What 997 Responses Say about CMMC's Future

00:00:01 [Speaker 1]
Welcome, everybody.
00:00:02 [Speaker 1]
Happy Monday.
00:00:03 [Speaker 1]
First one here in November, and, we've got a lively one.
00:00:08 [Speaker 1]
And as always, we're gonna just do a touch of banter before we get into the actual session.
00:00:14 [Speaker 1]
Let people come on in and join us.

00:00:17 [Speaker 1]
Also, hopefully, Jacob Horn will make his way in here.
00:00:22 [Speaker 1]
He had a a power outage situation.
00:00:25 [Speaker 1]
So, hopefully, you know, he'll...
00:00:28 [Speaker 1]
Like I said, he'll make his way.
00:00:30 [Speaker 1]
So, in the interim, I just gonna share my screen.

00:00:34 [Speaker 1]
This is something that I thought was worth talking about, but also somewhat tangential to what we're gonna be talking about today.
00:00:43 [Speaker 1]
And that is what happened late last week, which is this small, attack on finance, to the tune of 6,300,000,000.
00:00:58 [Speaker 1]
I was reading this morning, in fact, and I'm sure most of you have read or heard about this.
00:01:04 [Speaker 1]
But, boy, you know, one of the things we talk about all the time, you know, I'll I'll I'll just frame this to maybe Scott Edwards.
00:01:12 [Speaker 1]
Scott, you know, is is is an MSP, you know, we're always trying to have the customer understand potential, implications, right, of risk in their business and what it means to the business not, you know, get the technical jargon out.

00:01:29 [Speaker 1]
Just to give you a sense of the magnitude, they've had, north of 3,000,000,000 in withdrawals post this compromise.
00:01:40 [Speaker 1]
And the other thing I thought was, again, kind of using this as a a segue into today's conversation is it it turns out it's...
00:01:50 [Speaker 1]
It appears to be, you know, they're saying, a North Korean threat actor.
00:01:54 [Speaker 1]
And what we're gonna be talking about today is, you know, protecting, you know, our nation's intellectual property for the Department of War and, you know, obviously, the the program of CMMC and protecting, obviously, very critical information, from threat actors.
00:02:12 [Speaker 1]
And here we have, you know, just an example of, you know, seemingly something where a DevOps person, you know, did something to let a threat actor in and, oh, by the way, $6,300,000,000 later.

00:02:28 [Speaker 1]
But but your take on this is as it maybe relates tangentially.

00:02:32 [Speaker 2]
Well, I mean, 6,300,000,000 will certainly send up the average, the average cost of an incident, I think.
00:02:39 [Speaker 2]
So so I think that we're gonna see that number pop a little bit.
00:02:42 [Speaker 2]
But it...
00:02:42 [Speaker 2]
You know, it's it's this kind of thing.
00:02:44 [Speaker 2]
We've seen, you know, numerous reports just in the last just in the last few weeks.

00:02:48 [Speaker 2]
Lumen report just came out that identified, you know, who were the top targeted, you know, entities or types of organizations with the US government being number one, you know, the DIB being number two.
00:02:59 [Speaker 2]
You've got, universities involved in research, number three, and MSPs being number four.
00:03:05 [Speaker 2]
Right?
00:03:05 [Speaker 2]
Mhmm.
00:03:06 [Speaker 2]
Then you've got the things that happen in France with the, with the the refrigerators getting turned up to a 120 degrees.

00:03:12 [Speaker 2]
The same exact attack just happened in Belgium.
00:03:15 [Speaker 2]
I believe I just read an article this weekend that a very similar attack happened in a US military facility as well, where they spoiled food in a defect, you know, a a dining facility.
00:03:27 [Speaker 2]
And so, you know, we're seeing these types of attacks across the board, you know.
00:03:31 [Speaker 2]
You know, may...
00:03:32 [Speaker 2]
If it's crypto or if it's OT type environments or if it's, you know, IT environments.

00:03:37 [Speaker 2]
It's just all across the board.
00:03:39 [Speaker 2]
The the threat is not going away.
00:03:42 [Speaker 2]
The threat is literally just getting sped up.
00:03:44 [Speaker 2]
And, you know, another one, Chris Hughes, you know, friend, I believe...
00:03:47 [Speaker 2]
Andrew, I believe you know Chris Hughes.

00:03:49 [Speaker 2]
He had a great post, this last week on LinkedIn talking talking about, you know, some people have called it the volepocalypse or what have you.
00:03:56 [Speaker 2]
But, you know, 4% of all vulnerabilities ever identified in the history of the c v m...
00:04:02 [Speaker 2]
CVE program were identified in the last thirty days.
00:04:05 [Speaker 2]
Right?
00:04:05 [Speaker 2]
18,600 vulnerabilities identified in the last thirty days.

00:04:09 [Speaker 2]
I mean, it's just...
00:04:10 [Speaker 2]
It...
00:04:11 [Speaker 2]
It's just ballooning.
00:04:12 [Speaker 2]
It's really, really crazy how much all of this is hitting at one time.

00:04:16 [Speaker 1]
Yeah.
00:04:16 [Speaker 1]
For sure.
00:04:17 [Speaker 1]
Jason, your your take on this, and I'm sure it's not busy in DC, you know, only a few days away from the primaries.
00:04:22 [Speaker 1]
Right?
00:04:23 [Speaker 1]
Any...

00:04:23 [Speaker 1]
Anything going on, in your neck of the woods?

00:04:28 [Speaker 3]
The thing that that is standing out to me and and, you know, I'll just be perfectly frank.
00:04:32 [Speaker 3]
We don't cover a kind of Bitcoin.
00:04:34 [Speaker 3]
We don't cover these these time of hacks.
00:04:37 [Speaker 3]
But the amount of discussion that's happening around the threat of AI fueled attacks and the realization from federal executives, and you see this with CISA.
00:04:47 [Speaker 3]
You saw this with the PHP concern.

00:04:50 [Speaker 3]
Again, this may not have been a AI fueled attack, but AI found the attack.
00:04:55 [Speaker 3]
AI kinda drove CISA to be like, stop what you're doing everyone and and and start fixing this.
00:05:01 [Speaker 3]
I think it's just a a harbinger of things to come, and I think that is really driving a lot of where we're hearing a lot of chief information security officers and information security officers really say we we need to do better.
00:05:15 [Speaker 3]
We need to really think about it differently.
00:05:18 [Speaker 3]
And I think one of the challenges that we hear from is they just don't know what they have to protect.

00:05:23 [Speaker 3]
And, you know, everything starts with the inventory.
00:05:25 [Speaker 3]
And I'll just tag back real quick and not to take us off topic, but post quantum cryptography, there's a big plans due.
00:05:33 [Speaker 3]
Everyone's that's the next thing we're all gonna start talking about is PQC and...
00:05:37 [Speaker 3]
Well, phase one is what what do you have?
00:05:40 [Speaker 3]
And I think we're still in that phase when it comes to basic cybersecurity.

00:05:45 [Speaker 3]
We're still in that phase when it comes to basic, let's move to the cloud.
00:05:49 [Speaker 3]
What do we have that can move to the cloud?
00:05:51 [Speaker 3]
So I think agencies are still struggling with that issue of of what do we have, that inventory piece.
00:05:55 [Speaker 3]
So I think that's where...
00:05:56 [Speaker 3]
That's driving a lot of the discussions that we see, agencies and and folks like Summit seven and and other companies are having with with their customers.

00:06:05 [Speaker 2]
Yeah.
00:06:06 [Speaker 2]
You know?
00:06:06 [Speaker 2]
And it's not just agencies.
00:06:08 [Speaker 2]
I mean, you know, the dev industry is really, really struggling with this as well.
00:06:11 [Speaker 2]
I mean, especially when you start talking about things like OT.

00:06:14 [Speaker 2]
You know, OT is not part of the requirement set that that we've all been solving for for the last decade in the defense industrial base for the most part.
00:06:21 [Speaker 2]
Right?
00:06:22 [Speaker 2]
But you talked about not knowing what you have.
00:06:26 [Speaker 2]
The numbers of millions of, you know, OT devices that are sitting out on networks that have been completely forgotten about and, you know, they have been sitting there running quietly, and they've been there for fifteen years, and nobody knows physically where it is.
00:06:40 [Speaker 2]
Most people don't even know what it's doing anymore.

00:06:42 [Speaker 2]
It's just sitting there doing whatever it does.
00:06:45 [Speaker 2]
And then, you know, vulnerability pops up, and now we have, you know, exposed critical infrastructure sys...
00:06:51 [Speaker 2]
Systems.
00:06:51 [Speaker 2]
And, you know, we're seeing more and more of that, and and it's a huge, you know, it's a huge problem.

00:06:58 [Speaker 4]
Yeah.
00:06:58 [Speaker 4]
Interesting.
00:06:58 [Speaker 4]
Scott Edwards, none of these OT technologies are running on Windows NT, though.
00:07:03 [Speaker 4]
Correct?

00:07:04 [Speaker 2]
Well, so I was, I mean, I was talking to, Giddens, from WinTech, you know, at at at the at the conference this last week.
00:07:13 [Speaker 2]
You know, she has a a water jet.
00:07:16 [Speaker 2]
Right?
00:07:16 [Speaker 2]
I think you you may need to know what I'm gonna talk about, Brian.
00:07:19 [Speaker 2]
But she has a water jet that runs on Windows XP.

00:07:21 [Speaker 2]
Right?
00:07:22 [Speaker 2]
And she...
00:07:23 [Speaker 2]
It's a $250,000 piece of equipment.
00:07:25 [Speaker 2]
And because she had to Frankenstein build out a replacement piece of hardware to run Windows XP because there was no other way to get this, you know, system up and running unless she wants to go buy a new $250,000 piece of equipment.
00:07:39 [Speaker 2]
It's it's insane.

00:07:40 [Speaker 1]
Yeah.
00:07:40 [Speaker 1]
Interesting.
00:07:41 [Speaker 1]
Just one question to maybe you, Ryan.
00:07:44 [Speaker 1]
Jason brought up a good plan...
00:07:46 [Speaker 1]
A good point.

00:07:46 [Speaker 1]
Right?
00:07:47 [Speaker 1]
It's always the saying of, you know, you can't protect what you don't know you have.
00:07:50 [Speaker 1]
Right?
00:07:50 [Speaker 1]
That's, you know, kind of a famous saying.
00:07:53 [Speaker 1]
I do wonder, though, if I could just take the flip side to this, how relevant some of the, early controls are in frameworks.

00:08:04 [Speaker 1]
And what I mean by that is so much, at least in our world, right, small to medium business has moved to SaaS, like Jason pointed.
00:08:13 [Speaker 1]
Right?
00:08:13 [Speaker 1]
What's in the cloud?
00:08:14 [Speaker 1]
But we don't have an inventory control yet.
00:08:18 [Speaker 1]
Really, it talks about, you know, hardware, software.

00:08:20 [Speaker 1]
It doesn't talk about, well, what about your SaaS inventory?
00:08:23 [Speaker 1]
Right?
00:08:23 [Speaker 1]
And how are you collecting that?
00:08:24 [Speaker 1]
Are you talking to accounts payable?
00:08:27 [Speaker 1]
Right?

00:08:27 [Speaker 1]
How are you measuring shadow...
00:08:29 [Speaker 1]
You know, what goes up in shadow, right, IT.
00:08:34 [Speaker 1]
Can you talk, like, are are we...
00:08:36 [Speaker 1]
Are are the controls falling behind a little bit even in the times aside from what Scott Edwards just said, like an XP machine?
00:08:44 [Speaker 1]
I'm just curious your thoughts.

00:08:48 [Speaker 5]
Well, I I think that the the way that the requirements are certainly laid out right now don't provide a lot of clarity on, hey.
00:08:56 [Speaker 5]
When I say know what assets you have, I mean, understand them at this level of specificity.
00:09:03 [Speaker 5]
Right?
00:09:03 [Speaker 5]
I mean, if if you were to look at, like, some of the rules that agencies have to abide by, like, their binding operational directives, they have to scan their entire IP space at least every fourteen days, and they need to know very specific things about their assets.
00:09:18 [Speaker 5]
Otherwise, they wouldn't know that they have a latent vulnerability that they're exposed to.

00:09:23 [Speaker 5]
So understanding, what you have, like, not just at a hardware software level, but seeing those interconnections and saying, like, hey.
00:09:33 [Speaker 5]
Yeah.
00:09:34 [Speaker 5]
I I am connected to way more SaaS platforms than I realized.
00:09:38 [Speaker 5]
We have data going out and coming in at a prodigious rate that we didn't understand.
00:09:43 [Speaker 5]
There's definitely a gap and a miss.

00:09:45 [Speaker 5]
You know?
00:09:47 [Speaker 5]
You see it in the contract clauses themselves.
00:09:49 [Speaker 5]
You need to be aware of cloud, but it would be, I think, a lot better if you had an application level understanding of how the data moves and where it lives and then back into the infrastructure, the hardware, and things like that for...
00:10:03 [Speaker 5]
From there.
00:10:04 [Speaker 5]
So I I think that there's definitely, blind spots for a lot of organizations, and it it cuts both ways.

00:10:11 [Speaker 5]
Right?
00:10:11 [Speaker 5]
For every organization who's got a good handle on their on prem and is blind to what they've got in the cloud, you've got other organizations who, have very good telemetry and insights into their cloud first deployments and can't tell you thing one about what's happening on prem.
00:10:27 [Speaker 5]
Yeah.
00:10:27 [Speaker 5]
So it's almost like your...
00:10:29 [Speaker 5]
People tend to just sort of, like, build out capabilities or skill sets in one area and not the other.

00:10:34 [Speaker 1]
Yeah.
00:10:35 [Speaker 1]
Scott, maybe your...
00:10:36 [Speaker 1]
One take from you, I I might have cut you off there, but I was gonna ask because I got the pleasure to watch you do a mock assessment.
00:10:42 [Speaker 1]
It was really cool.
00:10:44 [Speaker 1]
But, let's...

00:10:45 [Speaker 1]
Like, the other thing that comes to mind is a lot of these talk about active directory.
00:10:49 [Speaker 1]
Right?
00:10:49 [Speaker 1]
Frameworks around that.
00:10:51 [Speaker 1]
But, again, in our world, when I say r, most MSPs are dealing with ENTRE these days.
00:10:56 [Speaker 1]
And, like, again, that's why I wonder, like, how are you seeing these kind of fall behind?

00:11:01 [Speaker 1]
And if so, like, how are you dealing with that in some of these assessments?

00:11:06 [Speaker 4]
Yeah.
00:11:07 [Speaker 4]
So the question's coming to me.
00:11:10 [Speaker 4]
I always take, like, this finance attack, and I, like, take it apart.
00:11:14 [Speaker 4]
Okay?
00:11:15 [Speaker 4]
What framework or control could have prevented this?

00:11:19 [Speaker 4]
Right?
00:11:20 [Speaker 4]
You know, why would they allow that much money to leave the building that fast, you know, without anything throttling that.
00:11:29 [Speaker 4]
Right?
00:11:30 [Speaker 4]
Just basic kind of a thing.
00:11:32 [Speaker 4]
Right?

00:11:32 [Speaker 4]
The other thing is what happened to least privilege?
00:11:35 [Speaker 4]
Right?
00:11:36 [Speaker 4]
Why would it gov dev...
00:11:38 [Speaker 4]
Why would it...

00:11:38 [Speaker 1]
I mean, dev ops side

00:11:40 [Speaker 4]
be able to access the, you you know, the Binance secret sauce to allow these transactions to happen?
00:11:49 [Speaker 4]
I mean, that shouldn't have happened.
00:11:51 [Speaker 4]
So that's...
00:11:52 [Speaker 4]
So I would look at things like, you know...
00:11:54 [Speaker 4]
And it fits in.

00:11:55 [Speaker 4]
I mean, it's the basics.
00:11:56 [Speaker 4]
And we talk about brilliant at the basics, but this is a basic least privilege.
00:12:01 [Speaker 4]
Right?

00:12:01 [Speaker 1]
Yeah.

00:12:02 [Speaker 4]
That needs to be in place that says, hey.
00:12:05 [Speaker 4]
If somebody got into this guy's endpoint, why could he actually execute these transactions?
00:12:12 [Speaker 4]
And if the controls are properly put in place, then this shouldn't have happened as it did.

00:12:19 [Speaker 1]
Yeah.
00:12:19 [Speaker 1]
I

00:12:19 [Speaker 2]
mean, you know, think about how, terrifying may be a strong word, but maybe not, that we have Frontier AI models in Shadow AI being run on networks that potentially with the lack of the least privilege have access to networks that are running Windows XP, you know, water jets and other, you know, other things that came out, you know, OT environments that came out in the nineties and early two thousands.
00:12:46 [Speaker 2]
You know, there was...
00:12:48 [Speaker 2]
Nobody ever thought that these kinds of things would be running side by side on the same networks.
00:12:53 [Speaker 2]
Right?
00:12:53 [Speaker 2]
And so there was no thought from a design architecture standpoint to protect, you know you know, for it.

00:12:59 [Speaker 2]
I mean, if...
00:13:00 [Speaker 2]
Even if you go all the way back to, you know, ARPANET, you know, TCPIP was never developed with security in mind.
00:13:07 [Speaker 2]
Right?
00:13:07 [Speaker 2]
So we're building on a house of cards for the last fifty, sixty years.
00:13:11 [Speaker 2]
And it just continues to compound as we add more and more capability to our environments.

00:13:16 [Speaker 2]
We haven't secured the baseline, yet we're adding more and more, you know, highly capable technical platforms that can really, really run roughshod over the security that's been put in place for the last twenty years.

00:13:28 [Speaker 1]
Got it.
00:13:29 [Speaker 1]
Alright.
00:13:29 [Speaker 1]
Well, let's do...
00:13:31 [Speaker 1]
Oh, go, Jace.

00:13:31 [Speaker 3]
I just was gonna say the most common thing I hear from fed...
00:13:34 [Speaker 3]
Federal executives is OT was never thought to have to connect to the Internet, and then all of a sudden, now we're connecting it to the Internet.
00:13:41 [Speaker 3]
And we're not sure how to secure it because it's not built to to Scott's point.
00:13:45 [Speaker 3]
It was never thought initially that we have to...
00:13:47 [Speaker 3]
Because this will be air gapped.

00:13:48 [Speaker 3]
It's gonna be behind the firewall.
00:13:50 [Speaker 3]
It's never gonna be exposed to the public Internet.
00:13:52 [Speaker 3]
So just

00:13:53 [Speaker 2]
Well, not not only that.
00:13:54 [Speaker 2]
I mean, from an Internet standpoint, you have so many of these devices, you know, these OT type devices that have cellular modem sitting in them connecting to a a Verizon network and completely backdooring an entire OT system.
00:14:06 [Speaker 2]
Right?
00:14:07 [Speaker 2]
So you can't even control for that, you know, because most...
00:14:09 [Speaker 2]
You know, there's many times that these things are put in place, and the the companies that are paying for the equipment don't even know that it's connecting on the backside so that, you know, the manufacturer can get in to make updates or what have you.

00:14:21 [Speaker 2]
So, anyway, it's it's a whole...
00:14:22 [Speaker 2]
That's a whole different show, Andrew.

00:14:24 [Speaker 1]
Yeah.
00:14:24 [Speaker 1]
We'll do it.
00:14:28 [Speaker 1]
Alright.
00:14:28 [Speaker 1]
Well, hey.
00:14:29 [Speaker 1]
Let's do some quick intros because I've got a very cool science, session today where our normal cohosts aren't here, but we got great cohosts.

00:14:39 [Speaker 1]
But let let...
00:14:40 [Speaker 1]
Let's start off with our our guest.
00:14:42 [Speaker 1]
Jason, welcome to the cyber call.
00:14:44 [Speaker 1]
Tell us a little about yourself, what you do over there at the Federal News Network, and thanks so much for showing up.

00:14:49 [Speaker 3]
Yeah.
00:14:49 [Speaker 3]
Appreciate being invited.
00:14:52 [Speaker 3]
I am Jason Miller, executive editor of Federal News Network.
00:14:55 [Speaker 3]
We've been around as as Federal News Network for, twenty six, almost twenty seven years now.
00:15:00 [Speaker 3]
What I like to say is we cover the three p's of Washington, programs, policy, and people.

00:15:04 [Speaker 3]
We don't cover politics.
00:15:06 [Speaker 3]
Every story, every interview we do tries to answer two very simple questions.
00:15:10 [Speaker 3]
Why do you care as a federal employee or contractor, and or how does this help you do your job better?
00:15:15 [Speaker 3]
So we really are a niche publication that happens to also be a radio station, but we are a news organization first that happens just to do broadcast.
00:15:24 [Speaker 3]
Personally, I've been covering federal government for a better part of twenty five years, covering, small business contracting first, and then falling into technology side.

00:15:33 [Speaker 3]
I cover a lot of acquisition, a lot of technology, and I've been following CMMC since, the defense department kicked off for 2016, 2017 time frame, started talking about it.
00:15:43 [Speaker 3]
And, I think you are asking me here to...
00:15:46 [Speaker 3]
Because my most recent investigative report looking at CMMC.
00:15:49 [Speaker 3]
So, I really appreciate it, and I'm excited to talk about it.

00:15:52 [Speaker 1]
Well, if you...
00:15:52 [Speaker 1]
Your work was awesome, I'm gonna make sure everybody...
00:15:55 [Speaker 1]
Once we get rolling here, I'll put the links to the two part story.
00:15:59 [Speaker 1]
Scott Scott Edwards, let me let you kick it off as a cohost, What about yourself, your company, then we'll move to Scott Singer, Brian Bonner, and hopefully, Jacob will show up.

00:16:07 [Speaker 2]
Sure.
00:16:07 [Speaker 2]
Real quick.
00:16:08 [Speaker 2]
Scott Edwards, CEO at Summit seven.
00:16:10 [Speaker 2]
We're an MSP, MSSP in the defense industrial base and federal contractor space.
00:16:14 [Speaker 2]
We've been in this market specifically for about the last ten years.

00:16:18 [Speaker 2]
This is, you know...
00:16:19 [Speaker 2]
971 and CMMC is pretty much all we've done for the last decade.
00:16:23 [Speaker 2]
So...

00:16:23 [Speaker 1]
Thanks for joining.
00:16:24 [Speaker 1]
Scott Singer.

00:16:26 [Speaker 4]
Retired thirty year naval officer, president, control case federal.
00:16:30 [Speaker 4]
We're a FedRAMP third party assessment organization and the CMMC third party assessor organization.
00:16:38 [Speaker 4]
Luckily, I'm luckily, I'm I'm happy that I'm still able to, continue to support our warfighters in this role.
00:16:47 [Speaker 4]
One thing I thought I'd quickly share is that back in 2021, I did, testify before Congress on this subject.
00:16:57 [Speaker 4]
And back then, it was...

00:16:59 [Speaker 4]
It's a very similar thing as we're hearing now is that tough for small businesses to comply.
00:17:05 [Speaker 4]
We gotta find some risk based approaches.
00:17:08 [Speaker 4]
And how do we allow them, you know, get them some money that's outside the allowable cost model to, you know, help them get compliant.
00:17:17 [Speaker 4]
And I'll talk a little bit later if I get a chance.
00:17:20 [Speaker 4]
There's a senate version of the 2027 National Defense Authorization Act that takes a shot at that, which I think is great.

00:17:27 [Speaker 1]
That's me.
00:17:28 [Speaker 1]
Brian.

00:17:30 [Speaker 5]
Hi.
00:17:31 [Speaker 5]
I'm Ryan.
00:17:31 [Speaker 5]
I'm the CEO at Dev Cert.
00:17:33 [Speaker 5]
We have been in this space, for quite a while, just mostly helping organizations get CMMC certified.
00:17:39 [Speaker 5]
We do a lot of work in the world of controlled unclassified information, identifying that, helping organizations apply those concepts inside of their organization.

00:17:49 [Speaker 5]
We get to work alongside a lot of great, MSPs and MSSPs like Scott Edwards' organization and c three PAOs like Scott Singer's organization to get folks across the finish line and get them certified, but then also strip cost out of the system, scope things more appropriately, operationalize, all of the safeguards, you name it.

00:18:08 [Speaker 1]
Fantastic.
00:18:09 [Speaker 1]
Alright.
00:18:09 [Speaker 1]
I'll set the stage real quick just because I wanna get into this.
00:18:13 [Speaker 1]
So as we said, Jason Miller, Federal Newsroom Network did these two part series on the responses that he was able to get a hold of, the 997 RFI responses.
00:18:23 [Speaker 1]
In a nutshell, all the arguments of the pause were, in essence, debunked as Jason kinda looked at why...

00:18:32 [Speaker 1]
The why behind stopping it, whether it had to do with the cost assessments, whether it had to do with not enough assessors, and on and on and on of why we're stopping this.
00:18:42 [Speaker 1]
Brilliantly written.
00:18:44 [Speaker 1]
So I wanted to get together as we did last time when the pause first happened where we had Scott, Scott, Ryan, and Jacob on, and we kinda walked through what was happening.
00:18:56 [Speaker 1]
Obviously, we're a little north of sixty days.
00:18:58 [Speaker 1]
No sarcasm there whatsoever.

00:19:01 [Speaker 1]
And so with that, Scott Singer, let me let you take over, and I'll go get the URLs and put them in chat.
00:19:09 [Speaker 1]
Thanks, guys.

00:19:10 [Speaker 4]
Sounds good.
00:19:11 [Speaker 4]
So as we're just talking about, you know, we're past, I think, a hundred days now.

00:19:17 [Speaker 2]
Hundred and twelve as of today.
00:19:19 [Speaker 2]
So not that I'm counting or anything.

00:19:21 [Speaker 4]
Okay.
00:19:22 [Speaker 4]
A hundred and twelve days.
00:19:25 [Speaker 4]
So, and I know that, you know, you...
00:19:29 [Speaker 4]
Apparently, you've got access to something here.
00:19:35 [Speaker 4]
Did that...

00:19:35 [Speaker 4]
Are those documents, do you think that was their settled view or the final version of this?
00:19:42 [Speaker 4]
Or, you know, are they still...
00:19:44 [Speaker 4]
We're working this?
00:19:45 [Speaker 4]
Where do you think this is at from based on what you know?

00:19:50 [Speaker 3]
So I got a hold of what I'll say is the, RFI summary document.
00:19:54 [Speaker 3]
I did not see all responses, all 997 responses.
00:19:58 [Speaker 3]
And then I got some inside information from people, both current and former, government officials who are familiar with CMMC.
00:20:08 [Speaker 3]
And and what I think...
00:20:09 [Speaker 3]
What we're seeing here is one piece to the bigger puzzle.

00:20:13 [Speaker 3]
I don't think they're settled, and I think they were settled.
00:20:15 [Speaker 3]
We would not be counting a hundred and twelve, hundred and thirteen, fourteen days.
00:20:19 [Speaker 3]
I think we would have some more knowledge that some sort of recommendation has been made to assistant secretary of defense for acquisition sustainment, Mike Duffy, and then so on and so forth up the chain to deputy secretary of defense, Feinberg.
00:20:32 [Speaker 3]
So I think there's still...
00:20:33 [Speaker 3]
The the the the the summary is informing what the next steps are, but I think based on my sourcing and the people I've talked to, that Kirsten Davie is the DOD CIO among others and on her team may be feeling a little stuck because they want to go down a specific path.

00:20:51 [Speaker 3]
They hope that the RFI would tell them one thing.
00:20:53 [Speaker 3]
And I think what the RFI did is tell them something else, and I'm not sure they have enough data or enough data that meets their needs to go forward with recommendations that they think could could get through the sticky wickets.
00:21:07 [Speaker 3]
But it's hard to say because...
00:21:09 [Speaker 3]
And I should say this perfectly upfront.
00:21:11 [Speaker 3]
The defense department refused to comment for my story.

00:21:15 [Speaker 3]
I wanna be clear on this.
00:21:16 [Speaker 3]
A lot of people will read my story.
00:21:17 [Speaker 3]
I wrote more than 6,000 words over two stories.
00:21:21 [Speaker 3]
People will read it and say it seems very one-sided.
00:21:23 [Speaker 3]
You seem just to be having people who are very critical of DOD, and where's the people who supported DOD?

00:21:29 [Speaker 3]
And, I gave DOD more than three weeks to respond.
00:21:33 [Speaker 3]
I gave him 15 questions.
00:21:35 [Speaker 3]
Some of them were based on these documents.
00:21:37 [Speaker 3]
Many were not.
00:21:39 [Speaker 3]
Many were very focused on the DOD CIO's feelings towards CMMC, how much research she did, how she made herself knowledgeable about it.

00:21:50 [Speaker 3]
I I realized some of the questions were gonna be difficult to answer.
00:21:54 [Speaker 3]
I went back and said, hey.
00:21:55 [Speaker 3]
I know there's a lot here.
00:21:56 [Speaker 3]
You can...
00:21:57 [Speaker 3]
If you need more time, let me know.

00:21:59 [Speaker 3]
Eventually, they wrote back and said, basically, we're not gonna comment.
00:22:03 [Speaker 3]
And I went back and said, are you sure about this?
00:22:06 [Speaker 3]
And here's what I have.
00:22:07 [Speaker 3]
I I gave them a heads up that I had this document, and they just told me to go away.
00:22:13 [Speaker 3]
So, so it's hard to know what...

00:22:15 [Speaker 3]
What's what's actually happening outside of that...
00:22:17 [Speaker 3]
What these RFI responses are saying.

00:22:21 [Speaker 4]
Thanks.
00:22:23 [Speaker 4]
You you know, just as my editorial, I'm I'm supportive of things like this to make any program better.
00:22:30 [Speaker 4]
Right?
00:22:31 [Speaker 4]
And and there's definitely things that could be made better in this program, so I just kinda wanna put that out front.
00:22:37 [Speaker 4]
And I also understand how when you have somebody new to a role like the honorable Davies, she's gonna wanna put her stamp on it and understand it.

00:22:46 [Speaker 4]
So all that aside, my personal experience, and I'm sure Brian and Scott Edwards would agree with me, is that third party verification has been working.
00:23:01 [Speaker 4]
And it's been securing CUI, and it's moving people out of, you know, some dangerous, you know, environments where export controlled information is in a bad place.
00:23:13 [Speaker 4]
Right, Ryan?
00:23:15 [Speaker 4]
And, so this...
00:23:16 [Speaker 4]
I mean, I've seen a lot of good things come out of this where information is getting better protected.

00:23:22 [Speaker 4]
So it's, you know, it's disappointing to see the companies pause because they didn't have to pause even though it's causing pause.
00:23:33 [Speaker 4]
So...
00:23:34 [Speaker 4]
And then, Scott, I know you talked about there's been 52,000 new vulnerabilities or CVEs that have come out since July 13.
00:23:43 [Speaker 4]
Right?
00:23:44 [Speaker 4]
Published by MITRE.

00:23:46 [Speaker 4]
That's, like, 13% as of all the CVEs ever put out.
00:23:53 [Speaker 4]
So, I mean, the threat's only getting worse.
00:23:55 [Speaker 4]
We would call it in the Midwest.
00:23:56 [Speaker 4]
We call it a hockey stick.

00:23:58 [Speaker 3]
So Mhmm.

00:23:59 [Speaker 4]
So it's definitely a hockey stick.
00:24:01 [Speaker 4]
With that kind of as a backdrop, your reporting said that three sources told you honorable Davies privately set a goal is to end CMMC.
00:24:11 [Speaker 4]
So assuming that that is accurate, did you get any read as to why she wants to kill the program?

00:24:20 [Speaker 3]
I think some of it comes back to there's this perception of the program that it's bureaucracy, it's burdensome, and the high cost.
00:24:32 [Speaker 3]
And I know we'll probably talk about the cost in a little bit, but I think people are in her ear and and saying, hey.
00:24:39 [Speaker 3]
This is a problem.
00:24:40 [Speaker 3]
It's not working.
00:24:41 [Speaker 3]
And and and to your point, no one ever who I talked to said, hey.

00:24:47 [Speaker 3]
The program's perfect.
00:24:48 [Speaker 3]
No one ever I...
00:24:49 [Speaker 3]
Who I spoke with said, hey.
00:24:50 [Speaker 3]
The program...
00:24:51 [Speaker 3]
Why is she touching a perfect program?

00:24:53 [Speaker 3]
I mean, even Katie Arrington, who was the duty CIO during the first Trump administration that got this going and was performing the duties as the duty CIO before miss Davies took over, said there are ways to make it better without a doubt.
00:25:08 [Speaker 3]
So...
00:25:09 [Speaker 3]
And and and she was even like, listen.
00:25:10 [Speaker 3]
It's not personal.
00:25:11 [Speaker 3]
It's not my baby.

00:25:12 [Speaker 3]
I I don't wanna own the program.
00:25:13 [Speaker 3]
I wish I didn't have to own the program.
00:25:16 [Speaker 3]
But she feels like based on her experience, based on what she knows, based on everything that's happening, just to Scott your point, Things were not good without industry was projecting CUI, and things have gotten better, but they're still not perfect.
00:25:30 [Speaker 3]
So to get to your...
00:25:31 [Speaker 3]
To answer your question, it's unclear why she wants to end the program except for people have told her things, and and it doesn't feel like, based on what I've been told by multiple sources, she's done her own enough research.

00:25:44 [Speaker 3]
And those are some of the questions I asked her.
00:25:46 [Speaker 3]
How did you go about?
00:25:48 [Speaker 3]
Can you confirm you only spent twenty minutes with the CMMC PMO back in April, March, April time frame, February time frame?
00:25:55 [Speaker 3]
What else have you done to learn about this?
00:25:56 [Speaker 3]
Right?

00:25:57 [Speaker 3]
I mean, Katie Arrington told me I left a binder on her desk.
00:25:59 [Speaker 3]
Now someone, put on LinkedIn.
00:26:01 [Speaker 3]
That binder was worthless.
00:26:03 [Speaker 3]
Well, okay.
00:26:04 [Speaker 3]
Like, maybe it was, maybe it wasn't, but I think the point is only this.

00:26:10 [Speaker 3]
If she took the time to understand the program, took to understand...
00:26:16 [Speaker 3]
Time to understand the problem, then maybe she could say, here are five things around CMMC that bother me that aren't working, but here's 10 things that are...
00:26:25 [Speaker 3]
Let's figure out a happy medium.
00:26:26 [Speaker 3]
Let's figure out a way to go forward.
00:26:28 [Speaker 3]
And and, again, to Scott, your point, the pause is not necessarily a bad idea, but it's unclear what that pause really means in the long run and what's happening next.

00:26:38 [Speaker 3]
And I think all those questions are being left to to the simmer, and I don't think she's done a good enough job to come out and say, listen, industry.
00:26:48 [Speaker 3]
We're not happy with what you're doing.
00:26:49 [Speaker 3]
You need to be better.
00:26:50 [Speaker 3]
We understand there's some challenges.
00:26:52 [Speaker 3]
How do we find the happy medium?

00:26:54 [Speaker 3]
I I don't know if that message is clear enough.
00:26:56 [Speaker 3]
And I, so So I trust the sources I talked to, and I think I think, you know, she she she had a bee in her bonnet, as I like to say, to say this is not not a good program, and and and they should end it.

00:27:09 [Speaker 2]
So so, Jason, you mentioned that, you know, they didn't obviously respond to any of your questions.
00:27:14 [Speaker 2]
And that's, I mean, that's pretty much how we have seen, you know, honorable Davies and this new...
00:27:20 [Speaker 2]
This CIO, you know, office interact or lack to...
00:27:26 [Speaker 2]
Lack of interaction with the ecosystem as a whole.
00:27:29 [Speaker 2]
You know, there hasn't been a lot of back and forth.

00:27:32 [Speaker 2]
There hasn't been a lot of information coming out of, you know, out of the CIO's office, you know, since the pause, you know, kicked off in July.
00:27:40 [Speaker 2]
And that, you know, that leaves, like you said, everyone to just speculate on what's going on.
00:27:46 [Speaker 2]
I know in previous administrations or in previous offices, even in the same administration, there was a tremendous amount of back and forth and question and answer.
00:27:54 [Speaker 2]
And, you know, you could send an you could send an email in to the DOD CIO's office, and they would answer it.
00:28:00 [Speaker 2]
And then they would post an FAQ update that would basically let everybody know that, hey.

00:28:04 [Speaker 2]
This question came in.
00:28:05 [Speaker 2]
This is how we see about it.
00:28:07 [Speaker 2]
But we're not seeing any of that kind of interaction with the ecosystem, you know, since, you know, honorable Davies has taken over.
00:28:14 [Speaker 2]
Do you first...
00:28:15 [Speaker 2]
Is that just within this specific program?

00:28:18 [Speaker 2]
Because...
00:28:19 [Speaker 2]
You know?
00:28:19 [Speaker 2]
Or is that across all of the CIO, you know, and how they interact, you know, across the entire, the agency itself?
00:28:27 [Speaker 2]
You know, is it just for the CMMC program that they're doing this?

00:28:33 [Speaker 3]
I think two things have to be, clear here.
00:28:36 [Speaker 3]
It's not unusual for a federal agency to kinda withdraw during an RFI process.
00:28:40 [Speaker 3]
Right?
00:28:41 [Speaker 3]
They wanna let the RFI process happen.
00:28:43 [Speaker 3]
You see this probably in regular acquisitions.

00:28:45 [Speaker 3]
If you're bidding on an acquisition and and an agency puts out an RFI, they kinda wanna let industry weigh in, do their thing.
00:28:51 [Speaker 3]
And then once industry has weighed in, they wanna go through and give give a fair look at this.
00:28:56 [Speaker 3]
Now the concern I've heard about the look at the RFI is they did it over a short amount of time.
00:29:02 [Speaker 3]
They got about a thousand responses.
00:29:04 [Speaker 3]
They didn't use AI.

00:29:05 [Speaker 3]
They didn't use any tools.
00:29:07 [Speaker 3]
It was all done by kinda hand.
00:29:09 [Speaker 3]
And and so it leads to a lot of questions about, okay.
00:29:11 [Speaker 3]
Well, how much analysis could you do?
00:29:14 [Speaker 3]
And then not talking about it adds to your point more concerns, more conjecture, more...

00:29:19 [Speaker 3]
Well, I I I guess they don't care.
00:29:22 [Speaker 3]
And I think, you know, you know, Kirsten Davies has spoken on occasion in in the community.
00:29:28 [Speaker 3]
I I don't think, it...
00:29:30 [Speaker 3]
It's quite enough for a lot of us.
00:29:32 [Speaker 3]
I think you wanna hear more from her, especially on a big program that affects so many people.

00:29:37 [Speaker 3]
And I think that is problematic.
00:29:40 [Speaker 3]
And when you see her speak, she doesn't really touch upon some of the big initiatives that DOD has been working on.
00:29:46 [Speaker 3]
Again, whether it's the RMF reform, whether it's the swift software program, and you can say, well, those are Katie Arrington's things.
00:29:54 [Speaker 3]
Why would she not...
00:29:55 [Speaker 3]
She'd want her own things, then that's fine.

00:29:57 [Speaker 3]
I mean, every CIO, every...
00:29:59 [Speaker 3]
Listen.
00:29:59 [Speaker 3]
You all own...
00:30:00 [Speaker 3]
Run companies.
00:30:01 [Speaker 3]
You know, you...

00:30:02 [Speaker 3]
Sometimes initiatives that you inherited, you don't want.
00:30:05 [Speaker 3]
You're...
00:30:05 [Speaker 3]
Or you change, and and there's nothing wrong with that.
00:30:08 [Speaker 3]
You see that across the board.
00:30:10 [Speaker 3]
But she has not really been out in front to say what matters.

00:30:13 [Speaker 3]
I mean, they did launch Brilliant at the basics, as a as a kind of a...
00:30:17 [Speaker 3]
An aside to CMMC.
00:30:20 [Speaker 3]
And even then, you know, folks say that is fine, but it's...
00:30:24 [Speaker 3]
Doesn't replace CMMC.
00:30:26 [Speaker 3]
It's gonna cost industry even more money for some of the things they're they're calling for.

00:30:31 [Speaker 3]
But my...
00:30:32 [Speaker 3]
I guess, the...
00:30:32 [Speaker 3]
My point is trying to be here is is the lack of communication is what is driving a lot of this frustration in in the community, and they're not...
00:30:43 [Speaker 3]
This this, I would say, the entire Trump administration doesn't talk about technology the way previous administrations have, both Trump won, both Biden, both during Obama, during George w Bush, so on and so forth.
00:30:56 [Speaker 3]
And I think that's also is is unusual and and and a little frustrating to the entire federal community that they're not getting that same level of communication that they're used to.

00:31:05 [Speaker 3]
And it's it's it's hard to know, understand what what do you want from us?
00:31:11 [Speaker 3]
Where do you want us to go next?
00:31:13 [Speaker 3]
How can we help you?
00:31:15 [Speaker 3]
You know, whenever I moderate panels, at events, and we get to the last question, and I always say, well, what should the audience know?
00:31:25 [Speaker 3]
And I said, and don't give me any platitudes because I have my, you know, self made platitude buzzer, and don't tell us about partnerships.

00:31:32 [Speaker 3]
So my partnerships are so important, and no tell us about...
00:31:34 [Speaker 3]
We gotta work together and do your homework.
00:31:36 [Speaker 3]
And and and I think that's kind of where they're at now is we're partners except for when we don't want you to be our partner when we're in charge.
00:31:44 [Speaker 3]
And we want this to be a collaboration except for when we don't want to collaborate with you.
00:31:48 [Speaker 3]
So I think all of those messages are just making it harder to understand what's happening anywhere across, not just DOD, but a lot of the agencies themselves.

00:32:00 [Speaker 1]
Scott Singer, I wanna get back to you and then, you know, could I move forward?
00:32:03 [Speaker 1]
But can I?
00:32:04 [Speaker 1]
As I get back to you and let you take over...
00:32:07 [Speaker 1]
Back over, Scott, this has been talked about before.
00:32:10 [Speaker 1]
But is it, like, are we just all kinda brushing under the rug that we've all been, in essence, lie...

00:32:17 [Speaker 1]
I mean, and not all.
00:32:18 [Speaker 1]
But but, basically, hey.
00:32:20 [Speaker 1]
We've been all lying about our 807...
00:32:23 [Speaker 1]
One seventy one compliance all along to get our contracts now that we have to actually prove it.
00:32:29 [Speaker 1]
I mean, it it...

00:32:30 [Speaker 1]
Like, does that just go away, so to speak, that no one really...
00:32:35 [Speaker 1]
We're not gonna look at that anymore.
00:32:37 [Speaker 1]
Like, it...
00:32:38 [Speaker 1]
This is the problem that it's, like, too expensive.
00:32:41 [Speaker 1]
And don't worry about that.

00:32:43 [Speaker 1]
All the contracting you've done all along, we're not even...
00:32:46 [Speaker 1]
I mean, I know that I'm not the first to talk about this, but it just seems head scratching.

00:32:54 [Speaker 2]
Well, I mean, you know, I'll just make a comment on that real quick.
00:32:58 [Speaker 2]
You know, if you look at the whole, history of where we've been with CUI protection in the defense industrial base, it goes...
00:33:06 [Speaker 2]
You know, go all the way back to 2013, and you look at what was, you know, required, you know, by DOD then.
00:33:13 [Speaker 2]
And we started out at 853.
00:33:15 [Speaker 2]
And the history over the last, you know, over the last decade plus, now we're approaching thirteen, fourteen years, has has been nothing but a continued concession to industry going from 853 to 971 to additional time to implement 971 to, you know, CMMC one point o and then pulling back the delta 20 and we get CMMC two point o and the rule making processes.

00:33:42 [Speaker 2]
And everything that we have done for the last thirteen years has been to try and and give more concession to industry so that they can get where they need to be to protect CUI at some level.
00:33:52 [Speaker 2]
Right?
00:33:53 [Speaker 2]
And and this is another attempt to do that, I think.
00:33:57 [Speaker 2]
But where do we go from here?
00:33:58 [Speaker 2]
I mean, you know, how do you...

00:34:00 [Speaker 2]
Do we...
00:34:01 [Speaker 2]
If you get rid of $801.71, what do you go...
00:34:04 [Speaker 2]
What do you use at that point?
00:34:06 [Speaker 2]
Because Brilliant at the Basics isn't it.
00:34:07 [Speaker 2]
I mean, okay.

00:34:08 [Speaker 2]
Great.
00:34:10 [Speaker 2]
Okay.
00:34:10 [Speaker 2]
That's the things that she wants to push on.
00:34:13 [Speaker 2]
But Brilliant at the Basics isn't gonna get it done.
00:34:15 [Speaker 2]
It's just not.

00:34:16 [Speaker 2]
I mean...
00:34:16 [Speaker 2]
And at some level, there are going to be companies even with Brilliant at the Basics, which is, you know, it's it's it's arguable if some of those things are basic anyway.
00:34:25 [Speaker 2]
But even if you get it down to 10 controls, if they are actually significant controls, they're still going to be a significant part of the DIB who cannot meet those requirements.
00:34:34 [Speaker 2]
They're just too small.
00:34:35 [Speaker 2]
They're under, you know, the the cybersecurity poverty line, and they're not going to be able to implement those controls.

00:34:41 [Speaker 2]
So I don't know where else we can go from here to make it easier for, for the DIB as a whole.
00:34:47 [Speaker 2]
So, Scott, I I don't know.
00:34:48 [Speaker 2]
What do you think?

00:34:52 [Speaker 4]
I don't disagree.
00:34:54 [Speaker 4]
You know, if you look at the...
00:34:55 [Speaker 4]
First of all, you know, the brilliant at the basics, there's a bunch of good ideas there, but there isn't a framework that supports that.
00:35:03 [Speaker 4]
And so how do you assess against it?
00:35:05 [Speaker 4]
How do you verify who find this?

00:35:07 [Speaker 4]
Because you go back to the 2020 National Defense Authorization Act.
00:35:11 [Speaker 4]
There was a third party verification requirement that was put forward as part of that bill.
00:35:17 [Speaker 4]
Right?
00:35:18 [Speaker 4]
So they're looking for trust but verify.
00:35:22 [Speaker 4]
Right?

00:35:22 [Speaker 4]
And we found from IG investigations that people weren't doing this.
00:35:28 [Speaker 4]
Right?
00:35:29 [Speaker 4]
And so you gotta have something you can assess against and look at.
00:35:33 [Speaker 4]
And right now, we've gotten SD eight hundred one seventy one.
00:35:36 [Speaker 4]
So, you know, I keep going back to saying, I've been looking at Brilliant and Basics, and we've been trying to map which controls, you know, apply, which ones don't, which ones in revision three apply and which ones don't, and things like, you know, you know, the the fishing MFA.

00:35:56 [Speaker 4]
I mean, that's just not covered anywhere right now.
00:36:00 [Speaker 4]
And so that's that step beyond where we're at today and cost more money.
00:36:04 [Speaker 4]
Right?
00:36:04 [Speaker 4]
So that's my interpretation is it's like, you know, the enemy of, you know, good is perfect.
00:36:10 [Speaker 4]
Right?

00:36:11 [Speaker 4]
I mean, kind of this...
00:36:12 [Speaker 4]
We've we've got it...
00:36:13 [Speaker 4]
We've got something good.
00:36:15 [Speaker 4]
Let's just make it better.
00:36:17 [Speaker 4]
Anyway...

00:36:18 [Speaker 4]
What what what...

00:36:19 [Speaker 3]
I was just jumping because I think, Scott, you bring up a really important part, which is over the last decade...
00:36:26 [Speaker 3]
And and and I've offered to do this at least twice to different associations who've declined for whatever reason.
00:36:33 [Speaker 3]
I said, look, I would love to do an anonymous survey with companies in the defense industrial base and ask them, since DOD started talking about CMMC in 2017, 2018, how...
00:36:43 [Speaker 3]
How's their CUI protection improved?
00:36:45 [Speaker 3]
Even before implementing the the basics of CMMC CMMC, what...

00:36:50 [Speaker 3]
And and and two different associations are like, oh, Jason, that's a great idea.
00:36:54 [Speaker 3]
I don't think we can participate with you.
00:36:55 [Speaker 3]
So I'm like, okay.
00:36:56 [Speaker 3]
Well, I could have done it myself, to be honest, and and we just didn't, but I thought it would be better if it's coming from, something else.
00:37:03 [Speaker 3]
But but I think my concern...

00:37:05 [Speaker 3]
My my concern or my question is is why not take the win even if you say CMMC is burdensome, is costly, we need to fix it.
00:37:18 [Speaker 3]
Why not take the win and say over the last five, six, seven years, look how much better we've gotten.
00:37:23 [Speaker 3]
Here's the impact it's made, and now let's let's take the next step.
00:37:27 [Speaker 3]
And to, what I...
00:37:28 [Speaker 3]
You know, to the people I've talked to said, just get it started.

00:37:31 [Speaker 3]
Even Katie Arrington said, get it started, then refine it.
00:37:33 [Speaker 3]
But you've gotta get it started because the problem is real.
00:37:37 [Speaker 3]
And I think one of the big reasons going back to your question, Scott, that you asked me about about why...
00:37:43 [Speaker 3]
What why...
00:37:43 [Speaker 3]
What miss Davy's kinda end result wants to be is there's concern, and I've heard it from multiple sources that she's not taking a classified briefing of the CUI problem, of this...

00:37:53 [Speaker 3]
Of the problem that's being, stolen.
00:37:55 [Speaker 3]
And I have no way to know if she has or hasn't.
00:37:58 [Speaker 3]
This is what...
00:37:58 [Speaker 3]
This is, you know, kind of what what informed sources believe based on.
00:38:02 [Speaker 3]
And they and they've told me if you take that classified briefing, and I don't have a classified way to do it.

00:38:07 [Speaker 3]
But I've been told that if you have, you will understand why CMMC is needed.
00:38:11 [Speaker 3]
And, Ryan, you're shaking your head.
00:38:12 [Speaker 3]
Maybe you've taken a classified briefing.
00:38:14 [Speaker 3]
I don't know.

00:38:15 [Speaker 1]
Ryan, maybe talk about, you know, lead in with...
00:38:17 [Speaker 1]
I wish Jacob was here to talk about Chesterton Spence, but, you know, he talked about that last time.
00:38:22 [Speaker 1]
Maybe kinda lead there.
00:38:24 [Speaker 1]
Like, she doesn't understand why there's effects.
00:38:26 [Speaker 1]
Right?

00:38:27 [Speaker 5]
Yeah.
00:38:28 [Speaker 5]
Yeah.
00:38:29 [Speaker 5]
Well, and and to Jason's point, if if you reached out to most organizations and said, like, how has your CUI safeguarding improved since the announcement of CMMC?
00:38:36 [Speaker 5]
A lot of them would say, I'm sorry.
00:38:37 [Speaker 5]
What's CUI?

00:38:39 [Speaker 5]
Because there...
00:38:40 [Speaker 5]
There's still, like, huge knowledge and understanding gaps where organizations are saying yes to the contract clauses and they're not unpacking what's inside of them in a lot of cases because it's a game of telephone through the supply chain with continually degrading understanding of what the assignment is.
00:38:58 [Speaker 5]
And so that's one anti pattern that we've always gotta fight back against.
00:39:01 [Speaker 5]
But, yeah, I mean, if you if you had an understanding of how much intellectual property is leaving, you know, the Continental United States every year, you know, estimates we were getting five, six years ago was 600 to 700,000,000,000 a year, and that's probably only increased.
00:39:18 [Speaker 5]
I mean, you would leave that briefing pretty pale faced, and and that would create some motivations.

00:39:25 [Speaker 5]
And so I I think that that on some level when when we read the RFI at at face value when it was was first published, we're like, this this sounds like someone who didn't read up on some of the why behind the CMMC program and is talking about things that are actually the responsibility of other, like, parts of the code of federal regulations, like other other regulatory functions, the CUI program itself

00:39:54 [Speaker 4]
or,

00:39:55 [Speaker 5]
you know, DFARS itself or, you know, things of that nature that, like, hey.
00:40:00 [Speaker 5]
The CMMC cannot, you know, solve this for you.
00:40:04 [Speaker 5]
And making the...
00:40:05 [Speaker 5]
Any annual sales page to see him and see won't affect those problems you're asking me about in the RFI.

00:40:12 [Speaker 1]
Hey.
00:40:12 [Speaker 1]
Good stuff.
00:40:13 [Speaker 1]
Scott, singer, back to you, bud.
00:40:15 [Speaker 1]
I do have a question.
00:40:16 [Speaker 1]
I gotta ask him a little bit, but let me let you guys

00:40:19 [Speaker 5]
guys know.

00:40:20 [Speaker 4]
I know.
00:40:20 [Speaker 4]
It's it's it's one of those things where everybody...
00:40:22 [Speaker 4]
We're all passionate about this.
00:40:24 [Speaker 4]
Right?

00:40:24 [Speaker 1]
Yeah.
00:40:25 [Speaker 1]
For

00:40:25 [Speaker 4]
sure....
00:40:26 [Speaker 4]
Care.
00:40:26 [Speaker 4]
And so, you know, it's it's gonna go off the rails a little bit, Andrew.
00:40:30 [Speaker 4]
So...
00:40:31 [Speaker 4]
It's fine.

00:40:32 [Speaker 1]
It's fine.

00:40:32 [Speaker 4]
Anyway, so let's go back to the RFI.
00:40:36 [Speaker 4]
So, the RFI, according to your article, puts the average CMMC assessment cost at about $47,000.
00:40:46 [Speaker 4]
So, that's a little high even from what I know, and I've done a 120 level two assessments, and our average is more in the range of $40,000.
00:41:01 [Speaker 4]
And you do have to be careful here, I think, on the statistics side.
00:41:05 [Speaker 4]
And by the way, I'm not a statistician.

00:41:07 [Speaker 4]
But, you know, there's things like medians and modes and averages.
00:41:11 [Speaker 4]
Right?
00:41:12 [Speaker 4]
And things can skew when you got outliers like, you know, the $600,000 assessment.
00:41:18 [Speaker 4]
I mean, to me, that's an outlier.
00:41:20 [Speaker 4]
In the old statistic days, we would throw those out.

00:41:22 [Speaker 4]
Right?
00:41:23 [Speaker 4]
When I had my class in college, you'd toss that out.
00:41:26 [Speaker 4]
But that said, I think it's still important to know that that happened because it happened.
00:41:32 [Speaker 4]
That's still a problem.
00:41:34 [Speaker 4]
But we being, you know, Scott, Ryan, Jacob, and I, we were all of the belief that a lot of these costs are made up of a number of things, the implementation cost, right, to get there.

00:41:48 [Speaker 4]
So can you talk about that a little bit about what your experiences and what you learned in this journey that you were on in this article?
00:41:58 [Speaker 4]
So the the cost

00:42:00 [Speaker 3]
that I was quoting comes directly from the RFI responses.
00:42:04 [Speaker 3]
And my understanding is...
00:42:06 [Speaker 3]
And and and when the story came out, I actually had someone call me after the fact and said, oh, we were one of the companies that submitted the contracts to DOD to prove what the average cost was or what the...
00:42:19 [Speaker 3]
From their perspective.
00:42:20 [Speaker 3]
And and so, it it was something like five contracts were were submitted or five different vendors submitted contracts to show the cost.

00:42:29 [Speaker 3]
And and I know that there's there...
00:42:31 [Speaker 3]
And and that part of that story actually got...
00:42:33 [Speaker 3]
There's a lot of back and forth on LinkedIn about it.
00:42:36 [Speaker 3]
And whether or not that 47,000 actually captures the entire cost or just to your point, Scott, the...
00:42:44 [Speaker 3]
Did you meet...

00:42:45 [Speaker 3]
Did you get to level two x...
00:42:47 [Speaker 3]
You know, did you do these 10 things, 100 things, whatever it was?
00:42:52 [Speaker 3]
It's it's it's unclear, but $600,000 and and and the cost that that Kelly Loeffler, the SBA administrator quoted, that there was a big gap, and and it's unclear where the...
00:43:06 [Speaker 3]
She got that number from.
00:43:08 [Speaker 3]
So I don't have a lot of insights in terms of that 47,000 number, but what I can tell you is is the cost to it was a main reason why duty suspended or decided to pause CMMC.

00:43:21 [Speaker 3]
And when the RFI came back at 47,000, they wrote in it that that this was a...
00:43:27 [Speaker 3]
And I quote the the the RFI summary document that cost was not the driver they expected it to be.
00:43:35 [Speaker 3]
They said that, you know, I'll just read it to you in in the email to kind of the summary.
00:43:40 [Speaker 3]
Another top five cost drivers closely related to NIST special publication eight hundred one seventy one complexity, which is the need for specialized dedicated personnel to assist with understanding requirements, implementing solutions, and documenting evidence.
00:43:54 [Speaker 3]
The results in small businesses augmenting their staff or expanding existing staff roles to sort...

00:43:59 [Speaker 3]
To assume additional duties, I think all that plays into it.
00:44:04 [Speaker 3]
And then they say, rounding out the top five perceived high cost, a $100,000 plus was the three p...
00:44:11 [Speaker 3]
Three c c three PO assessments.
00:44:14 [Speaker 3]
And in contrast, the average assessment was 47,000.
00:44:18 [Speaker 3]
So I think they're realizing the same thing that the the...

00:44:21 [Speaker 3]
What they've been told is maybe not necessarily true, but I'd love to maybe hear from you all.
00:44:26 [Speaker 3]
I mean I mean, Scott Ware or or Ryan or Scott Edwards, where does the cost come from if that they're talking about that is so expensive?
00:44:33 [Speaker 3]
I mean, to me...
00:44:35 [Speaker 3]
And what I was told is the $801.71 compliance.

00:44:39 [Speaker 2]
Yeah.
00:44:39 [Speaker 2]
And and that's correct.
00:44:40 [Speaker 2]
I mean, the majority of the cost in all of this goes back to $801.71 because, you know, companies have not implemented these systems to protect data, their data or the government's data.
00:44:54 [Speaker 2]
And so when you implement eight hundred one seventy one, there are a lot of tools and capabilities that have to be in place for you to meet the actual security requirements.
00:45:03 [Speaker 2]
And if you're not doing those things, then you're not going to end up meeting, you know, meeting the requirements of of the controls.

00:45:10 [Speaker 2]
And so, yes, most of it comes from 971.
00:45:13 [Speaker 2]
And from the government standpoint, the problem is is that, you know, companies have been signing contracts for more than a decade saying that they already were meeting these requirements.
00:45:25 [Speaker 2]
And so when the government hears, oh, it cost me $600,000, for CMMC, They hear it took me...
00:45:33 [Speaker 2]
It was $600,000 for a CMMC assessment because that's what the government understands the program to be.
00:45:38 [Speaker 2]
What they don't understand is that, you know, 550,000 of that was the implementation cost to get to $801.71 because they had been ignoring $801.71 for the last decade.

00:45:49 [Speaker 2]
Right?

00:45:49 [Speaker 5]
Yes, Scott.
00:45:50 [Speaker 5]
The the reminds me of, like, if if your state announced a new car inspection program, and then people start complaining about the cost of buying and insuring a car.

00:45:59 [Speaker 2]
Yeah.
00:45:59 [Speaker 2]
It's basically it.
00:46:00 [Speaker 2]
I mean, that's basically it.
00:46:02 [Speaker 2]
And so so that's where a lot of the cost does come from.
00:46:05 [Speaker 2]
And and and now the good thing with the CMMC program, and I gotta hand it to the DOD and the way that they built the CMMC program is they put a tremendous amount of thought and effort into building out the program, which had scoping requirements and had the ability to control cost and burden by scoping an environment and saying, this is the environment that CUI is going to live in, and now I only have to implement these controls around this very controlled environment.

00:46:31 [Speaker 2]
Before the CMMC program, you just had eight hundred one seventy one.
00:46:34 [Speaker 2]
It essentially...
00:46:35 [Speaker 2]
You were looking at an enterprise wide implementation of eight hundred one seventy one.
00:46:39 [Speaker 2]
With CMMC, they dramatically changed the rules of the game by adding all of this additional information about how to scope for the environment, having, you know, contractor risk managed assets since, you know, SPAs and SPD and all the different, you know, pieces of the program, all those different pieces of program dramatically reduce the overall cost to the ecosystem.
00:47:00 [Speaker 2]
However, comma, because you have to understand all of that stuff to be able to properly use the scoping, your average small business who has, you know, point two FTEs doing help desk work doesn't have the experience to read and understand all of that information and be able to use it appropriately so they complain about, oh, you've got consultants and blah blah, you know, all the stuff around the ecosystem to understand it.

00:47:27 [Speaker 2]
But either you implement the entire thing and you blow out the cost because you're doing enterprise app wide app, you know, implementations or you scope it down and you have to get some consulting help to help you, you know, build that out, or you go hire really expensive people.
00:47:40 [Speaker 2]
I mean, it's it's all a trade off.

00:47:43 [Speaker 4]
Can I have one comment on this too, Andrew, is that, you know, honorable Davies gets at talking about resiliency and Scott Edwards' comment around scoping of CUI environments made this jump out at me again?
00:47:58 [Speaker 4]
I mean, resiliency is important.
00:48:01 [Speaker 4]
She's cared about, you know, the company making widgets for DOW goes out of business.
00:48:07 [Speaker 4]
Right?
00:48:07 [Speaker 4]
And they can't make the things that are needed.

00:48:10 [Speaker 4]
Understand that completely.
00:48:11 [Speaker 4]
Right?
00:48:12 [Speaker 4]
The CUI CMMC program was not designed for that.

00:48:17 [Speaker 5]
Mhmm.

00:48:17 [Speaker 4]
Okay?
00:48:17 [Speaker 4]
It was designed to protect CUI, and that's like, DOW's IP.
00:48:24 [Speaker 4]
Right?
00:48:25 [Speaker 4]
And so that's...
00:48:27 [Speaker 4]
So anything...

00:48:28 [Speaker 4]
I...
00:48:28 [Speaker 4]
I'm a proponent of resiliency, but that's an add on, okay, to the current program, and that would cost more money.
00:48:37 [Speaker 4]
So it's back to the original kind of place we're at.
00:48:40 [Speaker 4]
Let's get this basic stuff right going now and build on it over time.

00:48:47 [Speaker 2]
So And my understanding was that, you know, DOW had that plan in place.
00:48:53 [Speaker 2]
Right?
00:48:53 [Speaker 2]
I was listening to, mister Buddy d's recently talk on a different podcast about the plan that they had in place to phase it out.
00:49:02 [Speaker 2]
And the IT controls, the eight hundred one seventy one were part of phase one, and the OT controls were going to be part of phase two, and so was eight hundred one seventy one r three uplift.
00:49:12 [Speaker 2]
All of that was part of a controlled progression that they had laid out, you know you know, back, you know, even ten months ago.

00:49:21 [Speaker 2]
You know, November, December of last year, all of that was ready to go, and it just has kinda gone nowhere.

00:49:27 [Speaker 3]
Well, that's real quick, Andrew.
00:49:28 [Speaker 3]
That's the other point that came up during my reporting quite a bit is 80171 has moved to rev three.
00:49:34 [Speaker 3]
It was on her desk ready to be signed to move CMMC to rev three.
00:49:38 [Speaker 3]
You have a CUI FAR case, federal opposition regulations case that's moving to rev three.
00:49:43 [Speaker 3]
If you remember earlier this year, the general services administration put out a a CUI protection type type of guide or recommendations.

00:49:51 [Speaker 3]
They had moved to rev three.
00:49:52 [Speaker 3]
That caused confusion.
00:49:54 [Speaker 3]
She could have moved to rev three fairly quickly, still had this pause to understand what's happening and and and kept the the ball rolling.
00:50:01 [Speaker 3]
And I think a lot of what Buddy Deez was talking about, and I was not familiar with that podcast or that interview, but probably what got held up because so much was being teed up for her to come in when she got confirmed by the senate to really get off and running.
00:50:14 [Speaker 3]
And instead of...

00:50:16 [Speaker 3]
Again, this is what the sources are telling me.
00:50:18 [Speaker 3]
Taking the time, getting the the the time...
00:50:21 [Speaker 3]
The the briefing and then then understanding where to go next, she just stopped.
00:50:26 [Speaker 3]
And I think that's, again, the frustration of of, and the questions just come up.
00:50:30 [Speaker 3]
I mean, the one story I'll repeat from my reporting is she was supposed to spend ninety minutes with the PMO, showed up late to the meeting, listened to them for twenty minutes, and then never talked to them again, and it's been seven, eight months.

00:50:44 [Speaker 3]
And it's just kinda like, okay.
00:50:47 [Speaker 3]
Like, trust your experts.
00:50:49 [Speaker 3]
I mean, we

00:50:49 [Speaker 5]
all I think that's what's what's, so, like, astounding to me is if you gave me all the raw ingredients that we're dealing with right now, which is the RFI, upcoming regulations that are gonna happen no matter what, gave me all of that to work with.
00:51:06 [Speaker 5]
The the best, most graceful landing I could orchestrate for the CIO would be to just declare 2027 a transition year to rev three in alignment with the far CUI rule and then resume the phased rollout at some future point when it makes sense.

00:51:23 [Speaker 2]
November 27.

00:51:25 [Speaker 5]
Instead of, like, effectively demonizing all the work that has been done to date, rev three is gonna require you to do a lot of the same things that were in Rev two and then some on top of that, like about 50% more.
00:51:41 [Speaker 5]
So there...
00:51:42 [Speaker 5]
There's there's a lot of, there's a lot of graceful exits here, I think, that Rev three presents.
00:51:49 [Speaker 5]
And it's it's kind of befuddling to me that that isn't what the department would reach for to sort of smooth this whole thing over, especially when the RFI responses don't don't point towards the the root cause of all these problems being third party assessments.

00:52:05 [Speaker 1]
Can can I just ask...
00:52:06 [Speaker 1]
Maybe start with Scott Edwards real quick here, Jason.
00:52:09 [Speaker 1]
I know you you have your three p's and it's nothing political, but I do wanna ask, you know, we've used a lot of military power in our Iran conflict and supporting, you know, Ukraine and, you know, with all of this going on and potentially what could change with the midterms.
00:52:31 [Speaker 1]
You know, Scott Edwards, you know, is someone that's, you know, obviously, is at West Point, very...
00:52:38 [Speaker 1]
You know, understands the military well.

00:52:40 [Speaker 1]
I mean, are we putting ourselves at further potential risk here, almost potential gridlock and critical rearmament that we need as we try to, you know, figure all this out and then potentially have, you know, gridlock in Washington.
00:52:57 [Speaker 1]
You mean, could we be running into a a kind of a cult?

00:53:00 [Speaker 2]
Yeah.
00:53:00 [Speaker 2]
I mean, that's a loaded...
00:53:01 [Speaker 2]
That's a hugely loaded question.
00:53:03 [Speaker 2]
But, you know, I will say, you know, in in honorable Davy's defense, I believe that she was also getting a lot of questions or pressure probably from the secretary of defense and potentially even from the president, that, hey.
00:53:17 [Speaker 2]
You know, we've used all of these munitions.

00:53:19 [Speaker 2]
We've used all of this equipment in Iran.
00:53:21 [Speaker 2]
We have to replenish the stocks.
00:53:23 [Speaker 2]
Now is not the time for us to be losing our supply chain because of CMMC.
00:53:28 [Speaker 2]
You know, we can't be kicking companies out of the supply chain, because, you know, we've got to have them building equipment.
00:53:35 [Speaker 2]
We've gotta get more equipment, you know, munitions completed.

00:53:39 [Speaker 2]
I think that was, while somewhat understandable, also very shortsighted from a national security standpoint.
00:53:47 [Speaker 2]
And, you know, it's kind of like, you know, you're going to pay the piper at some point.
00:53:52 [Speaker 2]
And, you know, if you're going to, you know, you know, prioritize short term gains of getting munitions out in the field, you're going to potentially lose the long term gain of national security by losing all of this data to our adversaries.
00:54:06 [Speaker 2]
So it's...
00:54:06 [Speaker 2]
You've gotta balance that.

00:54:07 [Speaker 2]
And I don't think that the balance was necessarily the right level of balance that was taken in the decision making process.
00:54:15 [Speaker 2]
That's my personal opinion on that.
00:54:16 [Speaker 2]
Yeah.
00:54:17 [Speaker 2]
Now as far as gridlock goes, if things go the way it looks like it's gonna go, you know, tomorrow, I believe that, the next two years are effectively going to be lost, if you will.
00:54:30 [Speaker 2]
We're going to do nothing.

00:54:31 [Speaker 2]
The senate is going to do nothing but have hearings for the next two years on anyone and everybody, that they can pull in front of a senate hearing, and any actual productive progress that was going to be made will absolutely be stopped.
00:54:43 [Speaker 2]
That's, again, my personal opinion.
00:54:45 [Speaker 2]
But there's just that much animosity right now in Washington that, you know, I just don't I just don't foresee anything positive happening over the next two years of this administration, if the senate goes the way that it looks like it's gonna go.
00:55:00 [Speaker 2]
And, you know, if the house goes as well, you know, it's game over for this administration from a productive standpoint, in my opinion.

00:55:07 [Speaker 1]
Yeah.
00:55:08 [Speaker 1]
Scott Scott Singer, your thoughts?
00:55:10 [Speaker 1]
You don't you don't you don't have to be political.
00:55:11 [Speaker 1]
Like, just my concern is the whole rearmament.
00:55:14 [Speaker 1]
Like, does this become a challenge for us to, you know, make sure we're ready to go, god forbid.

00:55:22 [Speaker 1]
I mean, you know, the...
00:55:24 [Speaker 1]
This is the best thing for China they've ever seen.
00:55:27 [Speaker 1]
Right?
00:55:27 [Speaker 1]
We're we're using all of our...
00:55:29 [Speaker 1]
We're we're in gridlock.

00:55:31 [Speaker 1]
We we...
00:55:31 [Speaker 1]
We're messing around with our, you know, with with what we're talking about here.
00:55:36 [Speaker 1]
And on on top of it, we're...
00:55:39 [Speaker 1]
Keep using our our our supplies.
00:55:41 [Speaker 1]
I mean, so so

00:55:44 [Speaker 4]
Yeah.
00:55:45 [Speaker 4]
I mean, it is a kind of a topic I don't wanna go too deep into, for obvious reasons.
00:55:50 [Speaker 4]
But, there were...
00:55:52 [Speaker 4]
There are mechanisms in place to step around some of these issues to keep small businesses in the supply chain.
00:56:00 [Speaker 4]
So there were...

00:56:02 [Speaker 4]
I mean, they...
00:56:02 [Speaker 4]
There are ways to do this.
00:56:05 [Speaker 4]
We have current laws and regulations that we can just go forward and implement while any of these hearings are happening.
00:56:14 [Speaker 4]
But let's get the supply chain secure, and let's make sure that we're making all the bullets.
00:56:20 [Speaker 4]
And is it butter and bullets, guns and bullets?

00:56:23 [Speaker 4]
I can't remember.

00:56:24 [Speaker 2]
Beans and bullets.

00:56:25 [Speaker 4]
Yeah.
00:56:25 [Speaker 4]
My old economics class.
00:56:27 [Speaker 4]
Right?
00:56:28 [Speaker 4]
But, you know, kidding aside, there's ways to keep all these things moving forward and still secure, you know, the DIB.
00:56:37 [Speaker 4]
And I think that's...

00:56:38 [Speaker 4]
We gotta not lose sight of that.

00:56:40 [Speaker 1]
Yeah.
00:56:40 [Speaker 1]
That that...
00:56:41 [Speaker 1]
That's good to hear.
00:56:42 [Speaker 1]
Jason?

00:56:43 [Speaker 5]
Scott, I I think that's one of the the biggest things that is so hard for the defense industrial base to stay on top of is the fact that these are all objects in motion.
00:56:50 [Speaker 5]
Right?
00:56:51 [Speaker 5]
Once once rule making commences on something, like, it sort of has a momentum of its own.
00:56:57 [Speaker 5]
And so a lot of these things don't completely stop or start based on today's sentiment or tomorrow's sentiment.
00:57:05 [Speaker 5]
And so there will be things that continue to creep up on you.

00:57:09 [Speaker 5]
You know, Scott, your team has done a great job of talking about the the pantheon of regulations that are headed our way on the topics of everything from cyber protections to cyber reporting to you name it, and those are all still cards in play.

00:57:24 [Speaker 1]
Jason, you're looking at, please.
00:57:26 [Speaker 1]
I

00:57:26 [Speaker 3]
think there's two things that that stand out to me when it comes to, the the cons...
00:57:32 [Speaker 3]
The the the other factors that maybe are are weighing on top of CMMC and maybe have pushed the CIO to to maybe say, say, hey.
00:57:39 [Speaker 3]
Maybe we do need to pause this.
00:57:41 [Speaker 3]
And and and and, you know, if if cost is an issue, and I think this gets into part two of my story, which is, you know, my goal is not to put out, hey.
00:57:51 [Speaker 3]
Here's the big problems everyone's complaining about Kirsten Davies and her her decisions.

00:57:56 [Speaker 3]
But...
00:57:57 [Speaker 3]
Okay.
00:57:57 [Speaker 3]
What are some of the actual...
00:57:59 [Speaker 3]
What can be done short term, medium term to start to fix this?
00:58:02 [Speaker 3]
And the RFI summary had its own set of recommendations from the task force, and they even laid out, here's stuff we could do right away.

00:58:08 [Speaker 3]
Here's stuff we need with some rulemaking.
00:58:10 [Speaker 3]
Here's stuff that's out of the CIO's control but could be done through, acquisition sustainment and others.
00:58:16 [Speaker 3]
And then I talked to some other folks.
00:58:18 [Speaker 3]
And if if cost was a big deal and they were worried about small business and pushing manufacturing and trying to get small businesses going, they could have gone to Congress earlier this year, add to the NDA or add to the probes bill, some sort of small business loan program, grant program, some way to offset those costs.
00:58:37 [Speaker 3]
There's plenty of people who've said, hey.

00:58:39 [Speaker 3]
You know, if if you're gonna...
00:58:41 [Speaker 3]
If if this is a major issue, there are ways to fix it without stopping the program.
00:58:47 [Speaker 3]
And and if you're saying, well, there's too much burden, Somebody pointed out to me and and and maybe Scott Edwards, and this is something you can maybe address as well.
00:58:55 [Speaker 3]
There are potential for waivers that the DOD CIO could sign off on certain contracts.
00:59:02 [Speaker 3]
Andrew, maybe you know more about this.

00:59:03 [Speaker 1]
No.
00:59:03 [Speaker 1]
It's just because Jacob Horn literally brought this up how many times, Scott.

00:59:07 [Speaker 2]
Oh, I

00:59:08 [Speaker 1]
don't know.
00:59:08 [Speaker 1]
Yeah.

00:59:08 [Speaker 2]
Yeah.
00:59:08 [Speaker 2]
For sure.

00:59:09 [Speaker 3]
So so so could she could she have just said, hey.
00:59:13 [Speaker 3]
We're finding that for this part of the industrial base, this is too much.
00:59:18 [Speaker 3]
So we're gonna waive this for these types of contracts.
00:59:20 [Speaker 3]
Scott, maybe jump in and talk a little bit about that waiver authority that I don't think she's used or Kate Arrington used or anybody else.
00:59:27 [Speaker 3]
And

00:59:28 [Speaker 1]
then, Scott, before you go, can we stay a little longer, everybody?
00:59:31 [Speaker 1]
Just a few more...
00:59:31 [Speaker 1]
Are you guys good?
00:59:32 [Speaker 1]
Scott, that's Sure.
00:59:33 [Speaker 1]
Good for a few extra and...

00:59:35 [Speaker 1]
Or...
00:59:35 [Speaker 1]
Okay.

00:59:36 [Speaker 2]
Yeah.
00:59:36 [Speaker 2]
Sure.

00:59:36 [Speaker 1]
Yeah.

00:59:36 [Speaker 3]
So, I

00:59:37 [Speaker 2]
mean, you know, from a waiver standpoint, yeah, that capability has always existed.
00:59:40 [Speaker 2]
Right?
00:59:41 [Speaker 2]
You know, I have, you know, she...
00:59:43 [Speaker 2]
You know, the CIO can, you know, could provide waivers for certain types of contracts or, you know, certain contract vehicles themselves.
00:59:51 [Speaker 2]
You know, the waiver authority is for an entire contract, not for a specific subcontractor on a on a contract.

00:59:57 [Speaker 2]
So, you know, there are some rules about how it can be done.
00:59:59 [Speaker 2]
But to my knowledge, I don't know that there's ever been a waiver issued.
01:00:03 [Speaker 2]
I mean, Ryan, Scott, maybe you've heard differently, but, you know, I...
01:00:07 [Speaker 2]
We've asked around trying to figure out if anybody's ever received or even asked for a waiver formally from the CIO.
01:00:13 [Speaker 2]
And I am not aware that anyone has ever asked nor been...

01:00:17 [Speaker 2]
One's been given.

01:00:18 [Speaker 4]
Scott, I think they've asked, at the contract level.
01:00:22 [Speaker 4]
There's been requests, and they've all been turned down because it's supposed to be at the program level.
01:00:28 [Speaker 4]
Right?
01:00:29 [Speaker 4]
It's supposed to be at the award program level, not at individual companies.

01:00:34 [Speaker 2]
Right.
01:00:34 [Speaker 2]
Right.
01:00:35 [Speaker 2]
Right.
01:00:35 [Speaker 2]
It has to be at the top level prime and everything down.
01:00:37 [Speaker 2]
Right?

01:00:38 [Speaker 5]
Yeah.
01:00:39 [Speaker 5]
But You have to look at how leverage that is.
01:00:41 [Speaker 5]
I mean, you have the people who are most likely to make those requests are the mega primes.
01:00:47 [Speaker 5]
And the the mega primes largely have been smiling and nodding saying, yes.
01:00:51 [Speaker 5]
We can meet these requirements.

01:00:52 [Speaker 5]
Yes.
01:00:53 [Speaker 5]
Our supply chain can meet these requirements all all throughout the solicitation process.
01:00:57 [Speaker 5]
So it's very hard to say, oh, also, 70% of our suppliers can't meet these requirements.
01:01:03 [Speaker 5]
Would you mind waiving them?
01:01:05 [Speaker 5]
Like, that's that's very...

01:01:07 [Speaker 5]
It's very hard to walk back on.
01:01:09 [Speaker 5]
And so to be a subcontractor, to be somewhere else in the supply chain and say, it's okay.
01:01:14 [Speaker 5]
Waivers are coming for me, is magical thinking.
01:01:18 [Speaker 5]
It happens at a unit of measure much larger than you.

01:01:22 [Speaker 4]
So one comment is that, you know, when I made a proposal and I...
01:01:27 [Speaker 4]
I've made a number of proposals to different folks on this subject, but it really requires, some rulemaking to get at the level of waivers that I think would really be necessary to make this work.
01:01:41 [Speaker 4]
And I think they should do that, to be honest.
01:01:44 [Speaker 4]
You you know, pause the program until they can rejigger 32 CFR part one seventy to make this work.
01:01:51 [Speaker 4]
It's right now just a little too rigid, and it doesn't give them enough flexibility from what I've read into this and some of the law firms I've hired to look at this and have read into this.

01:02:05 [Speaker 1]
Got it.
01:02:05 [Speaker 1]
How about, Scott, how about...
01:02:08 [Speaker 1]
Do do you have a question left maybe for Jason?
01:02:10 [Speaker 1]
I'll give one to Ryan, and we'll we'll wrap up if

01:02:14 [Speaker 4]
Yeah.
01:02:14 [Speaker 4]
Switch it over to Ryan.

01:02:16 [Speaker 1]
Yeah.
01:02:16 [Speaker 1]
I mean, sorry.
01:02:17 [Speaker 1]
How it is.
01:02:18 [Speaker 1]
But, Ryan, go ahead.
01:02:19 [Speaker 1]
Do you have it?

01:02:19 [Speaker 1]
Yeah.
01:02:20 [Speaker 1]
You wanna take one or two for Scott, and we can wrap things up?
01:02:24 [Speaker 1]
I'm sorry.
01:02:24 [Speaker 1]
For Jason.
01:02:25 [Speaker 1]
Got it, Jason.

01:02:26 [Speaker 3]
Or Scott.
01:02:27 [Speaker 3]
Yeah.

01:02:27 [Speaker 1]
Yeah.
01:02:28 [Speaker 1]
Scott Edwards.
01:02:29 [Speaker 1]
I'm sorry.
01:02:29 [Speaker 1]
I meant Scott Edward.
01:02:30 [Speaker 1]
I meant Scott Edwards and or

01:02:32 [Speaker 2]
So so so, Jason, you know, I'll ask I'll ask this one and then let Ryan wrap it up.
01:02:36 [Speaker 2]
But, you know, with...
01:02:38 [Speaker 2]
Did you get any feedback from any of your sources on how, the CIO was going to, you know, align the brilliant at the basics push with the existing eight hundred one seventy one requirement set.
01:02:52 [Speaker 2]
Is there gonna be...
01:02:52 [Speaker 2]
Were they looking to do some kind of migration?

01:02:54 [Speaker 2]
Is this an overlay on top of?
01:02:56 [Speaker 2]
Did you get any feedback on anything like that?

01:02:59 [Speaker 3]
I I didn't at all.
01:03:00 [Speaker 3]
And, you know, part of my questions to the DOD CIO's office was asking about, Brent, the basics and the concerns I'd heard about the cost of what it would take to implement where you wanna reduce cost because CMMC was too expensive, but then you put this out and say, hey.
01:03:14 [Speaker 3]
Here's what you should be doing, and that potentially could cost as well.
01:03:18 [Speaker 3]
But, no, I have no inclination or no no knowledge about how the two could be merged, integrated, overlap at all.
01:03:25 [Speaker 3]
Well I think...

01:03:27 [Speaker 3]
Go ahead.

01:03:27 [Speaker 2]
Well, I was just gonna say, I mean, if you look at Brilliant at the basics and you kinda line them up and, Scott, you said you've done a little bit of this at work as well, but it almost is like Brilliant at the basics are almost enhancements to existing eight hundred one seventy one controls, which makes it look a lot like eight hundred one seventy two, which is what CMMC level three was based on.
01:03:45 [Speaker 2]
Right?
01:03:45 [Speaker 2]
And so, you know, it it kinda feels like what they were trying to do with Brilliant at the Basics is really uplevel one seventy one to get beyond some of the baseline, you know, confidentiality controls to bring in the the resiliency aspect, if you will, that that she talked about, you know, pretty early on in July.
01:04:01 [Speaker 2]
So, Scott, you...
01:04:03 [Speaker 2]
Did you...

01:04:03 [Speaker 2]
Do you, you know, agree with that?
01:04:04 [Speaker 2]
Or...

01:04:06 [Speaker 4]
Oh, I agree a 100%.
01:04:09 [Speaker 4]
But, you know, going back, there's a lot of the 10, and then, obviously, the OT is something that's, you know...
01:04:16 [Speaker 4]
I I agree with her on OT that needs to be dealt with, and we've already talked about that.
01:04:23 [Speaker 4]
But a lot of the one seventy one maps, okay, and then you pull into one seventy two and more maps, and then you pull in one seventy three...
01:04:33 [Speaker 4]
I'm not...

01:04:34 [Speaker 4]
One seventy three.
01:04:35 [Speaker 4]
Rev three.
01:04:37 [Speaker 4]
I'm not a computer.
01:04:40 [Speaker 4]
When you pull into Rev three, then even more maps.
01:04:43 [Speaker 4]
Right?

01:04:43 [Speaker 4]
And then when you say, okay.
01:04:46 [Speaker 4]
You look at this, and there's things that are above and beyond.
01:04:50 [Speaker 4]
Right?
01:04:50 [Speaker 4]
Any of those frameworks.
01:04:51 [Speaker 4]
And I've been out looking for where to find them, and it's just, you know, you pull from a bunch of different places.

01:04:57 [Speaker 4]
So, but a lot of it's covered, honestly, in even the basics that we're doing right now or at least partially the way there.

01:05:08 [Speaker 1]
So, Ryan, over to you.
01:05:10 [Speaker 1]
As as I just...
01:05:11 [Speaker 1]
Scott Edwards, you know, because you started CS five.
01:05:14 [Speaker 1]
I thought Sean just said something interesting, which was, you know, no government folks at CS five.
01:05:20 [Speaker 1]
Very telling.

01:05:21 [Speaker 1]
Do you read into that at all as well?

01:05:23 [Speaker 2]
Yeah.
01:05:23 [Speaker 2]
That was that was super disappointing given the amount of, the lack of information coming out of the CIO's office, not having anybody from from DOD at c s five where you have almost a thousand people, both defense contractors as well as those trying to help the defense contractors, you know, talking about these topics and did not have anybody there from the CIO's office or DOD in general was super, you know, frustrating.
01:05:52 [Speaker 2]
I hated to see that.
01:05:53 [Speaker 2]
I think it was a really big missed opportunity, for, for the CIO's office to really engage and, you know, both give information, but also hear from the industry as a whole.

01:06:04 [Speaker 1]
Yeah.
01:06:04 [Speaker 1]
Fair.

01:06:05 [Speaker 3]
Andrew, I'll just say one thing, and and this is actually more for, this is much for the folks in industry as for DOD.
01:06:14 [Speaker 3]
One of the things I always tell folks, and this is very selfish, so I'll get in front of it so you don't accuse me of just being self, grandiose selfish.
01:06:23 [Speaker 3]
When there's bad news stories come out, the the the thing I always say from a journalist perspective is the more you do to get in front of the bad news, the better you'll be.
01:06:31 [Speaker 3]
Because because as a journalist, we're looking to try to tell the best stories.
01:06:35 [Speaker 3]
And a lot of people love to say, well, there's a liberal bias or you're you're just trying to create problems.

01:06:40 [Speaker 3]
And and while I can't speak for every journalist, I know that most of them that I've met are just trying to tell good stories and try to get both sides out.
01:06:49 [Speaker 3]
And when you crawl up in a ball and hope it goes away, the story doesn't gonna go away.
01:06:53 [Speaker 3]
And when you don't talk about things and you don't comment, that just leads to more problems.
01:06:59 [Speaker 3]
So, Scott, if you ever get a bad story, at Summit seven or or or or control case, get in front of it even if your lawyers tell you not to.

01:07:10 [Speaker 1]
Well, Jason, there's thing.

01:07:11 [Speaker 3]
Go ahead.

01:07:12 [Speaker 1]
I'm glad you said this.
01:07:13 [Speaker 1]
Look.
01:07:13 [Speaker 1]
We talk a lot about this on the cyber call, a lot of our conference, and and we see what good comms and bad comms from incidents, you know, incident response teams.
01:07:24 [Speaker 1]
Right?
01:07:25 [Speaker 1]
You see this day in and day out.

01:07:27 [Speaker 1]
You see a stellar examples from companies like CloudFlare whenever they have an incident.
01:07:33 [Speaker 1]
And then there's your others who...
01:07:37 [Speaker 1]
To your point, Jason, you're seeing media, you know, control the narrative.
01:07:44 [Speaker 1]
Other large differ firms control the narrative.
01:07:47 [Speaker 1]
So I I could...

01:07:48 [Speaker 1]
I think your point is absolutely perfectly valid.

01:07:52 [Speaker 3]
And and I think just the last bit of it is I think what's happening now is DOD could be controlling the narrative with CMMC.
01:07:59 [Speaker 3]
They could be getting in front of the the...
01:08:01 [Speaker 3]
But not just my story, but talking to you all to alleviate concerns to understand, and and they're not.
01:08:06 [Speaker 3]
And and why it's government...
01:08:08 [Speaker 3]
Listen.

01:08:08 [Speaker 3]
They're not alone.
01:08:09 [Speaker 3]
A lot of agencies don't let...
01:08:10 [Speaker 3]
Feel comfortable getting in front of the narrative.
01:08:13 [Speaker 3]
And then people people and and Republican, Democrat, doesn't matter, complain that they get treated poorly by the media.
01:08:20 [Speaker 3]
And part of that happens because you...

01:08:23 [Speaker 3]
You're letting other people control the narrative.
01:08:26 [Speaker 3]
And and I I do my best to make sure people know that, like, listen.
01:08:30 [Speaker 3]
I wrote 6,000 words, a solid 3,000 words of quoting DOD's own document, not quoting sources, not quoting unnamed sources, which, listen, none of us wanna use, but we get...
01:08:41 [Speaker 3]
If you wanna write a story with knowledgeable topics, you need to do that sometimes.
01:08:45 [Speaker 3]
You wish everybody would go on the record, but people are afraid.

01:08:48 [Speaker 3]
People are more afraid than ever to put their names out there.
01:08:50 [Speaker 3]
And so so I would just offer this that that if you're not in front of it, you're gonna be behind it.
01:08:57 [Speaker 3]
So so do your best to get in front of it, and the lawyers will always tell you not to.
01:09:00 [Speaker 3]
And I'm not a lawyer, but I I would tell you that they're always gonna be more cautious than than you need to be sometimes.
01:09:08 [Speaker 3]
And and even if DOD would have given me a long paragraph that said how important CMMC is and they're gonna make better changes, even if they never answered any of my questions and attributed, something like that would have been better than just nothing at all.

01:09:21 [Speaker 3]
And and I would tell you the same thing for any of your companies, anything that you're you're working on.

01:09:26 [Speaker 1]
Person.

01:09:26 [Speaker 5]
I I think it's safe to say that we would all rather be here right now talking about the implications of actual decisions

01:09:36 [Speaker 2]
Mhmm.

01:09:36 [Speaker 5]
That had been made and communicated so that then we can prepare everyone we know for the trajectory that we're now on.
01:09:43 [Speaker 5]
Right?
01:09:44 [Speaker 5]
And in lieu of that, in the lack of communication, now we are looking to sift through the vacuum and try to understand which way this cookie could crumble.
01:09:53 [Speaker 5]
So maybe one...
01:09:55 [Speaker 5]
Like, just last question that I would have for for you, Jason.

01:09:59 [Speaker 5]
You you sent over, I think you said, 15 questions to the CIO's office to have answered.
01:10:05 [Speaker 5]
Like, is there is there one question on that list that you think if it had been answered would clear up some of the confusion that we've talked about today?

01:10:15 [Speaker 3]
I think the one thing that I would really have appreciated knowing is is how Kirsten Davies learned about the program itself.
01:10:25 [Speaker 3]
I would have loved to get in her feedback for, you know, the the accusations that she only spent twenty minutes with the PMO, and she's done no other meetings with, she's she's really limited her time with industry.
01:10:37 [Speaker 3]
I would have loved for her just to tell me either, a, that was incorrect, and I spent...
01:10:42 [Speaker 3]
I had multiple meetings with the PMO.
01:10:43 [Speaker 3]
The...

01:10:43 [Speaker 3]
Whoever you're talking to just didn't talk to...
01:10:46 [Speaker 3]
Wasn't a part of them, and they're they're they're grumpy about it.
01:10:48 [Speaker 3]
Right?
01:10:49 [Speaker 3]
That would have given me...
01:10:50 [Speaker 3]
I probably would not have used that that end goat because I would have had her saying that's not true.

01:10:55 [Speaker 3]
Second, I would have loved her to say, hey.
01:10:58 [Speaker 3]
Just because I didn't meet with, no offense, Scott, summit seven, I did meet with 14 other industry on these days and times, and I've learned about it.
01:11:05 [Speaker 3]
And I don't like Scott, so I didn't meet with them.
01:11:07 [Speaker 3]
I mean, she didn't have to say that, but you get my point.
01:11:09 [Speaker 3]
Like, she could have made her case a little stronger to say how she has got up to the point in July to...

01:11:16 [Speaker 3]
That she made a recommendation to the undersecretary for acquisition sustainment to eventually make a decision to put a pause on CMMC.
01:11:24 [Speaker 3]
But because there's none of that, you're left with more conjecture, and then you're left with a lot of people going, this is what I believe to be true based on my experience, based on her actions, based on what I've heard from inside the Pentagon, and all of these things that lead up to to this word today.
01:11:40 [Speaker 3]
And I think that...
01:11:41 [Speaker 3]
That's the missing piece of of the questions.
01:11:44 [Speaker 3]
I mean, yeah, there's a bunch of other questions too, but her lack of transparency, for lack of a better word, about what she did.

01:11:55 [Speaker 3]
Maybe she doesn't owe it to me, and and she...
01:11:57 [Speaker 3]
But she does owe it to the community at large.
01:11:59 [Speaker 3]
I mean, you all have spent a lot of time, a lot of money, a lot of resources.
01:12:03 [Speaker 3]
Put your trust in the DOD, not just her, but the DOD to say, this is important to them, so this is now important to us.
01:12:12 [Speaker 3]
That...

01:12:12 [Speaker 3]
That's...
01:12:13 [Speaker 3]
And and and I think that that's why we're talking about this so much now.
01:12:16 [Speaker 3]
And I think that's why I I...
01:12:17 [Speaker 3]
You know, I I'm I'm pleased that my story resonated with so many people, even the people who thought my story sucked.
01:12:22 [Speaker 3]
Right?

01:12:22 [Speaker 3]
You know?
01:12:23 [Speaker 3]
There's some resignation going on.

01:12:26 [Speaker 1]
It it didn't suck whatsoever, Jason, and I'm I'm very grateful for you, coming on sharing north of an hour with us.
01:12:33 [Speaker 1]
I hope this is, you know, a relationship we can continue to build on, have it right a boom if you'd like.
01:12:39 [Speaker 1]
But in general, you know, bring you closer to the people like Scott Edwards, Scott Singer, Ryan Bonner, Jacob Horn.
01:12:46 [Speaker 1]
Hope all is well with him.
01:12:47 [Speaker 1]
But really appreciate you, you you lending your time to us.

01:12:51 [Speaker 1]
It was it was really insightful.
01:12:53 [Speaker 1]
Grateful for people like you that aren't afraid to share really what's going on.
01:12:58 [Speaker 1]
So thank you for that.

01:12:59 [Speaker 5]
Well, no.
01:13:00 [Speaker 5]
Thank you

01:13:00 [Speaker 3]
for having me.
01:13:01 [Speaker 3]
It's always nice.
01:13:01 [Speaker 3]
It's nice to be on the other side of the microphone once in a great while answering the questions they've always asking them, but, I appreciate it.
01:13:08 [Speaker 3]
It's good to to meet everyone.

01:13:09 [Speaker 1]
Yeah.
01:13:10 [Speaker 1]
Likewise.
01:13:11 [Speaker 1]
Scott, Scott, Ryan, everybody out there, thanks for staying late.
01:13:15 [Speaker 1]
Wishing you guys all a safe week.
01:13:16 [Speaker 1]
Take care.

01:13:17 [Speaker 2]
Thank you.

01:13:18 [Speaker 1]
Thanks, guys.
01:13:18 [Speaker 1]
Bye.