But if you had to pick a part of someone else's job, what would it be?
That you had to do. We're gonna start with Anne. I want to go. I want to go. I want to go. Okay. Good time. Go Ted.
I would pick my job. I'm living the dream, baby.
Who gets to talk as much as me? Nobody!
Ariel's got the face on that goes, I don't know. I have to be meetings with Kelsey. I was gonna say that.
That's a good point. Is there a way to be able to have more meetings
with Ariel and Kelsey than that's the part of their job?
That's my job. Are you saying that's the part of Ted's job you want is the power to be like,
this is the meeting that I want with the people that I want. Go.
Everybody does have a calendar so they can do that anytime they want.
You can, but I'm just saying I'm like the totem pole. You could schedule over a meeting and I'd
probably take you. Decide. Decide. Right. Yeah.
Yeah. Yeah. For sure. And you, Kelsey, do you want to read more compliance documents?
We love reading. Yeah. I don't envy a lot of Todd's responsibilities either,
which is probably just being pessimistic on a Monday, but I'm going, that sounds like a lot
responsibility. That sounds like a lot of compliance responsibility. Not to steal Todd's
answer, but I do really like my job. But I don't know. I think I would like to the fact that Todd
gets to work cross-departmentally. I'll probably a little bit more than I do. Some of the operational
stuff I find fascinating. So maybe just a day shadowing some of the operational stuff would be fun.
I wouldn't mind. I mean, these regulations are deep in the weeds, but I actually don't mind
a little bit, and maybe Ann's going to say that's not how it is, but sometimes the black and white
of it, this is the expectation and this is what you do. And just kind of going down your checklist
and where you at, what do you have to get done? I actually wouldn't mind that. I don't know about
all the reading that comes with it, but the process I think is very interesting.
So today on our TechBurbett Business Podcast is the Ann Show. We're discussing government
regulations. We've got Kelsey and myself are joined by Ann, our quality assurance analyst and GRC
specialist, and then Todd, our COO and CISO. And we're going to kind of do a little bit of
basic introduction to these government regulations and then maybe deep dive a little bit towards
the end. But I don't know if Ann wants to give us maybe a little introduction as to, you know,
how many acronyms you have to know and maybe a couple of the top ones.
Well, I would start with saying there's always a place to look up the
acronyms that we don't know. Really working with our state, local, and federal regulations
across the board. There's like we mentioned it just a little bit ago, there's always a manual.
There's always a place to refer and there's a way to find out what the rules are
with these different regulations and everything from a statute to a law.
We've had a lot of opportunities with our very customer base to see a lot of sides of different
regulations that our customers have and being able to support them with their technology
and how they do their business best. So needing to know or understand where our customers are,
CIT as a whole doesn't have a government regulation based on our products or our services.
We have certain accreditations to support our customers and theirs, but we as an entity
don't have any specific. So I'm just trying to think too. There's a few two big ones that have come
to the surface in the last few years are CMMC and Sejas and we'll start with Sejas because it's
smaller, but that's helping our customers manage not smaller, but it's a less lengthy and gooey mess.
It's very black and white. It is the criminal justice information services and our police
departments, our cities have information sometimes that requires us to understand how
Sejas information has to be protected in that there's a really riveting manual that I think
is about 260 pages that you can go through though and find that anytime you need to,
where that those controls are, we can refer to any portion of it. Luckily, that we can say,
okay, we'll recommend that you set it like this. It is always up to our customer though to
to ensure those are set appropriately. We can advise but not force. But just kind of going back,
the criminal justice Sejas information is the information that law enforcement uses to work,
to conduct business. It is things about criminal evidence. I'm looking at our notes too, but
the biometrics, a lot to do with the identity of a criminal and realistically, CIT doesn't
actually ever touch that kind of data. I just again want to make crystal clear with that, but
it's used to make assessments, make notes by law enforcement to support the legal system, I guess.
I'm going to jump in real briefly. I'm guessing that almost everybody that joins the podcast is
probably going to be having at least some level of engagement on the government level, most likely,
but just real briefly, Sejas is criminal information services. We keep throwing out the
acronym. I thought a little background would help. What's in information is the data is typically
collected by government, whether that's FBI, local government, etc. It is contained a lot of
information about what you'd expect, fingerprinting, criminal background history, missing persons data,
background checks, firearms, that kind of stuff. If you're going through the legal process, that's
the kind of information that's in the Sejas services systems. Sorry, continue. No, I did say the
criminal justice information systems, I just didn't say Sejas right after it. It made sense to me.
We're so immersed in this all the time that we forget that nobody knows what I'm thinking.
It is important to be aware of all of the regulations surrounding this so we can best
support our customers. But it's ensuring at a base level, it is really the methods that are
required to protect the data, but it's still protecting data. It's compliance at a base level.
We want to protect the sensitive information. We want to ensure people that have access to the
sensitive information only have the need to know to do their job. They don't have
access just because they feel like it. Being able to guide some of our customers where it is rare
that a law enforcement officer would read the security manual because that's not what they do.
Boots on the ground serving and protecting our communities, they certainly have no idea.
Yeah. It is really difficult from my perspective and I feel for them because they are
loving these requirements. We've found more than once that a chief of police is now being
expected to be an IT director. That's really not what they signed up for, but again, our customers
are fantastic in helping us help them and really looking at the types of information
the CGS information and going through these types of manuals and getting that, does this make sense?
Is this set up to the requirements in this manual? I think we always provide value to these customers,
but it's just another layer of protection, I guess. And knowledge of those levels of protection is
always the best to understand. With our team, go ahead. Oh, that's fine. I was going to say just
kind of wrapping around a bubble around that a little bit. I mean, there are a lot of different
organizations that do have some kind of, I was going to use the word culpability, I'm not sure
that's really right, but the reason why it matters is I mentioned not everybody is going to be in
government, or most people that are listening might be, but there is also an extension to it.
If you've watched any of our podcasts in the past, we'll get into things such as supply chain or
just being a part of a third party. And as the world continues to get a little bit more complicated,
you start to see this rise in cybersecurity attacks, etc. You're seeing that there's a trickle down
process of it may be a city, it may be a county, it may be whatever, it may be the federal government
itself, but they are starting to hold everybody accountable to make sure that they're doing the
right things. And so you're starting to see that those organizations or government operations are
being told that anybody they're working with has to comply as well. So one of the things that Ann
mentioned early on was we don't really have the compliance requirement to ourselves, and yet we
do. So if we're working with a city, a county, a state, a contractor for the federal government,
they are looking to us and saying, how are you doing your due diligence to make sure you're
doing the things that you need to do and or help us get there. But if we're helping them,
they're still expecting us to be able to do all the things. So there is a strong guideline, whether
that's, I'll throw a NIS too, and I never remember the acronym, but we use it enough that you should
know by now. But there's, there's, let's do acronym soup, right? There's NIS, there's CMMC,
there's CGIS, etc. They're all kind of largely the same. And I think this is where Ann was going
to go next is what are the things that you're being asked to do? And they do have a lot of,
a lot of similarities. They may phrase them slightly different. They may categorize them a
little bit different, but at their core, they're still more or less the same things to make sure
that you're doing in the security world. We call it the triad. It's the CIA, confidentiality, integrity,
accessibility, or availability. And so they're all trying to get to that same thing. And I'll be
quiet again, because Ann was on a roll. I'm sorry, I disrupted your flow. That was perfect. No, it
really is. That, I always say at the base level, so many things are really the same.
One of those key elements in compliance in general and in information protection is knowing
what you need to protect. And then based on that, the layers add, we need to protect this specific
type of information or device or fill in the blank at this way. These devices are a different way,
but the different regulations for government are kind of taking all of that in a big circle and
saying, hey, we've identified the specific kind of information, rather than not knowing what to
protect. We know, and now we have to apply it regardless. So if it's the Seegis information,
like Todd elaborated on that person data, then we know it has to be protected this way. If it's
CMMC or what's called CUI, controlled unclassified information, then you know that this specific
data has to be protected this way. That's where all of these manuals, as riveting as they are,
they really do spell out exactly what you need to do. And CMMC has been a little different,
because it's evolved a little. But I think with CMMC, it's really just been who's allowed to
review the rules and protection haven't changed or the methods.
Yeah, one of the things that I wanted to kind of touch on briefly was what is the purpose behind
it. And as I mentioned, it's trying to do the triad, the CIA. And the reason for this being a
concern is as the world continues to change, the threats continue to evolve. You're starting to see
more people work remotely and brought up peacekeepers as an example of someone that would
potentially have access to sieges information. So they're mobile, they're outside of the building,
but still potentially having access to it. The threats are getting more and more complicated.
You're getting third parties in it. I'll use CIT as an example, since we do work with cities,
counties, etc. You'll typically see where we unintentionally may have access to a system.
So we still have to do all of the due diligence to make sure that we comply as well. It may be
something that was inadvertent. We weren't necessarily looking at it, but as we're working on a system
to get it to work properly, you may come across it. So we do have to do all the things. We have to
do the vetting, the so on and so forth. That's the main reason why you do this, these threats,
kind of as I mentioned, even with the tools themselves, where they're kind of universal and
they're kind of mix and match, the threats are too. There's a lot of sensitive information that
the bad guys are after. And so you see the same kind of motivations behind everything. They're
trying to get access to information that they want because there's value to it. And so when you see
the how do I then turn around and slow it down, same concept, I need processes and procedures,
etc. to do it. And of course, we need the people to be able to follow those processes and procedures
as well. Yeah, I was in a huge overview and maybe something to definitely deep dive in at a later
time. But you, Ian mentioned earlier, you know, speaking about law enforcement and maybe people
expected to be IT or doing compliance, who that is not their job. I'm curious, you know, as a
tech partner, when you're working with these people who maybe don't know and haven't read all
these things, where are those biggest, where are their biggest kind of missteps or miscommunication
or what are kind of those big things that they sometimes are missing when it comes to compliance
that you're helping support them? I'll jump in briefly and I'll turn it over to Ian. But I think
the comment of having responsibilities that they wouldn't normally have, we work with a lot of the
small and mid-sized organizations. And I think that's kind of a reoccurring theme we see in a lot
of cases where people get to wear many hats, unfortunately, and sometimes it's not their
forte. But when we see that come to fruition, things that you'll occasionally see is that
cities can be very large, they can be very, very large, or they can be very, very small.
And when you're looking at that variation, you're going to see that they're going to just naturally
be at different levels of maturity. And what that could mean is that traditionally, they've
inherited what they always have. I'll use a small city as an example where the city may just be
small enough where all of their systems came online and they just kind of stayed that way.
They were too small to worry about it any other way. As this starts to mature and the threats
continue to evolve, they're being asked, now you really need to do all the things. And that may mean
something like separating the city from the PD, separating, some may have the library,
where you're going to have people that go to the library jump on the wireless, making sure that
the liquor store is off the network. Those kinds of things are things that we typically see where
they're just not quite mature enough where they're saying, okay, how do I do these? What are the
natural steps? And of course, like everybody, budget is a concern. So where do you start?
How do you start to untangle what we've got today and put in a strong road map of where do we go
forward from here? I think to put a circle around that it's helping our customers,
they often ask Todd uses a version of this, tell me what I don't know that's important.
And we can try to stay apprised of any changes in the regulation or know the regulation. So
of any kind to try to see going into a new customer or an existing to say, hey, maybe this isn't an
align and maybe you're aware, maybe you're not. There are times and places where they've come
back and said, yes, we are aware and that is something we're not, it's not even on the radar
for a while. Well, you have to maybe be compliant by December 31st. Oh, that I wasn't aware of. Okay,
so like, and in almost every type of regulation, though, to whether it's the government industry
is banking with rare exception, if you are taking steps to meet compliance and you're not quite there,
almost every auditor we've encountered of or examiner, that kind of thing, if you have a plan
in place to meet the requirements and you're not blatantly disregarding them,
there's a lot of leeway in that. It's not that people willfully miss these regulations, but
like Todd said, they had one server this whole time and now they're being asked to have a firewall,
two servers and 20 more users at a small city where those didn't exist. That's a huge burden.
That's a huge burden on a city. And when you think about coming to all of us as taxpayers to be like,
why did we have to spend another $150,000 on what, why? But knowing those kind of things to say,
we may need to show a plan and even helping in budgeting. I mean, having those regulations
to point to to say it's not just a suggestion, it really is a requirement. So let's try to get there.
So that, I mean, that's the more fun of our job, I guess, of my job that when you know that someone
isn't quite there in any one of these regulations, how can we get you there? Do we?
That's the fun of looking and saying what tools exist, what don't, how can we
will tell you where the holes are and maybe these give
priority to certain ones or even adding them to a budget. I think that's really where
your CIT is great in doing those kind of things with our customers. But I'm not trying to brag or
anything, but I think we do a pretty good job of doing that.
I mean, definitely you can brag, you can brag on our podcast.
It's us.
We do it all the time. Yeah, it's us. But we do recognize there are other people out there,
so we encourage you to reach out and find out what you have that comes up all the time,
no matter what we're talking about, know what you have. Is there anything else you want to kind of
share? We very much skim the surface. I think we're going to come back to this, do a little
deep dive, but anything else that you want to share about government regulations, best practices,
tips or tricks or anything like that? I will touch on it real briefly. I mean,
it does look very complicated. As Ann mentioned, there's these documents that are 20 pages long,
and that is very typical in the world of compliance, but they do exist for a good reason,
and they are trying to spell things out as clearly as they can. Unfortunately,
when you're trying to be incredibly clear, sometimes that means you end up using a lot of
words. That would be me. The reality is you can boil these things down, and this is where your
tech partner starts to be able to translate those documents into meaningful, actionable things.
Some of those things are the stuff we talk about over and over again. Do your cybersecurity training,
make sure you've got an incident response plan in place, make sure you got your physical security
in place. There's a lot of stuff that's pretty standard, but I think that's a good thing to
make sure that you're dotting your eyes and crossing your T's. Some of the things that
become a little bit more complicated in the government layer is that you need to make sure
that you've got some agreements in place. They call them the information exchange agreements,
and those are really kind of in the typical business world the analogy I'd make would be
your NDAs. You're trying to make sure that you've got agreements in place that say we
can share information without giving out too much. Then the last thing that I want to make
and then the last thing that I wanted to add on and again I'll turn it over to Ann so she can expand
on anything that I covered too quickly or didn't at all would be that there are concerns about not
being compliant. Now, if you're a government entity and you're being told you need to be
compliant, they're not going to kick you out of the government. There is a little bit of leeway
in there, but there are certain things that if you're a partner, there are issues and concerns.
If you're a non-compliant as a partner and you're being asked to, some of the downsides are you
could potentially lose access to information. So, see just in particular, a great example would be
banks do background checks on their employees, and if you lose access to the data, you can't really
be compliant in making sure that you're doing good hires. There are fines and then worst case,
it's possible that criminal charges could be brought against individuals as well. So, there
are concerns to make sure that you take it seriously and of course it's the government and they can
enforce their will. So, be cautious, be diligent. That is the, I think that contractors are actually
held to a slightly higher standard than say a government entity like the city's municipalities,
that kind of thing, because we can have fines and I'm sure a city could too, but we don't,
we lose business then and we don't want to do that or a contractor not compliant with the
government regulations will lose that big contract that, you know, employees 25% or 50% of their
business. So, it gets to be very real when you potentially lose something as significant as a
good chunk of your business, but it's not, it makes people suddenly pay attention as well.
For sure, for sure. Well, thank you Todd and Ann for joining us today. I think we'll definitely
have a deep dive on this in the future. If you enjoyed this podcast, please like, subscribe so
that we know that you're into this subject. If you have a question or a topic you'd like us to
discuss, reach out to us at info at cIT-net.com or head out to our website cIT-net.com slash podcast
and we'll be back next week with an all new episode.