Today on our Tech for Business podcast, Todd, our COO and CISO and Ann, our Quality Assurance
Analyst and GMC Specialist.
Just joked about all these letters.
I'm here to discuss CMMC.
So we get Cybersecurity Maturity Model Certification.
Did I get it?
You did?
Yeah!
I love it.
And that's the last time we'll say it.
We'll just say the letters.
Ann or Todd, I was hoping you'd give a really quick overview and my question is really who
are we talking to today?
Who is affected by the changes coming to this CMMC?
And then what is it?
Yeah, why don't we start with what is it real quick?
Yeah.
Let Ann do that and then I'll jump into some who and she can expand on it.
It's a program.
CMMC, not anything longer, is a program that was built to protect the defense industrial
base which you'd hear Dibb referred to because we all love making words out of acronyms.
A lot of times people hear those words immediately or if they have a similar background to me
they're like, what, why are we touching this?
We should just let it go.
And really it's to protect the real details, not the overly secured, it's the medium level
things and it applies to prime and subcontracts of the DOD and that goes to many levels, say
a tier one, two, three and more.
I think we as a technology provider really hit that two and three level.
We're not typically dealing with a prime contractor but it's the smaller manufacturing
that CIT really deals with and it applies to them just the same as a prime which makes
it interesting and hard.
Yeah, so a couple of things.
This started out, what was it, 2019 I think is when they had the first iteration of CMMC
and it's gone through a couple of iterations since then.
It was a little bit longer than that.
I can look that up real briefly.
It's gone through a couple of iterations.
The reason why we're talking about it now is because 2.0 is out and we're anticipating
that this will be the final version that will end up being live.
The current timeline has it being included in contracts that will be accepted at the
beginning of 2025 so you're looking at February through April timeframe roughly.
And so with that in mind, the time to get serious about it is now.
When we've gone through a couple of the previous iterations, most people wait until the very
last moment which is a little scary because it's hard to put all of the pieces in place
at the last minute.
But expanding on the who, it's anybody that's providing any goods or services to the Department
of Defense and it's extremely broad so it includes subcontractors, it includes any providers
that happen to be within the supply chain.
So it's big.
I think the number they're estimating is roughly 76,000.
Companies are impacted by this.
So it's a big number and it does impact a lot of people.
And like I said, if you find yourself in that supply chain at any rate, the reason that
the last C I want to kind of highlight this is it's not as simple as just putting and
policies in place.
There's a certification process that needs to be completed.
So you have to do all of the stuff before you can be certified.
And then once you're certified, you can start applying for the contracts.
Some of the minor changes that happened over the last couple of iterations is it used to
be a couple of different levels and they've scaled it down from five down to three, which
makes it a little bit easier.
Level one is about as basic as it gets.
I mean, there's literally 17 controls.
It really isn't all that complicated.
But if you're going to be doing any business, you really need to be gunning for level two.
And that I think jumps up to 119 security controls.
So you go from a few to, wow, we got to get serious here.
The level two really parallels the NIST 800.
So it is that like Todd said, it's really paralleling that I like to think of the CMMC
controls, one, two, and three, which it went, I think Todd, you said that five to three
in this iteration is it's similar to what a SOC-1 type one to SOC-1 type two.
It's the now prove it.
Okay.
Now we have, okay, we've had these requirements for a really long time.
Like a lot of these stem from DFARS that have been on these contracts and have been
pushed or levied.
I don't want to say just like signed off, checked off, and not thought about much.
But they're like, yeah, we're pretty close to that.
I think this should be good.
But it's really having that extra level now that says, well, now someone else is going
to come and certify.
In level one, you can self-certify, but level two, you can't.
And that's really a huge leap to say, okay, now we have to have the evidence that we meet
all these practices they call them, that everything from minor auditing to how you handle and
safeguard your information.
So it's a big deal.
It really is.
And some organizations have had practices in place.
They've just never documented them, nor been required to certify that they do them in a
way or modify them year over year.
So it is a big, big thing coming.
I think it's, is it required in 2025 that it will be on every new contract coming.
It, we are seeing it already.
But it, the requirement I think has, that's the part, one of the few items.
The 2.0 isn't entirely ratified, if you will, by all parties yet.
But that has been one of the key pieces.
When is this effective?
Because there are people that are like, well, it should have been a long time ago.
And now we need to put a hard and fast date where that, that'll be included.
Yeah.
And I believe that the, the timeline was supposed to be more, I mean, so it's gone through several
iterations and I think they're trying to get it ratified a little bit later this year.
But to Ann's point, it is showing up in contracts already.
And I kind of wanted to highlight this.
This does impact a lot of small and mid-sized businesses.
I mean, when I gave that 76,000, the vast majority of them, and that's like well over
50,000 of those 76 are small businesses.
And I mentioned that because that, again, you most likely can't do this on your own.
You're probably going to need some assistance walking through it because you probably haven't
had a mature compliance process historically.
And I know you can easily get into the people's head if you go, is it worth it?
My answer would be yes.
But most people do know already inherently.
If you look at what it takes to start to go down that path, people are already doing business
with the Department of Defense.
And if you don't go through this process, that portion of your business is going to go away.
And you can quickly put a dollar amount as to what that looks like.
You can look at your percentage of it.
And assuming that's true, again, my perspective is now is the time really waiting throughout
the year is not going to get you where you want to go.
And historically, we have seen that.
So we've had a few starts and stops with a bunch of our customers throughout the years
as they're going, okay, I'm getting ready to gear up, which is good because again, now
they don't have to take massive leaps over the next quarter, a couple of months.
So in any case, anybody's curious, we're still in the, we just started the second quarter
of 2024.
So the timing of this podcast is pretty early in the process still.
But if you're needing assistance, it doesn't have to be us.
Obviously, we're not, our podcast does reach all parts of the country and beyond.
So there are plenty of people out there that can help with the process, but it's now's
the time.
Get your head around the fact that you need to start working on this because there are
plenty of projects that will take more than a couple of days or weeks.
I did quick find at least the information right now says that assessments will be available
Q1 2025, but the requirements will be Q3 of 2025.
That's what it is as of today.
Yeah.
So the assessment that Ariel's talking about is you will be required if you're in this
industry, you will be required to complete a self assessment every single year.
So those are the ones that you're going to start seeing at the beginning of 2025.
So I know this is, compliance is always, at least in my mind, like a lot of information.
So I was wondering if you could explain a little bit of the changes and is this going
to be a heavy lift for businesses?
Are they going to have a lot they're going to need to do in the next year to get up to
speed?
And it depends, but the average business, the average, if you're doing your due diligence,
are you going to have a harder time with all the changes coming?
I was going to say hit the sound bar.
Should we just have one?
Just hit the button just for that, that it's really, in the 2.0, there really is not a
lot of new requirements, to be honest.
It's still near's nist.
It just went from the five to the three.
And that actually gained a lot of clarity for who can certify who can't and whatnot.
But the requirements kind of remain the same.
Just because there was an iteration or an update to 2.0 didn't make those required by
this in 1.0, have those requirements disappear.
I think there may have been some people that chose to wait until 2.0 was out.
But it is a heavy lift.
It can be.
And it really getting through each of the requirements and seeing where you're at.
And even, I know, like Todd said, we can certainly help do these, the gap assessment help you
through a process.
But it won't go away.
And if you, again, like Todd mentioned, you risk not having that portion of your business
quickly.
And I don't think this is something that a lot of businesses are willing to just give
up.
A lot of that bread and butter of a smaller organization is this DOD base.
And they've never had those requirements enforced before.
And this is really kind of where what rubber meets the road.
And unfortunately, it is kind of a we mean business kind of deal.
And no one wants to be the bad guy, but this is kind of forced that hand to say, we've
said this to you many times.
We still need you to meet these requirements.
And now we've expanded those to make a little bit more to mirror the NIST.
And now someone's going to assess against this.
And even if you had tried to, you're over a year, you're still going to have to maintain
that year over a year.
Yeah.
And I think the depends part comes from everybody's in a different spot, right?
So if an organization has already started down the path, it's going to be a lot easier.
If you're waiting and you have been waiting, which, you know, love it, hate it, other,
when it comes to compliance, a lot of people will make the decision.
I'll do it when I'm forced to do it.
Personally, I'm not a big believer in that.
But my career sent me through manufacturing.
So I was always in the ISO world and in the constant improvement process in general.
So when I grew up, if you will, through my career, that was just kind of part of who
I was and how I learned.
And so when it comes to that, I look at it as more volunteer, which I would naturally
fall into and start doing that, which we started this at CIT before we have had any kind of
requirements, but we do fall heavily into that category as well.
I would love to say I have an idea what the cost would be for an organization to go through
this.
Unfortunately, since every organization is a different size, the pricing does vary, right?
You may have some things already in place, whether that's training and policies and procedures,
or you may have nothing.
And you're starting from ground zero, in which case there's going to be a lot to go through
and a lot of stuff you're going to try and get in place, which is still possible between
now and the beginning of 25.
But you are starting to run out a little bit of a runway there.
But there are some deep compliance requirements that are in there as well.
I don't know how deep we're going to get into the security questions and controls today,
but there is a lot there.
And so it can be a significant amount of work.
Just to kind of give you anything from a ballpark is if you've been going down a compliance
path anyway, and there's a lot of them out there for a lot of different reasons, this
had started and some people are on the path, you may have your antivirus, your security
policy, your incident response plan.
You may have good pieces in place already and you're just going, okay, the next big
piece for me is a SIM.
Well, that might be pretty straightforward.
But again, if you're nowhere yet and you're going, that's fine.
They're going to force me, I'll get to it.
Then there's a lot and you are literally looking at months worth of work.
One of the things that I think is interesting as you look at how CMMC has been evolving
is it started out pretty heavy handed, which good, bad or other.
It started because historically there was no enforcement of the rules, if you will.
And then they got a lot of feedback going, you're asking an awful lot of us.
And so they swung completely the opposite direction and made it extremely easy.
And then it's kind of settling down in the middle where it's still a big lift, but it's
not what it looked like in its original form.
There's still a lot there.
But again, the purpose behind it is it's time to get serious.
We are going to enforce it.
And if you can't do that, which is a whole certification phase, right?
If you're not certified, you're not getting the business.
So again, it was before we just kind of let it go and we figured we'd get there eventually.
And unfortunately, the way the world is when it comes to cybersecurity and getting access
to the state, even though it's been unclassified, it's still controlled.
So they do have specific requirements about what you can do with it.
And therefore, here comes CMMC to make sure you're doing what you're saying you're doing.
For sure.
So we can get into the nitty-gritty if you'd like.
My quick question is, when I'm looking at some of the information provided for this
podcast, I'm seeing these maturity levels and these framework levels.
And when you go through this assessment, where you land, is that going to change the type
of business you're able to do, the type of contracts you have?
Are you able to reassess before that year?
What does a little bit of that process look like just out of my own curiosity?
Yes, to all of that.
One of the more difficult pieces of this as they were approaching 2.0 is there were not
assessors available and they had not been able to be trained on this nor certified.
We had two, myself included, that went through registered practitioner training for this.
And we have not recertified because this hasn't been ratified, if you will.
And we want to make sure we're recertifying to the actual standard, not to a GUI standard
that we can hope for.
But I think I alluded to it earlier.
Even once it's assessed, this is a requirement ongoing, not just a one time and then we'll
come back.
This could be one contractor can be required by one contract to be assessed or provide
that information that they've been certified.
But it could be that they have another assessment, if you will, by another entity, if you will.
And I won't say it.
It's not like an Army contract versus a Navy contract.
They can go back and forth and have, they are all the same requirements, but they can
go through and say, nope, we're not quite there.
It looks like it's been nine months since your last assessment.
We want to see your latest.
And Todd mentioned that the requirement for the self-assessments, that is across the board,
truly required whether you're any level.
But the two and the three on this are other people being available outside entities coming
to do that.
And that can be tricky when there's not a lot of people.
So to answer your question in a roundabout way, yes, you could have that follow on assessment,
but the availability might not be there.
Maybe you're scheduled and you're ready, but there's no one to do that.
So it really is trying to ensure that you're going first and right the first time.
So you wouldn't be required to do that.
It sounds like the assessors are reasonable and fair, I guess I would say.
But you don't, I would not want someone to have to come back and say, oh, are you sure?
Do you still need it?
Yeah.
The answer to the original question is the contracts are going to come and it is a requirement.
So it's part of the contract.
You either participate and you don't.
If you're not certified, you can't participate, you're done.
If you were not certified by February and there's contracts that happened in there, those are
the ones that you won't be able to.
But if you got certified by April, then sure you could participate.
There may be business cases as to why you would want to be fully ready to rock by February,
assuming, hey, there's going to be a limited pool of people that are even able to do this
work.
We want to be one of those and that might be worthy of their time.
But you can get assessed at any given time, of course, as Ann mentioned, assuming that
you've got availability of the assessor.
But again, I think the main thrust of it is you want to do it because it's going to be
a requirement of a lot of those contracts.
One of the things I think is really interesting when it looks at the assessment itself is there
is a requirement in that you get that signed off by a senior official of your organization.
And I mentioned that because the intent here is that you can't just say, go get that done,
Jim, go turn the buttons and push the knobs.
Sorry.
No, you have to be fully engaged.
So it is.
Todd signs our SOC report saying that everyone in our organization has met the requirements
and all the evidence that we've provided is true and accurate.
That's where that senior leadership endorsement and Todd's eyes are wide open to where we
are as an organization.
It's no different in the CMMC.
And this doesn't allow for a senior leadership team to be covering their eyes like, I had
no idea.
Wow.
What?
And we're very fortunate at CIT that our leadership is absolutely focused on things like this.
That's not always the case.
They're like, just get it done.
Just check it off and we'll just sign it.
I'm like, it really avoids that endorsement is critical and I like it.
But it's across the board for a lot of different frameworks, to be honest, not just CMMC.
Right.
Yeah.
And there was one other thing that I thought and hit on a moment ago before I started babbling
when she had kind of talked about this isn't a one time thing, right?
This is a continuous process.
So you don't start it.
You don't get a quick stamp and I'm done.
This is a continuous thing.
The intent is that you're always trying to get better.
Again, as I said, we are not under a heavy compliance, but as these kinds of things come,
we do start to become part of the supply chain.
So we need to follow along as well.
We naturally do because we're trying to do the right things.
It also helps us with what we do, giving this type of guidance in general.
But to me, staying on the path of compliance is a good natural thing for a business to
be doing regardless of whether a regulator is on you about it or not.
Understand that there's a cost associated with it.
So not everybody's on board with that.
But in my opinion, it's a big deal and being engaged does matter.
So we've kind of been talking this high overview and I always try to ask what the biggest challenges
or what the biggest hurdles you see, what are the things that are new for this CMMC
2.0 that are going to kind of stop people up or clog people as they are trying to get
this new certification, if that kind of makes sense?
Where are the hiccups for businesses that they're going to maybe have problems with
that are new or you've seen them lacking in the previous generation of this?
I think we hit it from a couple different angles and that's really like the, I see maybe
three right off the top of my head.
One is it's not just a, oh yeah, we do it.
It is you have to certify and then be ready with evidence that you can do this and continue
to do this.
That would be your self assessment, but then being prepared for having an assessment by
an external entity.
We're fortunate that we've gone through the process of, say, a SOC audit, but many people
have not ever had that requirement of having external auditors or assessors to come into
their organization.
ISO is a big deal and it's in a similar vein.
That might be one of the only manufacturing elements that they would kind of drop parallel,
but then that compliance as a voluntary kind of implementation.
That has a completely dovetailing that the voluntary commitment to getting to compliance
standards and maintaining them because it's the right thing to do.
Matt, unfortunately, he's right that there are always going to be the people that don't
do it till the very last second because it's stupid and I don't have time for this.
I don't want to put the budget towards it.
But in reality, most of any framework to very much importantly include CMMC are really trying
to guide people in the right direction of meeting standards that are really important
for you as an organization to maintain, in this case, your cyber hygiene.
From my perspective, I think the thing that's going to be the hardest for organizations,
there hasn't been a significant change on the security controls.
There's domains that you have, so you need to do things like do you have physical security,
that's door badge access, it's cameras on the buildings, there's security training.
A lot of those things really didn't change from one version to the other.
From my perspective, I think the hardest thing to kind of get your arms around is the maturity
of it.
I'll use this example of one of the things that you need to do under here is, and this
is just an example, this is one piece of the puzzle.
This is not like, hey, boom, we've got the answers, is the incident response.
Typically the way that CIT addresses this is we go, we build the incident response plan,
which includes a call tree.
Inevitably at every organization I have never been at, I have never started out where they
didn't have a single person that was the answer to every question.
When this happens, what do you call?
You call Joe.
Great.
What we typically do is we build the plan and then we build the tabletop exercise.
The tabletop exercise we start as a maturity level is we try to bring in leadership, and
this is the maturity I'm talking about.
Again, more often than not, you got a doer that's doing the work and senior management
is going, great, let me know when that's done and I'll sign off on it.
Well, in this situation, that doesn't work, right?
Because in the event something happens, senior management is going to want to know what happens.
We start the plan, we do the tabletop, and the vast majority of our tabletop exercises
to begin with are, do you know you're supposed to go grab the plan?
It's that basic, right?
Where's the plan?
Then phase two is, okay, Joe's not available.
Now what are you going to do?
They're like, well, wait a minute, Joe's always available.
He never goes on vacation, even when he does, he's got a cell phone.
I can always get a phone.
I'm like, great, he's out to see.
His phone's not working now.
What are you going to do?
He won the lottery.
He's out to see.
Right.
Whatever it is, right?
Now all of a sudden, this maturity kicks in and the leadership finally gets it.
So it isn't Joe, this is everybody.
And then we keep building for that.
So to me, that's the biggest hurdle to overcome is this isn't something you assign and delegate
off.
This is something that impacts your entire organization.
And it does take a while to kind of embrace that and go, no, this is who we are now.
And that is going to be by far, in my opinion, the biggest hurdle.
And I know that sounds probably a little cheesy and whatnot, but it's the only way that you
get this and you get it in place and it's repeatable.
And again, if this is your business, you're working with the Department of Defense, there's
a lot of money to be had out there, right?
Everybody knows what Lockheed Martin's making and whatnot.
It's significant.
So there's a good reason why a lot of businesses choose to work with the Department of Defense.
These are the kinds of things you're going to have to get your arms around and build
it into the culture of your organization.
And in my opinion, that's going to be the hardest thing to get in place.
Looking at these changes.
Is there anything that you are really, and maybe we answered it already, excited that's
new in it?
Or is there anything that you feel like is glaringly missing?
From my perspective, I don't think there's a lot that's glaringly missing.
They've got a lot of smart people that have contributed to this.
So it is a very robust process.
It's a great framework.
There's a lot there.
It excites me personally, and you're going to have to deal with the fact that I'm a security
nerd.
The fact that people are going to have to embrace it, right?
From my perspective, the easiest thing that actually gets the security culture in place
is the compliance.
And I know that that sounds like it's really designed to be a hammer.
And quite frankly, in a lot of cases it is.
To me, that is the biggest boom from something like this, is most organizations should be
doing a lot of stuff.
Just to give you a little context out there is the way that CIT builds our offerings is
we just include security.
Because if I said, hey, we think you should do this, more often than not, the response
is, let me think about that.
I'll get back to you.
But if we say it's just included and you get it, we'll set it up for you and we'll help
you through the process, then people are pretty, okay, that makes sense.
Well when that happens, those people that have been working for us, and I'm guessing
there's other people that are out there like this, they're already set on that first level
one, they're ready to rock.
They're okay, we've got ports in place, we could even get certified on that today if
we wanted to.
That's great, but this compliance does help get us to the next level, which again, it
can be a fight when people say I don't see the value in that.
And I can only make so many business propositions on how it does actually make sense before
I kind of go, okay, well, it's your decision, it's your risk, it's not mine.
It's like the addition into cyber insurance requirements for ADR, where we had been ahead
of the game putting that as part of our managed service offering.
And I don't want to make this all about CIT because these are about technology for business,
but to spot on, we are almost always ahead of the game in our compliance requirements
and can confidently say it's important to us, it's important for us to deliver this quality
of service to organizations.
And oh, by the way, this meets XYZ amount of your compliance requirements.
I mean, we're not, we're humble breaking, I don't know.
Wait, just a break.
Oh, you need to be able to have a show ADR.
Okay, you're so good at this.
I do think that's a part of it.
One of the things, it came up a little bit earlier and I was going to jump in and mention
that and I kind of forgot about it and I let it go.
But Anne was kind of talking about earlier in the podcast about how going through the
audit and being prepared for it is sometimes difficult to do.
When you've got all the things in place, it really isn't that hard.
And I know that's easy for me to say I've been doing this for a long time.
I got all kinds of gray hair on my chin.
But where I was going with this is really what it is is when you've got it in place.
It's a little nerving, unnerving to go through an audit or certification process, right?
You're basically somebody's judging you and that's a hard thing for most people to get
their arms around.
But when you're working with a partner that's going, yep, we've got that.
We've got these, we're checking the boxes.
It's more than checking the boxes because like I said, I want that leadership accountability
in there too.
But when we know we've got the things in place and we've got the proof, the certification
process is quite simple.
There is a roadmap.
There is a way to get there.
I try to avoid tuning our own horn on this podcast to keep it educational.
But the businesses that we work with, do they come to you and say, I'm doing this
CMMC thing and you hand them a folder and say, here's the pieces that we provide?
What does that conversation look like with businesses who are working with an outside
person?
So if you listened to any of our podcasts before, basically what ends up happening is
we do what I refer to as a gap analysis.
Where are you at today?
Because if I can't tell you where you're at, I can't tell you what the next steps are.
But yes, you can start to build.
Like I said, this process is completely mapped out.
It is very, very logical.
There is a way from zero to 100 and it is mapped.
So you can sit down and say, here's how we're going to do it.
You build the plan, you build the budget, and then you implement the plan.
As I mentioned, everybody's in a different spot.
Some people might be on antivirus.
Some people may have adopted EDR.
That's going to change how you approach things.
But that's typically how it goes as you start to work through what's in place today and
where are the gaps that we need to fill in?
Do I need to get additional buy-in from leadership?
So on and so forth.
But that's how it typically begins.
And yes, most people, I think one of the larger things that's hard, especially for those 50,000
small businesses is while it's written in English and it's clear to someone like myself
and Ann, it isn't to everybody.
And so they look at that and they go, I can read that, but I'll be darned if I have the
slightest idea what that says.
The words putting together things.
Right, exactly.
So that can be a big hurdle.
And so, yeah, there are lots of people out there that can help through that process and
translate that into plain, actionable English for organizations.
Again, not horn-tutting it either is one of the benefits of the CI team as a whole is
that we are translators.
But we may even have the products ahead of time.
We have the things that meet the requirements, but we also seek to educate.
We're not just going to drop something and say, hey, here, good luck to you.
Like, yeah, it's EDR.
And really, do you know what an EDR is?
Do you know what that is?
Okay, let's talk about it.
Do you know?
I understand you've asked us about CMMC.
Here's the requirements.
And let's see where that cross-references.
We can't certify you, but we can certainly get you where you need to be and where you
can start to understand where those requirements are.
Some people might not be as excited as I am to talk about those things.
But it's really important, even on a super high level, to say that it educates someone.
Tell me in easy terms, not the words putting together, terms that this is why EDR is important
to you.
This is why these products are important to you as an organization.
Yeah, one thing that, as Ann was talking, popped into my head, and I thought it related
pretty well, is if you are looking for someone to partner with, there's a couple of different
ways that the approaches typically go.
And so if you're starting to do this, just keep this in your head.
The three that I would say is, do it yourself.
So somebody can sell you a tool, you implement it, you get it done, or maybe you do it all
on your own, you do the research, et cetera.
Do it together.
So someone like CIT comes in and says, OK, we're going to work together on it.
I'll take this piece, you take that piece, you let us know when you need additional help.
And then there's do it for you.
So there'll be the all-in, everything's included approach where that organization may just take
it, run with it.
It's not as simple as they just do everything with something like this.
Because as I mentioned, the business does need the buy-in.
They do need to say yes.
They are the ones signing on the bottom line.
And so there's a lot of trust that would go into a decision like that for me where you're
going.
I really believe this person can do everything they said they can, and I'm just going to sign
off on it.
That would be a tough pill for me to swallow.
But there are those three approaches.
And just think about that if you're looking for a partner to help you through that, is
which one of those best suits you.
For sure.
Definitely.
It seems to be a topic we may come back to at the end of the year as it comes back top
of mind for people because it's getting a little bit closer for sure.
Thank you so much, Todd and Anne for joining us today.
If you liked this podcast, please sure to like and subscribe.
If you have a topic you'd like us to discuss or want to know more about CMMC and all the
things coming for that, reach out to us at info at cIT-net.com or head out to our podcast
cIT-net.com slash podcast and we'll be back next week with an all new episode.