Welcome to the Quick 10 Podcast brought to you by Quick Track, focusing on all things
FedCon and cyber defense from different perspectives and different personalities all in 10-ish
minutes.
Here's your host, Derek White.
All right.
Thank you for joining us again on the next episode of the Quick 10 Podcast.
Super, super, super excited for this one.
Can't wait to get rolling.
Today's guest is Allison Giddens, president of operations at Wintech Incorporated.
Allison, how are you?
I am good.
How are you?
I like your necklace there.
That's nice.
Here we go.
It's Wolves' back, Nas Reid, anybody who pays attention to sports in the NBA.
I'm a diehard Timberwolves fan.
We've got Western Conference Finals, Dallas office here at Berlin, and Quick Track, Minneapolis
office have a lot on the line for breaking, right?
So very jazzed up on this side.
How are you doing?
Everything good?
I'm good.
I'm not really that big of a basketball fan, but I watch my Braves like anybody else.
I'm not excited about some of the way that they're playing, but hey, I love my Braves
no matter what.
See that Braves, that's another...
I know.
I'm sorry.
Your Falcons and your Braves, man.
I'm sorry.
We got you on the Braves side, so it's okay.
We still don't talk about 1998 Vikings Falcons here.
Well, if it makes you feel any better, neither do we when it comes to the Patriots.
Well, you and everybody else, yeah, nobody wants to talk about the Patriots.
Boo.
Well, congratulations on all the quarterbacks.
So good luck to you.
Thank you.
We're starting a club.
Oh, it's so good.
All right.
Well, so today's episode is titled, CMMC from a Small Business Perspective.
So thank you again for joining.
You are one of the top voices in my opinion, in our opinion, when it comes down to the
small business side of things, the OSC, the organization seeking certification side of
things.
But I have two disclaimers I want to make.
One, we're going to go over in time today.
So the 10-ish minutes, we're probably going to go over because this is going to be a great
topic.
Two, are we, I'm asking you, Allison, are we at all affiliated at all financially, customer
relation?
Nothing.
No, no.
Outside of that, the check for $100,000 you gave me to do the podcast.
No, there's been.
That was just to help you guys pay for for.
But anyway, oh, oh, oh, oh, oh, oh, we, um.
Yeah.
So I do want to make the disclaimer, Allison and Wintek are not a customer or not a partner.
There's no affiliation.
We are peers and friends from the industry.
You know, kudos to you for being on a lot of the industry events, being very involved
in the community.
Again, I think that carries a ton of weight.
I've sent your stuff to prospects in relationships that have come up over the years because your
take on things related to CMMC are very valuable.
So thank you for doing that.
Appreciate that.
Yeah, you bet.
All right.
So let's get into it.
Let's talk a little bit about, you know, your side of it.
I'll just tee it up to you.
Go into a little bit of things before I ask you just a couple of questions that I want
to make sure we get in here.
You know, Wintek.
Yeah.
Allison Giddens, day in the life of you.
What's some of the stuff you want to share regarding the CMMC life that you've learned
and that you're living?
Oh, man.
So I was on a panel a few years ago and a question asked was, is cybersecurity the number
one risk on your day to day life?
And I went down the line and a bunch of the big primes, they were all like, yeah, yeah,
yeah.
Got to me and I was like, no.
And it was almost like the record stop that, you know, and so the day in the life of me,
I'll give you kind of a perspective.
Yesterday, yesterday was a heck of a day.
Right off the bat, walked in to find that we had a problem with a machine.
We were trying to get back online to run some parts.
Then a couple hours later, we found out that a very large shipping carrier had misplaced
an order for us that was, oh, I don't know, eighty thousand dollars worth of parts.
And it was MIA.
And then a couple hours after that, we got notified that one of our machinists was leaving
the company to go be closer to family.
And we kind of had to in a pinch figure out what we were going to do about that.
Meanwhile, we're preparing for an audit.
And then I got word that there was some material that we were expecting to hit our dock today
to make some parts.
And it's not going to be here until June.
So you have all these other things that are happening while I'm managing CMMC at Wintec.
So yeah, that's just a couple of things going on.
That was the morning.
There's no other business out there that has people wearing multiple hats as the president
of operations.
So it's good.
You have, that sounds like three hours of work a week.
That's not bad.
Due to my sleep.
Yeah, right.
Oh, well, that's I mean, that's it, right?
That is that is part of the we'll call it bottleneck frustration is going button.
Cybersecurity is a big deal.
And now you can look at the news today in late May of just the last couple of days of
some pretty serious stuff that's going on.
That's in no relation to CMMC for the most part, right?
It's scary stuff.
So small, okay.
So to peel it back a little bit, small, small business, medium enterprise, you know, you
name it, everyone's got challenges when it comes to cybersecurity requirements until
it becomes second nature.
There's always going to be challenges on the outcomes because you can't touch and feel
most of it.
You just have to to know versus believe is kind of our thing here.
So from a biggest frustration side of of your day to day, you can go back a year or two
years just in general.
You know, this isn't a complaint fest or anything like that.
But what is your biggest frustration that you'd like to see become less frustrating
if you were able to rub the genie lamp and have things happen?
I think one of the biggest frustrations in my world is managing up.
So and I can only imagine what it's like in a small business where you're not the one
who ultimately has authority over things.
But when we get things from when we get orders from customers that are big primes or when
we get communication from our government friends and partners, when there's no consistency,
whether that's marking of data, whether that's communication of flow down, everything in
between, it's really hard for us to continue to follow the rules when we don't really know
what they are or when we're being kind of told to do things that in writing, it's not
what it says or it's the opposite, you know, where we'll get things, we'll get overkill,
we'll get a joke that I have a 41 page purchase order for an $800 bracket.
It's like, come on, guys, come on.
You know, it's one of those if everything is a priority, then nothing is a priority.
So I think my frustration, my biggest frustration is, you know, I'm a manufacturer, you tell
me what it is that you need and I will do it.
Yeah.
Okay, then let me ask you a follow up question to that because this comes up a lot.
So now granted, disclaimer here is that you're one of the nicest people on the planet and
also very knowledgeable in this space.
So a little bit easier maybe for you.
So what are some strategies that and advice you can give on how to communicate upstream?
That's a good question.
You know, like, you know, it's never perfect, you don't just get to walk into an office,
right?
So what are some ways that you've seen success on getting some of the answers that you need
to at least at the very least, give you something to stand on as you make very impactful decisions
around getting these requirements in place?
Well, I think it goes without saying, you always want things in writing, right?
But sometimes I really think it matters the relationship between the parties.
So how I personally work with a buyer at a prime is going to be slightly different than
it would say somebody directly at DLA or DOD.
You know, there might there's a time and a place to pick up the phone, have a conversation.
You leave less to email tone when you do that.
And you can follow it up with an email to get things in writing.
So it's you can say and do things to allow the other party to save face.
So just like I am not by any stretch of the imagination, a technical, you know, genius
with CMMC, there's there's no way I can pick up the phone and call my my buyer at a prime
and say, hey, you flow down the bars 252.204 dash 7012.
But I'm looking at the data that you sent and I don't see anything marked.
Will you help me?
You know, did I miss this?
Because it's a little bit unfamiliar to me.
And now, you know, you're letting them kind of be the bigger person and say something
like, oh, it was flowed to us.
And so I just copy pasted my bad.
Let me take that out.
Or you know, oh, gosh, yeah, you're right.
It doesn't have marking on it.
Let me go talk to my government customer.
And you know, you're allowing that other person to have those kinds of, you know, you're
not putting them on defense.
You're not telling them they're they don't know their job because they probably very
much know their job.
It's just just like us.
We're being we're being told, you know, you've got to be experts about everything.
So I think that's that's a key in that how to handle those kinds of circumstances and
then follow it up with the email, you know, get everything in writing.
So hey, thanks again for talking to me.
You know, look out for that purchase order update.
So that's that's that's that's good.
That's that's what one of the biggest things that we share, too, is, you know, if you're
going to get stuck in this situation in the future, the and you can't get the answer,
get it in writing.
And if they don't do diligence means a lot.
Obviously, if this was a risk based only approach, that would be great in some cases.
But you know, you're a business, you've got deliverables, you've got, you know, they don't
expect you to go out of business, right, by trying to figure stuff out.
So that's great advice.
Pretty much echo that on our side as well, too.
Another question that I'm excited to hear your answer on is, you know, it's it's the
middle of twenty twenty four.
If you could hop in the telephone booth time machine with Bill and Ted and go on an excellent
adventure.
Not a bogus journey.
Let's go.
Excellent adventure and go back five years from today.
What would you tell yourself and other small businesses, manufacturers that you know today?
What would you tell them five years ago that you think would help on the impact side for
today?
Five years ago.
So five years ago would be what?
May of twenty nineteen or twenty twenty.
I mean, stuff.
OK, first off, stock up on Lysol wipes and masks.
No, if I could tell them all over again.
Right.
So we actually went to we were not in we weren't in a terrible place then.
But I think that if I knew what was coming, I probably would have maybe upgraded or change
our infrastructure a little bit sooner than we did.
I think I was gun shy to do certain things along the way, thinking it was going to rock
the boat much quicker than or much more much more significantly than it did.
I think it's a business owner.
You know, we we're kind of gun shy at times to make big changes because if it's not broken,
where are we fixing it?
And so the moment that somebody says, well, you need to do this because it's going to
improve your security.
You know, what we're thinking is, oh, my gosh, that means that now so and so is it's going
to look different.
The interface and their creature habit and they're going to be ticked off.
And I don't want to tick off my employees.
I want to make this easy for them.
I think that if it's important finding a partner, whether it's an MSP or consultant or somebody
internally, it's important to find somebody you trust who understands the business processes.
And I think if we could do it all over, maybe I just would have done certain things to improve
our stance a little bit sooner.
I would have maybe expedited some things.
But I think it's important that people realize that you just want to be better than you were
yesterday.
So it's OK for the baby steps.
That's OK.
Well, I'm going to assume that's because that's a that's a terrific answer and that you because
you know what you know and you've put the time in, you know, you assume you don't just
go out to the market and say, I'm going to talk to the cheapest person out there because
that doesn't usually end up in a great spot.
But you know, how does how does it feel personally when when you're you're you're heading up
the CMMC stuff by knowing that stuff, knowing that you've put the time and effort and do
you mean, do you feel like you sleep better now than you would if you would have waited
until like a year ago to start working on this stuff?
Would that would that freak you out at night?
Oh, yeah, I think I mean, looking around at people that are kind of waking up and now
all of a sudden starting, it like makes me itch.
You know, it's like, oh, gosh.
And to some people, it's kind of and I am not.
I mean, I know you called me a nice person, but I don't really think I mean, yes, my husband
and he'll probably disagree with you.
But there there are some things that like I'll look around at some of these smaller
businesses that are maybe 20 percent defense industrial based.
And so they're just now waking up saying, you know, maybe I should start doing these
things.
And I'm just like, what are you do?
Like, if this was not a significant part of your business, why are you already all of
a sudden?
Now pulling the trigger on things.
And I don't know, I you don't know what you don't know.
And you know, I take for granted that that as co-owner of Wintec, I have a business partner
that handles the manufacturing and sales perspective.
So if it were just me, I don't know if I'd be this involved.
I don't know that I'd have the time to be this involved.
It's all about resource constraints.
So yeah, I don't know.
I definitely itch when I see that there are people just now kind of getting with the program.
Yeah.
Well, that that, you know, Twilight Zone time machine or whatever you want to call it, you
go back in time.
You know, there was efforts to be made to have resources to help individuals like you
and companies like yours to to try to do the right thing.
And I think that came with the expertise just wasn't there on it's not just a gap assessment.
It's not just a it's not just a build a poem and have a system security plan in place and
get to it when you have time.
Of course, that was accepted.
Unfortunately, we all know that story.
And that's why CMMC exists.
But at the same time, you know, I think you hit on one of the biggest things, too, is
you do have to kind of peel it back to the atoms, right?
You really have to go back, go back to what you can control, know what you know.
You know who works there.
You know what they access, you know, where data flows.
Understanding that is huge.
That's that's always a big thing.
So I think that's one of the big takeaways is every time you see a breach in the news,
right?
Everything large, small doesn't matter.
Every single time.
They always seem to struggle with.
Well, gosh, I didn't realize that those people had access to that.
I didn't realize that the credentials are being shared.
And you know, you you look at that.
Of course, it's easy to say that after it happens.
But you know, I go back to you should start with least privilege access.
And Allison should have access to things that probably 95 percent of your company shouldn't
have access to if not more.
So that makes just such a firmer foundation.
So I like that.
Where you're coming from with that is is having a better foundation on your.
Gosh, that sounds so cliche about having a better foundation on your cybersecurity and
how your data is handled, whether it's related to CMMC or just your your what matters to
you most intellectual property.
Well, it's hard because, you know, if you're a if you're a small business and this is the
way you've always done it to some small businesses, you're what I'm hearing is, OK, you need to
change the way you're doing everything.
And that's not what you're saying.
But that's what's being heard.
You know, is, oh, wait, you want to take access away?
Well, then that means that in my head, all the stuff in that folder on the server, on
the file server that's on Pram now, you know, now four out of five of my office people shouldn't
have it.
Yeah.
But what if I'm out of town and I need them to send banking instructions to it's probably
a bad example because of all the fishing spearfishing.
But you know, what if I'm out of town and I need them to send, you know, the such and
such to to my customer?
We fall into this trap of, well, everybody wears a lot of hats, so everybody needs access.
And that very well might be true in some circumstances.
But if it is, document it, write it down, explain why.
Yep.
Go through risk.
You know, what happens if to this company, if, you know, I just say Christmas bonuses.
That's like one of my things I always go to is you have obligations.
We're not talking about trying to build Fort Knox.
You know, this is but multifactor authentication.
You know, it's it sounds scary.
You know, I say it at Christmas time and my parents and my family go, you know, and I've
just it's not, you know, give them a little presentation and we get it.
We got it set up.
And now they're accustomed to it.
It takes a half second.
Most of the time.
But yes, it's not that simple.
If just say, well, that solves everything.
But you know, that's what they're asking.
Right.
They're asking to lower the risk of things that you should be doing before you start
putting on the stuff that is more advanced so that if you have to be against more advanced
from there, you can build it up versus, you know, bolting stuff on and just throwing stuff
at the wall.
So well, this was awesome.
I know we are over in time and that's OK because we can.
And that's the beauty of not having anything scripted.
But again, thank you, Allison, for joining.
I will say if you liked what you heard or you've seen, if you're watching this on YouTube,
go on LinkedIn, follow Allison.
Her perspectives are great.
She just put out a piece the other day, which I thought was great from your perspective
of manufacturer.
And you know, as time goes on, things are going to change.
Perspectives are going to change.
Opinions are going to change.
Attitudes are going to change.
You know, businesses should be ready for that.
So thank you again.
And we'll have you on again in the future for sure.
And for those that are listening on their favorite podcast platform, make sure you subscribe
or follow.
YouTube, same thing.
So you don't miss out on future episodes as we start to ramp some of these up.
It'll be interesting to have Allison on again and see how your perspective maybe has changed
based on other dominoes falling the way that they will.
So yes.
All right.
Well, thanks again.
Take care and we'll see you next time.
Go Timberwolves.
Yeah, Wolves back.
Thank you for listening to this episode and make sure to subscribe to the Quick 10 Podcast
wherever you get your podcasts and check us out on YouTube as well.
For more information about Quick Track, visit our website at www.quicktrack.com.
And we'll see you next time.