pretty much doing. And I got it all under control. Implemented Rapid7, CrowdStrike, Hatchman deployments, all that stuff. The user headcount was 80 employees to start off with. The user headcount of the company we bought was about a hundred. During the entire thing, I believe they got up to 260 employees total. It was challenging. There's a lot of opportunities. It was fun, but 80 to 260
• 7:15
  Speaker A: in that nine months. Standing up a standardized interface and art interface infrastructure. Now multiple locations. Did it jump to the three true locations or was it still just two locations?
• 7:30
  Speaker B: And we really focused on the two. And then we brought in the third entity later down the road and probably getting. They had no baseline budget before. They really didn't know what their IT was. They had engineers with credit cards and they just bought whatever they wanted whenever they needed it. And so it's consolidating all of this stuff under the IT department outside of what was specific to, like, particular projects and contracts they had which would go in a separate budget, but like getting all of the software, all the licenses, all of the various aspects to running the business under one umbrella. So I can do manage, like instead of ad hoc, oh, we got to renew this license, we got to do whatever. Like people just running around getting that consolidated. Then they had a rough idea. It was roughly around 400,000 they were spending annually to about two and a half million. And they're like, what happened? Why are we spending all this money? I'm like, well, you didn't track it before you were spending it still. Plus we had to get all this other new stuff and licensing and things. And so that just adds to it. And then like convincing them, like, oh, really? This Is it is around $100 million company after they bought the other one. And so if you look at it going for 100 million, two and a half, it's like two and a half percent of their annual growth. So that's in line probably a little less than what typical companies spend on it. Especially in the government compliance. Like usually it's 4 to 6%. So I kept a tight budget too.
• 9:11
  Speaker C: If your Internet goes down and you're calling carriers yourself, that's not strategic. It we help teams centralize monitoring, proactive tickets and escalation across every location without capex. Less noise, more uptime, make it boring again. Just go to you've been heard.com and answer the seven questions to simplify, streamline and save.
• 9:32
  Speaker A: Yeah, well man, getting a hold of all of that stuff is a challenge because some of that stuff come on this, that environment had to have been ripe for shadow it. Not to mention the fact that it was just shadow it to start with. By what I would qualify things. It was not stood up with that infrastructure in mind. It was stood up and then things were bolted in. Yeah. Especially for Bruce. One of the people attending is saying that 2 1/2% is way below. Especially for a government provider.
• 10:08
  Speaker B: No, I mean it's way below. I mean it's from 400 to two and a half million. Right. Like that, that's a big jump to executives from their perspective. Yeah, like what I was going to have to chew. Right. Like you can only chew so much and you, you break it up in chunks to get to where you need to go. But yeah, the biggest challenge was communicating to the founders and, and executives that look, we're Department of Defense contractors. Sure, you can't charge back because of the products we were selling, but like permission to play. You gotta spend this money to get there.
• 10:41
  Speaker D: Right.
• 10:41
  Speaker B: Like you, there's no other option like you go out of business or like you spend the money to get compliant. Right.
• 10:48
  Speaker E: As a DoD contractor, there's going to be a massive investment being made right now to handle audits and the cyber security audits. They just passed a bunch of new laws that make the cybersecurity audits for the DOD contractors even harder. Are they even aware of these laws that they're going to lose their DoD contracts if they don't comply? Because then the harshness of the new laws is if you fail and don't have a corrective action within a certain number of days, you're gone.
• 11:18
  Speaker A: And actually my understanding is that that was already in place, that this has Been those requirements and those CMC.
• 11:27
  Speaker B: Well, they've. Since 2000.
• 11:29
  Speaker E: Kimber's got the same thing, right? He's got CMCC level two requirements, just like you have level two requirements with CMMC.
• 11:37
  Speaker B: They passed their audit in November. I got let go in August. So I stayed in touch with some of the engineers there. And so you're absolutely right. Like October 2025, CMMC requirements were going to be in the contract. If you don't have it, it's a pass or fail. If you don't have it, you have I think 60 days to.
• 11:56
  Speaker E: To show corrective action.
• 11:58
  Speaker B: To have the corrective action. And if you don't have the corrective action, that's it. Game over. All contracts done.
• 12:03
  Speaker D: So we are cm, CMMC level one compliant.
• 12:07
  Speaker B: The level two?
• 12:08
  Speaker D: Yeah, the level two compliant just hit coming out of the initial audit for that. Our auditor led us to believe that there isn't a finalization in that process. So you can. There's not a certification out there because there's no certified auditors to provide the certification. And everybody selling it is just on bullshit because there's nothing there to fit. That's what I was told. That's what I was told.
• 12:31
  Speaker B: No, no, that's completely wrong. Cyber AB is where you want to go to find auditors if you're really. We can talk in the chat community. I'm happy to give you recommendations if you're needing it. No, you, you need to be certified for CMOSCA Level 2. If you're handling CUI. If you're only handling FCI, not a requirement. So as a lead up to the part of getting let go, I was reporting to the CTO initially. Here's a founder, he decided to retire. I asked for project management to help out. I did not know it would be a nightmare dealing with project management. My typical involvement with project management before was like, hey, we'll let you do whatever you need to do to get the job done. Communicate with us, right? Like your deadlines, what you're working on. And we provide status reports to management. Right. Like we don't know technology. We'll just make sure you're, you're meeting deadlines and if those change, we'll adjust them and let management help.
• 13:28
  Speaker A: Yeah, and communicate. Handle and communicate.
• 13:32
  Speaker B: Organize, help, bring in other resources. You're like, be the gopher, so to speak. Right? Go. We need these meetings with these people. Help make it happen. The person that was doing the project management thought that meant to micromanage my IT staff, including me.
• 13:50
  Speaker A: And so without knowing it and everything
• 13:54
  Speaker B: that's involved, or he thought he did, but no. So he knew some terms which was helpful for explaining, but he didn't understand all the heavy lift that it would take. And so working through that was very challenging. But at any rate, we got it all done. We met the requirements.
• 14:14
  Speaker A: Oh, okay.
• 14:16
  Speaker B: So from a technical perspective, the easiest way to meet compliance with Level 2 is to identify where the CUI is controlled. Unclassified information for the those that aren't familiar with acronym, it's government data that is not classified, but it's sensitive enough to have certain controls. And so identify how that gets into your organization, what that actually is in relation to what you're doing, like how you're getting it right, like where it resides currently, which should be in a secure environment, but at this case it was not. And then get it in the secure environment and make sure it doesn't come back out. So we ended up using Azure GCC High, it's Azure Gov cloud.
• 15:03
  Speaker A: So I was going to ask about Azure and your use of that, but yeah, going into the government portion of it helps meet some of those. It's just built in for you.
• 15:15
  Speaker B: It's one of those things where the biggest thing with why you want the govcloud is the audit trail and logging that they keep for you versus commercial. You have to keep data for 90 days and I forget what clause that is, but basically that's what the Gov cloud does to help meet some of the compliance. Like if you got hacked, you got to keep that data for 90 days and the commercial doesn't do that. Okay, there's a few other reasons, but that's the main one.
• 15:48
  Speaker A: Yeah, and definitely useful to have it just built in by default so that you've got it and you're not having to add it in or do the configurations to add because you can do it in the public one, but it's all those configuration changes and. And to have it just built in is nuts.
• 16:06
  Speaker B: The other. Right. If you were to use commercial, I don't know the differences, but you'd have to store that data in a environment that is also locked down to meet all the requirements. So yeah, it just makes the whole process easier and we had a short timeline to get it, so that was throughout the go and the cost isn't significantly more. I mean it is, but if you got a subset of users that need it versus making all of commercial BE compliant, it just made it easier. The founders were also engineers and so they understand certain technical things. Software engineers and so they knew they had to meet government compliance. It was a thing to keep their contracts. They didn't know the depth of it and what it would cost. Presented them with multiple options. They didn't like the cost, had to come up with some other creative solutions. Turns out it wasn't really the route to go. And so we had to pivot back to what I originally said or they were still bulking at the cost. And so I'm like, look, this is permission to play. This isn't one of those things that like, if we don't get it by this timeline, that puts a whole business in jeopardy. I don't know how else to communicate this. And I had tons of data to back it up. They were in communication with other people in the DoD space already and they're like, all right, we gotta do it. So that that took almost a year of convincing with the executive team that we had to do it. Some of them were like, oh, we'll just get a waiver. I'm like, that's not how that works. So it took a while, but in the end term I was like, all right, well this is going to be a longer approach to do it. I understand that we can do an enclave. And I had a consultant lined up that could build it out for us. And then the idea was we build it out or we pay them to maintain it moving forward or train my team to manage Azure. We just take it on and have the team manage that aspect to it. But I'm like, if our team manages it, that means we need additional headcount because that means they're going to have to manage it. But so that's kind of where it went. But I still was able to make wins. Like they still had to be compliant with fci. That's a self attestation. So you say, yes, I'm meeting compliance requirements. Okay, good. Level two is they have a third party auditor come out and certify you. So self attestation is you still should meet the requirements you're supposed to, but they didn't view that as problematic as the requirement to have the contract.
• 18:29
  Speaker A: I was wondering about all of the audits and whether how much of this was that they had heard that they needed to do this and how much of it was that somebody had showed up at the door and said you're doing this or but bye. And, and here's your timeline with the fact that you had two years to accomplish it. It sounds like it's more of they realized that they needed it so that they could continue versus an auditor or somebody else showing up and saying, hey, you're out of compliance.
• 18:57
  Speaker B: Yeah, luckily during this time, they weren't hacked or breached or any of that, because that would have triggered out an audit a lot too. Yeah. At least not that we're aware of. So.
• 19:09
  Speaker A: And remind me of that audit timeline again and your experience with. Or your employment timeline.
• 19:16
  Speaker B: So I brought on end of 2023, basically two years. So basically August 2023 to August of 2025. But I got compliant in November. So I stayed in contact with the people, but I already had all the stuff in place. It's just the auditors couldn't get out because there's like, that's just what it was like. There's so many people that need to pass the audit and there's so many auditors. And so they had to schedule it in November, but they passed the audit. So.
• 19:47
  Speaker A: Yeah. So in other words, you'd built and set everything up and everything was good to go and then ultimately they just still had to wait for the appointment to happen for somebody to show up. Right.
• 19:57
  Speaker B: So there's a couple different ways to view this. Like, if you're at the top, right. And you're communicating with other executives at your same level. Right. Like money and value is the thing. Like, we're spending all this money. What value are you providing to the business? So having that in a clear, structured format, I think is very important for sure. And. Right. Like what we're spending all this money, why are we going to do it? And. Right. Like get it into terms that make sense to them. Like people end up giving any speech. Know your audience and that's pretty much it. Know who you're talking to to have them use the terms they use. Not necessarily like all the IT lingo because nobody really cares about that and maybe didn't care at professionals know other IT professional wording, but executives don't. So that's one aspect if you're communicating the same level. The other thing is if you're at like a director and you're communicating up, provide the value you're offering to like to other executives. Not just like, if you're reporting to the CTO or cio, you let them know, but let the broader audience know. So it's not like, not just filtered through one person. Because if you really like. I think the other part is like, what value are you providing? Well, if you don't take the time to actually like, one, believe you're providing this value, or two, take the time to Reflect on it. Because when, you know, weed solving all these problems, you may not really digest, wow, I'm making a huge impact on this organization. What am I doing? Take the time to document that, reflect on it, and distill it into information that you can communicate out to the broader audience. And then when it's supposed to be in, I gotta let go.
• 21:52
  Speaker A: Yeah. There's some great advice in the middle of all of that, that take the moment to pause, reflect on it. Because like, like your work on the CMMC compliance allowed the business to continue. So without it that the business stops. It's like, okay, we provided electricity to the organization and the value of it. It's. Oh, you met compliance. No, we made it so that you could continue to stay in business and being able to communicate that or to have that shift in mindset of. No, I didn't just make us compliant. I made it so that the business could continue having that kind of shift in your mindset is a product of what you're talking about, of that reflecting on your value and. But being able to articulate it is huge for all of us because I think that's one of the things that many of us struggle with. And being able to see it from that other point of view or talk
• 22:55
  Speaker B: about that other point of view.
• 22:56
  Speaker A: Whether you see it from there or not, you've got to at least be able to speak to it.
• 23:01
  Speaker B: It's very important and take the time to do it. There's a few different frameworks to kind of help guide you through that. SBI is one of them. Situation behavior.
• 23:11
  Speaker A: Is that.
• 23:11
  Speaker B: Yeah.
• 23:12
  Speaker A: Okay. Yeah, I was gonna ask.
• 23:14
  Speaker B: So, like, what's the situation? Like what's going on then, like the behavior. What did you do to. Or what did you. Like, basically, what did you do? And then the impact on the organization and then that's kind of a way to kind of. If you're. You're stuck to think about it. Right? Yeah, it's really. You gotta take the time to do it and celebrate those wins. Right. Like, there's a lot these leaders are doing, a lot you're doing for the organization and celebrate them. Celebrate them with your team. Like, it's not just you usually your other team needs to kind of get the feedback. They're doing a great job.
• 23:47
  Speaker A: And yeah, I don't know about you, but I find it so easy to slip into that mentality of, okay, I can put that check mark done, move on to the next thing and move on to the next thing and move on to the next thing. And not taking that time to acknowledge the win, not only for your team's morale, but for the organization, too. It's part of proving that value and showing that value and making sure that you're being heard. You got to communicate that out. My predecessor, the current organization, wasn't very good at that, and he was doing a lot of things and he had a lot of wins for the organization. But since he wasn't able to communicate it out, the organization didn't see all of the value that was being brought.
• 24:32
  Speaker B: Exactly. And you can have the amazing technical skills, which I feel that I have, but if you don't let anybody know about it, they're not going to know all the stuff you're doing. And that's a lesson learned, right? Like, advocate for yourself, advocate for your team. Let everybody, not just the executives, but the broader audience, like, get in the communication channels. Let them know what you're doing and setbacks that happened. Right. Like, you don't need to. Not the nitty gritty details and technical stuff, but like, but you need to be honest.
• 25:06
  Speaker A: Don't hide any of those stumbles. Every five of us stumble. All of us have challenges and they turn themselves into opportunities. But if you're not communicating them, if I'm not communicating them, then I'm afraid of what's going on today. And I need to be able to be honest with the whole organization so that we can be honest about when things are going to be achieved.
• 25:30
  Speaker D: Right.
• 25:31
  Speaker B: You know, things change. Let people know ahead of time. Right. Like, hey, we're going to roll out after the directory and oh, three months later, we're not quite there yet. So let them know when things change. Why? Yeah, why? Until they feel more comfortable with what IQ is doing. Yeah, in 18 months. I think AI is the biggest hype right now. And I think it's one of those things that's kind of like a black box where executives are like, oh, new shiny thing. We must do it, implement it in our whole organ or we lose productivity and missing out. So I was like, FOMO kind of. They don't really know what it is, but they need it. And so really, like, I think in the next 18 months, people will start to figure out where AI can fit in in organizations. Probably not everybody needs it. And the organizations that can adopt and implement it well will have far greater competitive advantage to those who just buy a tool and figure people will know how to use it. So there's a process to get people on board and start using it. And the cost of that Right. Like, oh, we're laying off 16,000 people because AI is going to replace all their jobs. I think it quite works that way.
• 26:43
  Speaker A: Prove that it works before you lay them off.
• 26:45
  Speaker B: Yeah, please. Right. Like, don't just. Yeah, AI can replace some people's sort of, but you still need a human in the loop. It's not perfect, man. Somebody said not perfect. No, it's definitely not. And so I think really where I see the advantage is already defined process and workflow and then how can you tie automations in there where AI could fill the gap or make it faster and better and distilling that information. Another way is like rag databases and stuff like that where like you can have like, for example, like all of these podcasts go in somewhere, right? You have the data, the transcripts, blah, blah, blah. And then AI can process that. And then you be like, oh, this podcast from three years ago that I did and I talked about this, like, you're not going to know that, but you can throw it somewhere in the database and search for it. So there's elements to this that are helpful, but having it replace everybody's job, I don't see that. Well, not next 18 months. I just stay at. You got to find out where, if it's best in the organization, what you want to accomplish, the outcomes you want, and then see if AI is the right fit.
• 27:56
  Speaker A: Okay, so let's, let's break into a little of the conversation around some of that, because I foresee this being a huge aspect of this within the next 18 months, that right now there's a buzz around vibe coding. And so anybody can code because they can talk to these generative models and they can start to have the generative models write code for them. You've got some of that cybersecurity background. And when Johnny Cornflakes is one of my coworkers, loves to say, starts figuring out how to buy code and creates this program, it introduces it inside of the CMMC certified network. What thoughts talk about shadow it. Vibe coding is about to just cover us all in that.
• 28:50
  Speaker B: Yeah, that's a big thing. So, right, like you gotta have governance and some sort of controls on things. Just filters and you can be aware of it. You can block it. You cannot block it. People typically will figure out a way around things that are blocked if they have some wiggle room. You can have some policies in place like, don't do this if you do this. Right. Like bad things can happen, but that doesn't prevent a breach. Right. That's a human element. So with cmfc, what I was talking about earlier is enclave, right? Like where is the data? Build an enclave and that's it. Like that's set. Once it's set, it's set. And if you want to introduce a change, you may have to bring in an auditor again. And so that's going to pretty much deter any executive from having to spend that kind of money to have somebody audit if somebody wants to vibe code stuff. And then if you don't pass the audit because somebody vibe coded things weird, now you lose all your contracts. So do you really want to throw vibe code in the cmc? Probably not. But is that on the other network? That's not necessarily a strict one. Compliance. How do you stop that? How do you prevent it? It's a cultural thing to a certain extent. And I think the broader question is how you stop shadow it. Because vive codes is one aspect to it. And I don't think it hurts to let people explore, but maybe giving them a kind of more isolated environment to explore so they can do it and not introduce it to production before it's vetted and tested and secured. Like the people are going to play around, but if you don't let them play around in a secure way, they'll do it on production network and well, that's typically not a good idea. So my personality is generally I, I, I love helping people and, and technology, I'm really good at it, hone those skills and so that's an avenue. I can help others. And I like stepping into complex environments or environments that definitely need help and, and getting things done in a way that provides like the organization value, build them up and like building teams, like high performance teams like that, that's a very rewarding thing like getting some, an admin to focus on the things they want to do with their career and then helping them achieve it and get there. Leaders, the good leaders I feel don't help just serve your staff, but they help build other leaders. And I love doing that. I take time to I guess lead myself first is probably the biggest thing. And we're not all perfect, but we try and then, so I guess what fires me up is solving a lot of business problems and helping people achieve what they want to accomplish. And technology is a way to do that, but building those personal relationships throughout the process.
• 31:43
  Speaker A: Okay, and so along those lines, is there anything that you want to promote, anything that you're doing currently, ways that you're trying to succeed yourself? Talk to us some about that, bring up some of those things and help let any of our listeners know what you can help them with.
• 32:03
  Speaker B: So there's a couple various things. I was a member of Heroic Us for a while. They have a personal growth coaching program. A lot of different things, but the probably piece that provides the most value is their philosopher notes. It's over 700 some books this guy is read. He provides cliff note versions. They're all related to like personal growth, stoic philosophy, like tons of stuff. If you want a good book to read, I recommend checking out the philosopher notes there. Tons of data, tons of information.
• 32:38
  Speaker A: What was the site again?
• 32:40
  Speaker B: Heroic Us.
• 32:42
  Speaker A: Heroic Us. Okay.
• 32:45
  Speaker B: I think they're trying to do Heroic Us us, but Heroic Us. And so the other portion of this, you can have all the logical theory and everything else, but there's an aspect to it of your nervous system. And I don't know how many people have heard of this, but polyvagal theory, are you familiar with that?
• 33:03
  Speaker A: No, I'm not.
• 33:05
  Speaker B: So there's a vagus nerve in your body that basically goes from your stomach to your brain and regulates the nervous system. And so there's a certain element of how you respond throughout the day that is tied to your nervous system, your default reaction to stress and how you view things. And there's actually ways that you can train your brain. It sounds kind of crazy, but there's ways that you can train pathways in your brain and work on this kind of like working out. You build muscles. You can really build, like pathways in your brain to help you handle stress better, to help you handle challenges better versus just like reacting and not handling it right. You can take a brief second back, do an exercise for like 10 seconds, and kind of flip that switch in your brain to get clear perspective on what's going on. It's asking me.
• 34:02
  Speaker A: Yeah. For me, I've always thought of that as the difference between responding and reacting. Because for me, when I react, it's that instant just in response. Yeah, I've taken that step back and then.
• 34:17
  Speaker B: Then move forward with a. Yeah, oversupply what you want. Like not showing up how you want versus showing up reactive, which typically doesn't always help. So it's positive intelligence. Com. It doesn't talk specifically about polyvagal, but I've done a lot of reading on this stuff. That's probably the most effective program to developing the skills to work through this process and figure things out. Those two programs have definitely helped me out through this process. Then if you need help, ask for it. I guess that's the other thing. Like don't be try to ask for help when you need it. I think this kind of summarize what I said before is when you're into weeds, you may not really take the time to reflect on the value you provide. Just take that time to write it down, celebrate the wins, and maybe even just write like a quick shot on like a note card by you that like, you can remind yourself of, like the worth and value you provide. Like, those little things definitely help you get through the day.
• 35:20
  Speaker A: Find your champions. Yep, find your champions. Well, talk to them. Let them tell you some of the things that I don't know about you, but I have a tendency to shove down those wins. I worry about the losses, and I carry those losses with me. But those wins, I have a tendency to go, oh, I, I, I'm just doing my job. I'm just doing my job. But when people recognize it and tell me, hey, this helped a lot, I got to capture those and I got to make sure to share that for my teammates. Being somebody else's champion is just as important as being your own champion. It's okay for you to be your own champion. I think that's one of the other things Nathan's trying to tell us. So if you've enjoyed today's discussion, please make sure to give us some likes or hit some stars or or leave some comments on your podcast collecting application wherever you happen to get this stuff and or if you happen to be a fellow nerd or a geek, join us at the you've been heard.com community so that we can talk about these things. No vendors are in there. It's just guys like us talking to each other. Guys and gals. So everybody's welcome in the you've Been Heard community. Thanks for listening, everyone.
• 36:34
  Speaker B: Thank you.
• 36:35
  Speaker A: Thanks Nathan. Truly been a wonderful discussion.