How to Climb Mount CMMC (for MSPs and SMBs)

[00:00:00] Hello Climbers and welcome back to Climbing Mount CMMC.

[00:00:05] Hello Climbers, my name is Kaylee and this is Bobby and today we are going to be talking about one mountain of the two mountain process of CMMC for MSPs.

[00:00:24] Now I'm talking about MSPs specifically, we're going to be discussing MSPs specifically today, but I do believe that two groups could get something out of this.

[00:00:34] One, a group that is an MSP themselves and two, somebody who has an MSP that is a contractor in the Dib space.

[00:00:43] So yeah, and you know, this mountain one is it's very similar to anyone who's going to be climbing it.

[00:00:49] So, you know, because it's just about focusing on getting yourself ready, right?

[00:00:53] Exactly.

[00:00:54] We're just having a slant on it based on MSPs, but it's still very relevant to an OSC who's going to be going, you know,

[00:01:02] organizations seeking certification.

[00:01:04] So going for a level two, you know, those it definitely is very relevant to them.

[00:01:10] But, you know, just we're going to have a little bit more of a spin specifically about how it relates to MSPs.

[00:01:16] Right.

[00:01:17] So let's talk about this, this view that we're trying to give you guys.

[00:01:21] We do really believe as an MSP that we are climbing two mountains.

[00:01:26] The first mountain is ourselves.

[00:01:29] Getting ourselves as an MSP ready for a level two certification and CMMC compliance, truly.

[00:01:38] Then the next mountain is now docking on to our clients and then becoming, you know, basically this helper throughout the entire walk up the mountain and through the assessment for your client.

[00:01:55] Now, this is when, you know, maybe some other MSPs might be talking a little bit different than we do.

[00:02:02] But this is just our perspective on we believe we really want to help the client through this entire thing.

[00:02:07] But again, you might be hearing some different perspectives from other people.

[00:02:11] We've surely heard a lot of different perspectives.

[00:02:14] What do we say, Kaylee?

[00:02:15] What are we not?

[00:02:16] We're not what?

[00:02:18] What do we claim we're not?

[00:02:19] Oh, we are not CMMC Jesus.

[00:02:24] We are not.

[00:02:25] I am not putting the hand on the CMMC Bible for this one.

[00:02:29] But I'm sorry to interrupt you, but there are two really important concerns that I think people need to take into consideration, especially with the 32 CFR rule that's now finalized and is going to be kicking into effect.

[00:02:42] At the time of this recording, it's next month.

[00:02:45] So it's less than 30 days away that we're going to be like, you know, happy certification new year.

[00:02:52] You know, it's like a whole new world.

[00:02:55] Now, yes, MSPs do not technically have to get certified.

[00:02:58] So, Bobby, why are you focusing specifically on then getting certified?

[00:03:02] Well, let me ask you this.

[00:03:03] If you had your kids and they were getting on a plane, would you want someone who is not certified to work on that plane or someone that is certified to work on that plane?

[00:03:11] Kaylee, you have a beautiful daughter and I have a granddaughter.

[00:03:14] Yeah.

[00:03:15] What's the answer?

[00:03:16] Yeah, that person's going to be certified for sure.

[00:03:18] Maybe even double or triple.

[00:03:20] Yeah.

[00:03:20] Can you add some more certifications?

[00:03:22] Yeah, add some more.

[00:03:23] This is these people's livelihoods.

[00:03:26] Like, do you really want to dabble in that without being certified in what you're doing?

[00:03:29] It just doesn't really make sense when you look at it that way.

[00:03:32] So to me, like I couldn't imagine not being level two certified before I participated in the ecosystem because I feel like it's required.

[00:03:38] Yeah, I love it.

[00:03:39] And the other thing is we're also a key part that we want to emphasize is when you're getting ready to be certified yourself, you want to have a very focused look at how you're going to engage your clients.

[00:03:54] You don't want to build like this little teeny box over here so you can get your certification, right?

[00:03:59] So kind of like how sometimes people kind of game the system when it comes to SOC certification level twos.

[00:04:04] You know, you don't want to get this little teeny thimble.

[00:04:07] You want your whole system that you're going to be supporting your clients assessed because then you want to leverage that as you're supporting your clients.

[00:04:14] And that will help them on their journey and they'll appreciate that.

[00:04:17] So pay attention when you're doing that.

[00:04:18] And that's what we're talking about doing it that way.

[00:04:21] Now, that's not the only way.

[00:04:22] You can do it a lot of different ways.

[00:04:24] And like I said, we're not CMMC Jesus.

[00:04:26] So choose your own path.

[00:04:27] Yeah, that's right.

[00:04:28] Okay, so let's get into this.

[00:04:30] I'm excited.

[00:04:31] We've got 12 points along this first mountain.

[00:04:34] And yes, we are still only talking about the first mountain.

[00:04:37] And yes, there are 12 points.

[00:04:39] So let's go through them.

[00:04:40] Okay, first, we are, you know, where we've just entered into the park.

[00:04:45] We see the mountain ahead of us and we have a trail, right?

[00:04:50] There is left where we're saying just commercial clients and keep with what we have.

[00:04:54] And then we've got right that says step into the CMMC universe and walk this treacherous

[00:05:00] battle uphill.

[00:05:01] I can see it in my head.

[00:05:03] This is great visualization.

[00:05:04] I love it.

[00:05:04] Great.

[00:05:05] Okay.

[00:05:05] So it is question one.

[00:05:08] Do I even want to do this in the first place?

[00:05:11] It might sound stupid, but like, hello, you've got to ask yourself that because you are doing

[00:05:17] your customers or your clients that are in this space, in the dib space that are contractors.

[00:05:22] You're doing them a huge disservice.

[00:05:24] If you cannot make up your mind, but you're still an MSP for them because they actually need

[00:05:30] an MSP that's going to be able to climb this or has already climbed this before.

[00:05:35] So when you are stalling like this with this decision, you're also really not helping your

[00:05:40] clients that are in that space.

[00:05:42] So it's so important for you guys to make this decision as an MSP.

[00:05:47] Early, as early as possible.

[00:05:48] We're getting emails daily from people that are like, hey, my MSP finally told me that

[00:05:54] they're not going to do it.

[00:05:55] You know, could you help us?

[00:05:57] And, you know, we're like, sure, bring it on.

[00:05:59] We want to be a part of that.

[00:06:01] But I mean, those people should be applauded.

[00:06:03] You know, it's coming into the 11th hour here, you know, it would have been better if

[00:06:07] they would have a little more time to do this because now it's on crunch time because

[00:06:10] they, you know, contract requirements could be dropping as early as next, early next year,

[00:06:14] Q1, Q2, Q3, depending on where they fall in the ecosystem.

[00:06:19] So they're going to be under a pinch and anyone that waits later.

[00:06:23] And I don't know about you, but if you have a contract agreement with that client and,

[00:06:28] you know, you might need to start having conversations with them about how they, they want to do that

[00:06:32] and make some decisions.

[00:06:32] And if you're not sure if you're MSP and you're like, what am I looking down the barrel?

[00:06:35] I listened to your podcast, Bobby.

[00:06:37] I'm not sure if I want to do it.

[00:06:38] Reach out to us.

[00:06:39] We want to help you.

[00:06:40] We want to, I mean, we've been there.

[00:06:42] We did it.

[00:06:42] You know, we've climbed the mountains and, you know, if you're not sure if you want to

[00:06:47] do it, hey, this ecosystem is huge.

[00:06:49] We are open book, just like we are on the podcast.

[00:06:52] We share.

[00:06:53] And of course, you know, Brian Hubbard's MSP CyberX is also a great place to connect with

[00:06:58] a lot of other organizations that are doing the same thing as we are.

[00:07:01] Right.

[00:07:02] So once you have made the decision and you have decided to move forward on the CMMC mountain,

[00:07:09] you now, okay, I'm keeping with the visuals here.

[00:07:12] Here we go.

[00:07:13] I'm going full podcast mode with the visual story.

[00:07:17] Okay.

[00:07:17] Let's pretend like your leadership are like tied to your waist with a rope and they are

[00:07:25] rocks behind you.

[00:07:27] Okay.

[00:07:28] Now, if you do not have the leadership buy-in, those rocks are going to be quite heavy or

[00:07:37] you could put them on like a nice little wagon and pull them along with you.

[00:07:42] Okay.

[00:07:43] Doesn't sound exciting either.

[00:07:44] It's a little easier, but not great.

[00:07:47] And I kind of, it was thinking of explaining it this way because it's still not going to

[00:07:53] be easy to implement this throughout your organization, but to have leadership buy-in is critical.

[00:08:00] I cannot imagine doing this without it.

[00:08:03] And there are a lot of people in other organizations that are kind of scratching their heads going,

[00:08:07] I don't think I can pull this off here.

[00:08:09] Yeah.

[00:08:09] You know, you, you absolutely need leadership buy-in if you're the intern or you've only

[00:08:13] been there for a few years that you have no chance.

[00:08:15] If you're an intern and you're doing this right now and trying to do this for a whole

[00:08:19] tiny client right now, like, and you're listening to us, run.

[00:08:23] Run.

[00:08:24] This is so scary.

[00:08:27] Yeah.

[00:08:27] That's, I couldn't imagine doing that.

[00:08:29] You want the, the, the, you want the leadership cheering you on.

[00:08:32] You want them ahead of you.

[00:08:33] They should be the first people to sign up for the tabletop exercises and the training.

[00:08:38] You know, they shouldn't be like, Oh, why do I have to do this?

[00:08:40] Like they, they gotta be like, Oh, this is, this is going to get us where we need

[00:08:43] to be, you know, like they gotta be sold out for this because it is not an easy task

[00:08:48] to do.

[00:08:49] So if you don't have leadership buy-in, it ain't going to be fun.

[00:08:52] Exactly.

[00:08:54] So now let's talk, let's talk about just a little bit, just a little teeny bit about

[00:08:59] the cost of this thing.

[00:09:01] Right.

[00:09:01] Right.

[00:09:02] So, um, the third point is, are you sitting on at least $250,000?

[00:09:09] Now that is not a small number.

[00:09:12] Well, sorry for some MSPs, maybe that is a smaller number, but for us, we are not big

[00:09:18] and that is not a small number.

[00:09:21] So yeah.

[00:09:22] Let's talk about that.

[00:09:23] Contents, uh, context on that.

[00:09:25] Okay.

[00:09:25] Uh, I, when we were at Seek East, which was awesome, I had, I had such a great time at

[00:09:29] the conference.

[00:09:30] Um, you know, I, I'd kind of shared that several times with MSPs and they kind of were

[00:09:34] like, well, you know, like, what do you mean?

[00:09:36] Is it really that much?

[00:09:37] It's not a CapEx one-time stroke a check.

[00:09:40] That's how much it's going to be.

[00:09:41] But when you start looking at that, you've got specific resources that that's pretty much

[00:09:46] all they're going to be doing for a considerable amount of time as you try to get that done.

[00:09:49] So that's that person's salary that gets allocated towards that.

[00:09:52] You've got licenses you have to pay for.

[00:09:54] You have training because there's, and you know, unless you were in the matrix and could just

[00:09:58] jack right in the back of your head and somehow download everything magically, you're going

[00:10:02] to have to go to CCP or you have to go to other types of training.

[00:10:05] All this stuff adds up.

[00:10:06] You know, you, the contracts for CMMC, it better be different because the, you know, assessors

[00:10:14] are going to be looking at your contracts and your contracts have to appropriately reference

[00:10:16] to your shared responsibility matrix.

[00:10:19] Right.

[00:10:19] So you go into attorney to get this stuff written up specifically to help address these

[00:10:23] challenges.

[00:10:24] Um, if you're not, I, it's not something I would recommend.

[00:10:28] I mean, I'm not saying you can't, but you know, and then that just, it just, there's

[00:10:33] so many ways that you sort of get hit by costs that has to deal with CMMC.

[00:10:38] Also, you know, for us, we went into a massive dry spell of new clients because of the fact

[00:10:44] that our focus was so directed towards CMMC.

[00:10:48] We lost our average peak of a return on our pipeline, right?

[00:10:51] Just because of the fact that we were changing directions so heavily over the course of the last

[00:10:56] year and a half towards CMMC, we, you know, we had a significant revenue dip because of

[00:11:00] the fact that we were focusing that way.

[00:11:02] So, you know, every MSP is different in how they engage it.

[00:11:05] You know, we're a 15 person company.

[00:11:06] We're not that large.

[00:11:07] So that was a big punch in the face for us.

[00:11:09] Um, and that, that's just keeping it real.

[00:11:12] Like, I'm not saying you're going to spend 250, but if you don't have at least something

[00:11:16] close to that dollar amount in your bank, um, it could get really tight for you.

[00:11:21] And what you don't want to do is, is get halfway into the woods and go, this ain't working and

[00:11:25] then run halfway back.

[00:11:27] You know, that's just, that's your, you've lost both ways at that point.

[00:11:30] Exactly.

[00:11:31] So you really want to have enough cash that you can easily make it through that whole

[00:11:34] situation.

[00:11:35] And you're not having to worry about how you're going to handle it because it's going to hit

[00:11:39] your bottom line.

[00:11:40] Uh, and do not, do not do the, uh, marriage counseling for CMMC that I see so many MSPs.

[00:11:47] What is that?

[00:11:49] What is that?

[00:11:50] We have not brought that up in so long.

[00:11:53] Wow.

[00:11:53] Yes.

[00:11:54] So you always would talk about the marriage counseling where you guys are holding hand in

[00:11:59] hand, going together, walking through the woods together, hoping that you'll do it at the same

[00:12:05] time, both hand in hand.

[00:12:07] Yeah.

[00:12:07] It's like, I'm going to hire, you know, I'm going to get one or two clients and we're

[00:12:10] just going to figure this out together.

[00:12:11] We'll figure it all out together.

[00:12:12] And the problem with that mentality is, is now you have aligned your system and what

[00:12:17] you've got to those clients, not to a system that you want to have a whole bunch of clients

[00:12:22] assigned to.

[00:12:23] If you're MSP, the way this thing works is you're going to have to have, you know, more

[00:12:27] than a few companies that you're doing MSP engagements for CMMC.

[00:12:31] And that's really hard.

[00:12:32] You've got to have a system that is willing and ready to engage them where they're at and

[00:12:37] it can do it at scale.

[00:12:38] So, you know, doing that whole marriage counseling thing and we'll just sort of figure it out.

[00:12:42] It just doesn't really work.

[00:12:44] I've not seen a successfully an MSP pull that off yet.

[00:12:48] I've seen numerous times where they've tried that MSP looks at it and goes, man, they get

[00:12:52] about three quarters of the way through and go, this is way too hard.

[00:12:54] And they just exit.

[00:12:55] And then the client's like, now what do I do?

[00:12:57] Yeah.

[00:12:58] So don't do that.

[00:12:59] Don't do that.

[00:13:00] So I, okay, I like to think of the, the money aspect of this, you know, having a good,

[00:13:08] you know, good amount saved up to, to climb a mountain like this.

[00:13:12] I see that as like the equipment, like having good shoes, having a good backpack and, you

[00:13:19] know, climbing up this mountain with, you know, really good equipment on you.

[00:13:24] And then the next part, then before we do that, I just want to, you know, if the CEOs

[00:13:29] and other leaders and they listen to that and go, well, that's it.

[00:13:31] I'm done.

[00:13:31] I'm finished.

[00:13:32] All right.

[00:13:32] Let me just be here a little bit behind the curtain here for you.

[00:13:35] You can anticipate 2.5 to 3.5 additional revenue return for clients that are doing CMMC

[00:13:44] because the work is so much harder.

[00:13:45] It requires more certified people.

[00:13:47] I mean, your contract, you know, general high watermark goes up exponentially.

[00:13:54] Oh, true.

[00:13:54] Yeah.

[00:13:55] Great point.

[00:13:55] And, and also it's much easier to differentiate yourself in the crowd when you have the level

[00:14:00] two certification.

[00:14:00] So yes, it's very expensive, but the return is substantially worth it from our experience.

[00:14:06] Now, he's the same.

[00:14:08] I just want to say that.

[00:14:09] And, and, and we're charging fairly, you know, there are organizations that are considerably

[00:14:14] larger than us that charge a lot more money and have a lot more cost involved than we do.

[00:14:19] And so I just, I just wanted you to realize it's definitely worth that, but you, you want

[00:14:23] to make sure you have that debate when you, when you go to take it when we're going to,

[00:14:26] we'll talk about that later in, in season three about it in much more detail.

[00:14:31] Yes.

[00:14:32] Yeah.

[00:14:32] That's great.

[00:14:33] Yeah.

[00:14:33] I'm so glad you said that.

[00:14:34] So like I was saying before, so if the, you know, the money and prepping like financially

[00:14:41] for it is the you know,

[00:14:44] the, uh, what did I call the equipment?

[00:14:48] Yeah.

[00:14:48] So like your backpack and your shoes, then the backpacks and shoes, but yeah, I get it.

[00:14:54] Really freaking expensive.

[00:14:57] Maybe you've got a really, maybe you've got a really cute hat or something.

[00:15:02] I don't know.

[00:15:03] Colossians.

[00:15:03] I don't know.

[00:15:04] So, okay.

[00:15:04] What about, what about the tools now?

[00:15:07] The tools inside your belt or inside your backpack that you're going to use along the

[00:15:12] climb.

[00:15:13] This is where I feel like the next point, point four is going into this part of it, which

[00:15:20] is like invest in learning, like teaching, you know, teaching people on your staff, whoever

[00:15:26] is going to be like mostly in charge of this yourself, like train, um, you know, go to CCP

[00:15:32] courses, get a, get a CCP certification, um, get a CCA.

[00:15:37] Right.

[00:15:38] So like things like that to prepare yourself, um, for this climb and help you, that will

[00:15:45] help you along the path, um, as you're going up the mountain.

[00:15:49] Right.

[00:15:50] Be involved in peer groups.

[00:15:51] Come to college.

[00:15:51] Yeah.

[00:15:52] Peer.

[00:15:52] Right.

[00:15:53] You know, I've seen MSPs that like out of nowhere, like I've never even heard of them.

[00:15:59] Like, yeah, yeah.

[00:15:59] We're really close.

[00:16:00] And you're like, what the, like, we're, I haven't seen you anywhere.

[00:16:04] I mean, it's not that that's bad, but like, it's much harder if you don't have an opportunity

[00:16:08] to talk with other people in the industry.

[00:16:10] And, you know, to be honest with you, I mean, a lot of us share very freely, uh, just because

[00:16:15] we're, we're rooting for everybody, you know?

[00:16:17] So, so definitely get engaged, not, not just get the certifications, which I wholly agree.

[00:16:23] You absolutely need to have at least a CCP or CCA, but also talk with your peers.

[00:16:27] It's very helpful.

[00:16:28] Yeah.

[00:16:30] So what if you were going along this journey and you had a map, right.

[00:16:37] That took you along the road, but you couldn't really read it that well.

[00:16:42] You needed help reading it.

[00:16:44] You were a bit lost on the path.

[00:16:46] Wouldn't a park ranger who came on just alongside you.

[00:16:50] I didn't know where you were going with that.

[00:16:53] Do you see where I'm going now?

[00:16:55] Yeah, keep going.

[00:16:55] To help you along the path of this mountain.

[00:16:59] And you know what?

[00:17:01] A consultant, um, somebody who can come alongside you and help you up.

[00:17:05] That would be great during this time of the journey to be able to tell you, tell you what

[00:17:10] tools that you can use and you can't, maybe some that you can't use, um, the scoping, um,

[00:17:16] of your company.

[00:17:17] What is in scope?

[00:17:18] What is not in scope?

[00:17:20] You know, that, that can be quite a difficult process.

[00:17:23] And if you get that wrong, that will be very frustrating to go back and change in your

[00:17:29] documentation process.

[00:17:30] So maybe just maybe talk with a park ranger before you go way too far down the wrong path.

[00:17:37] It's a bad day when you find that out.

[00:17:39] And it's similar to like, if you're doing construction, you want that engineer who's

[00:17:42] going to sample the soil.

[00:17:43] Who's going to look at that and go, uh, there's a sinkhole there.

[00:17:46] You got a problem.

[00:17:46] You know, that is a bad, bad day when you're like, you know, in your, you know, your, your

[00:17:52] boxers sitting down to watch, you know, NFL on Monday night.

[00:17:56] And then all of a sudden your whole living room falls into a hole.

[00:17:59] It's a bad day.

[00:18:00] You know?

[00:18:00] So you, you really want to talk with, uh, I, I recommend right now, C3 PAOs that have

[00:18:08] gone through GSVAs that have actually seen it.

[00:18:10] Now mileage will vary, you know, once this ecosystem really starts getting kicked off

[00:18:16] people that are just CCAs and others that haven't participated in those, you'll start

[00:18:20] to see more maturity as more people have gone through their own audits and those types of

[00:18:24] things.

[00:18:25] But that's a good rule of thumb.

[00:18:27] You want to talk with organizations that have at least gone through several GSVAs and they

[00:18:32] understand more about the scoping and they've literally been through that journey and they

[00:18:36] can work a lot closer with you on how to do that.

[00:18:38] I can't recommend that enough.

[00:18:40] Not saying you can't do it on your own because I've seen other people do it successfully.

[00:18:43] It's just not something we felt comfortable on our own doing.

[00:18:46] So we actually engaged with a C3PO.

[00:18:48] We used Curie systems and they were awesome.

[00:18:50] Then we actually invested and talked with some other CCAs and that we had friends and

[00:18:55] we just showed them what was going on and got their input because again, that, that

[00:18:59] scoping design is what you build off of.

[00:19:02] And if you get that wrong, you can't fix that overnight.

[00:19:04] You can change a policy, but you can't change your design, you know, overnight you're

[00:19:09] screwed if you got that wrong.

[00:19:10] Right now, although I mean, I'm sure many of you guys who are listening to this know this,

[00:19:15] but you can't once you get, you know, that C3PO to help you with the scoping process or

[00:19:21] whatever it may be, they cannot do the assessment itself for you.

[00:19:25] But it's still critical to have that person.

[00:19:28] So it doesn't mean just because they can't help you or just because they can't do the

[00:19:32] assessment for you doesn't mean that you shouldn't get somebody else's help.

[00:19:36] So, you know, maybe look at one C3PO to do your assessment and another person to help

[00:19:41] you with the scoping and design process of all this.

[00:19:45] We've had several clients that we're working with that actually have C3PO's that are

[00:19:49] engaged and we're working together with them and the C3PO consultant they're engaged

[00:19:53] with.

[00:19:54] That just helps someone kind of looking over her shoulders.

[00:19:57] It's not something that we're against.

[00:19:58] We actually are for that.

[00:19:59] Right.

[00:20:00] And we call it the triad, right?

[00:20:02] You want to have that because you've got the client, you've got additional outside consultant

[00:20:06] and MSP.

[00:20:07] I think that really pretty much guarantees you success at the end.

[00:20:10] So there's no guarantees, but I bet that's about as close as you can get because you just

[00:20:14] got multiple parties looking at it to try to make sure you get on the mountain correctly.

[00:20:17] I'm excited to talk more about that sort of perspective in the next mountain that we climb

[00:20:23] on this next episode because that'll be great.

[00:20:26] So we're going to do that in season three, right?

[00:20:28] So we're going to be season three.

[00:20:30] Correct.

[00:20:30] Yeah.

[00:20:31] So this is going to be the end of season two if you're listening to this now, but season

[00:20:35] three, we'll be talking about the next mountain.

[00:20:38] So let's talk about, we just did five, which is talking to a consultant, getting that scoping

[00:20:44] piece done.

[00:20:45] Now the next part of this climb up is kind of split into two perspectives.

[00:20:50] There's the design and there's the documentation, right?

[00:20:53] And those two things are quite difficult.

[00:20:59] I'm not going to say that they're easy or that one's very easy and the other one's super

[00:21:05] hard kind of thing.

[00:21:06] So you're going to need two perspectives on this whole process.

[00:21:11] Do you want to talk a little bit on your perspective of doing that implementation piece?

[00:21:17] I want to hear yours thought of it.

[00:21:18] I mean, I have mine, but I mean, you saw it from a different perspective.

[00:21:21] Like, what do you, how do you feel about that?

[00:21:23] Do you, do you feel like that needs to be both?

[00:21:26] Well, that's interesting.

[00:21:27] I didn't know I'd be put on the spot like this, but in my perspective, I thought I, you

[00:21:33] know, so Adam did, did one, right?

[00:21:35] Adam did the documentation and you did the design piece of it.

[00:21:38] I do believe that it takes a certain mind to do one and a certain mind to do another.

[00:21:45] You know this mind, could I have been great at the documentation?

[00:21:47] I sure do.

[00:21:48] And I don't want you doing my documentation, mister.

[00:21:52] So yeah, you know, it's an email coming from you when it, there's spelling errors.

[00:21:56] So yeah, I don't want.

[00:21:59] I own it.

[00:21:59] It's me.

[00:22:00] It's definitely me.

[00:22:01] It's all right.

[00:22:01] But you're excellent at design because you're very innovative in that way.

[00:22:07] And you can kind of come up with, it's not just like, how did somebody else do it?

[00:22:10] But it's like, how, how did somebody else do it?

[00:22:12] And how can I make it better?

[00:22:13] And how can I evolve this to, to make it exactly what we need and what our clients need?

[00:22:19] You know?

[00:22:19] And, and, and so I, I really do feel like, and then there's Adam that's like, I do believe

[00:22:24] that in section 13, 20, you know, and so good at that.

[00:22:27] Yeah.

[00:22:28] You know what I mean?

[00:22:28] So I do believe that there are two minds and I do think that there should be separate

[00:22:33] people doing that.

[00:22:35] Um, I saw that perspective, like, at least from, from my perspective, looking in on watching

[00:22:40] you guys do it.

[00:22:41] Um, that's what I saw.

[00:22:43] Um, but, but yeah, not, not claiming Jesus, not claiming CMMC.

[00:22:48] Well, I think, yeah, that's how I feel.

[00:22:50] Um, and you could be one person and do them both, but boy, you're a unicorn if you can,

[00:22:56] because the documentation.

[00:22:58] You are special.

[00:22:59] Yeah.

[00:22:59] Just because the documentation piece just takes such a good mind of looking at things analytically

[00:23:04] and be able to, and it's a lot of writing, man.

[00:23:07] I mean, so much writing of doing your S your system security plan.

[00:23:11] I mean, our system security plan is over 150 pages, you know?

[00:23:14] Yeah.

[00:23:15] Uh, and we don't have a lot of charts and graphs.

[00:23:17] I mean, like we're, we're pounding it out.

[00:23:20] You know?

[00:23:20] Right.

[00:23:21] Um, and so it's, it's legit.

[00:23:23] Um, and then, then you've got your policies and you've got your procedures and all of

[00:23:27] that kind of comes together for, I don't know how many hundreds of thousands of words that's

[00:23:32] taken.

[00:23:33] Um, and you haven't even picked up your pencil yet or, you know, to, to actually start

[00:23:38] typing on the keyboard with, you know, pin pecking, if you will, to kind of get the

[00:23:42] architecture built.

[00:23:43] Right.

[00:23:43] Yeah.

[00:23:44] Now me and Adam and, and, and multiple people came together to have the design, the scoping,

[00:23:48] that's what we're referring to.

[00:23:49] And we talked about scoping, but then you've got to implement it, right?

[00:23:51] You've got to build the container.

[00:23:52] You've got to do those types of stuff.

[00:23:53] You have to add those and get the group and all of that stuff needs to happen.

[00:23:58] And, um, you know, if you don't have two people implementing that or a team of people,

[00:24:03] you know, you just are extending your timeframe on how long it's going to take for you to

[00:24:06] get that done.

[00:24:07] And, you know, it just depends on what your dwell time that you want to have trying to

[00:24:10] get this implemented.

[00:24:11] Right.

[00:24:11] Um, because if you don't have it built, how can you appropriately support your clients?

[00:24:15] Right.

[00:24:16] So you don't want to waste any more time than you have to, to get it built up so you can

[00:24:20] appropriately support them.

[00:24:21] Because if not, then you could be holding back your clients and that's a bad day.

[00:24:24] And if we're, if we're putting our MSP hat on and we're thinking about implementing this

[00:24:29] with multiple different clients, if you're just one person, well, you're not going to

[00:24:33] be one person doing this for long because you're going to get like, what, like three

[00:24:38] clients and you'll be like, oh, I'm exhausted.

[00:24:40] And then that's it.

[00:24:42] You know?

[00:24:43] So like, you can't, like, that's not even realistic to be able to push out to your clients.

[00:24:49] Yeah.

[00:24:49] That's a good point.

[00:24:50] Even if it is happening now for you right now, great, but that's not going to be able

[00:24:56] to withstand the next mountain.

[00:24:58] You know what I mean?

[00:24:59] Definitely not.

[00:25:00] So, and let's talk about, so we've, we've been talking about the, you know, the two sides,

[00:25:07] the design, the documentation, and how we believe that that should be split into two different

[00:25:12] people.

[00:25:12] But also in the seventh point is building this with inheritance and proof in mind.

[00:25:20] Which is kind of like what we were talking about before of like the perspective of our

[00:25:24] clients when doing this.

[00:25:26] Right?

[00:25:27] So you need to know while you're building this, how, how is this going to connect with

[00:25:34] our clients?

[00:25:35] What, what is going to happen here?

[00:25:37] And if, if you don't understand that piece, you're going to do like what Bobby was saying

[00:25:40] earlier of like, you can make this pretty little tiny bubble right here and have this audited,

[00:25:45] but that's not what is going to be working with your clients.

[00:25:49] So, so you have to think about that or you'll be doing your company, a complete and total,

[00:25:54] you know, injustice for the future with the next mountain.

[00:25:57] Couldn't have said it better.

[00:25:59] Wow.

[00:26:00] I've made you speechless.

[00:26:01] That's it.

[00:26:02] Next point, please.

[00:26:03] Wow.

[00:26:04] Incredible.

[00:26:05] I think I've never done that before.

[00:26:06] Everybody make note.

[00:26:07] Okay.

[00:26:08] The next point is building evidence.

[00:26:11] Ooh, this is good stuff.

[00:26:14] It'll get you, it'll get you on the audit possibly.

[00:26:16] Cause it just depends on now there's, okay.

[00:26:20] I'm just going to be real here.

[00:26:21] Everybody pay attention.

[00:26:22] This is real.

[00:26:22] This is me telling you here.

[00:26:23] All right.

[00:26:24] Listen, listen to what I'm about to tell you.

[00:26:26] Um, not all C-3PO's are equal.

[00:26:30] Okay.

[00:26:31] Okay.

[00:26:32] Just like when you go into court, every judge is going to look at things differently.

[00:26:36] Right.

[00:26:36] That's why some attorneys are like, Hmm, I would like this judge, please.

[00:26:39] Um, unlike in law, you can pick who your judge is going to be in general, because you can

[00:26:45] pick the C-3PO that you're going to do business with because you're paying them.

[00:26:49] All right.

[00:26:50] That's how that works.

[00:26:51] And now you might not be able to pick your assessment team, but you can talk to the C-3PO

[00:26:57] and have a better understanding where they're at.

[00:26:59] Now they can't consult you, but you can talk with them to go through and try to have a better

[00:27:03] understanding and not all of them are equal.

[00:27:06] So when you're looking at this, you really have to be very, very careful in who you pick

[00:27:10] and how you choose and how you can work through that because it will have a bearing on how successful

[00:27:15] you are.

[00:27:15] Mm-hmm.

[00:27:16] And it's going to help when, um, well, you know, we'll probably talk about this a little

[00:27:21] bit later, but like keeping when you're in the actual assessment, keeping that assessor

[00:27:27] on track on path, like, Oh no, no, no, no.

[00:27:29] This way.

[00:27:30] This is what we're looking at.

[00:27:31] Right.

[00:27:31] Wait, wait, wait, wait, wait.

[00:27:32] Right here.

[00:27:33] And the reason why that is like some, some C-3PO's will be like, okay.

[00:27:38] Um, you have all of the documentation.

[00:27:41] You have all these pieces.

[00:27:43] Um, you're good.

[00:27:44] Most C-3PO's would look at this and go, but where's the evidence?

[00:27:48] Like, where's, where's the logs of you living in it?

[00:27:51] That shows that you've done the training.

[00:27:53] Well, we haven't done the training yet.

[00:27:54] We just got the container built.

[00:27:56] Okay.

[00:27:57] Well, how about a tabletop?

[00:27:58] Well, that's scheduled for next month.

[00:28:00] You're like, Hmm.

[00:28:01] Okay.

[00:28:02] Well, how, how, you know, show me how you've tested these analytic rules.

[00:28:06] Well, we haven't had, you know, been in our container long enough.

[00:28:09] That's a lot of, you know, asterisks that start adding up and not all C-3PO's will be

[00:28:14] cool with that.

[00:28:15] So you need to build the evidence enough time.

[00:28:18] So it might take you seven to eight months to a year to build it.

[00:28:22] But then, um, if you're not living at it yet, then you haven't built the evidence.

[00:28:26] So you need to build that into your timeframe of when you're doing that.

[00:28:29] And we always do that with our clients.

[00:28:31] We're like, this is how long we think it's going to take to build it.

[00:28:34] And here's the additional timeframe it's going to take for us to build evidence.

[00:28:36] We'll work as best as we can in doing this, but we're going to need that in the audit

[00:28:39] to prove that we did it right.

[00:28:41] Right.

[00:28:43] So the next part, I was trying to visualize how I was going to tell this, right?

[00:28:48] So the ninth point that we're making here is a self-assessment.

[00:28:54] Do a self-assessment.

[00:28:56] Now, in my head, what I'm picturing is you're getting to the top of this first mountain.

[00:29:02] Very close.

[00:29:03] Very close.

[00:29:04] Right?

[00:29:04] And gliding down is like doing the assessment.

[00:29:09] You're going to direct.

[00:29:11] You're going to move.

[00:29:12] Let's say, what are those things called that make you look like a little flying monkey

[00:29:16] when you're, what is that called?

[00:29:18] You know, those little wing suits.

[00:29:20] Those little wing suits.

[00:29:21] Yeah.

[00:29:22] Like what if you like flew down in those?

[00:29:25] This is like the self-assessment is like looking at those wings and making sure everything's

[00:29:31] good as well as looking down that there's no other mountains that you're going to slam

[00:29:35] right into when you go down.

[00:29:37] You're like double checking all of your equipment, double checking your stuff before you actually

[00:29:41] do it.

[00:29:42] And you might possibly hurt yourself and your hospital bill is going to be really expensive.

[00:29:48] If you live.

[00:29:50] So yeah, if you live.

[00:29:51] Well, the self-assessment process is so valid because what you have to do in there is you're

[00:29:56] building the habit of going through and going through all 320 assessment objectives and

[00:30:03] having a list of how for each one of those, you're going to prove that you're doing it

[00:30:06] right.

[00:30:07] Right.

[00:30:07] So not like, I think we're good, but like write out how you're going to do it, what evidence

[00:30:13] you're going to use to do it with.

[00:30:14] And if you have some other additional screenshots to prove to yourself and maybe even to an auditor

[00:30:18] that you're doing it, do that too.

[00:30:21] And if you go through all 320 of those, now you have a great evidence bank and maybe a good

[00:30:27] chunk of that the auditor might take.

[00:30:28] And maybe they might not, but if it cuts down half of your day of your three day, you know,

[00:30:34] assessment timeframe, that is great.

[00:30:37] The less time, even if they don't charge you less, the less time you're talking to the

[00:30:40] auditor, less chance they're going to find something wrong.

[00:30:43] Right.

[00:30:43] So get them in, get them out.

[00:30:46] You don't want them to stay any longer than you have to.

[00:30:49] That is, that is crucial.

[00:30:51] So being prepared.

[00:30:52] And then you can use that readiness piece as, as, as a good journey to help you.

[00:30:57] And then it's also something really great to use to, to have that kind of walk the dance

[00:31:02] of someone pretending to be the auditor.

[00:31:04] And you can use that document to kind of walk it to prove your, your stance.

[00:31:08] It's, it's such a valuable document.

[00:31:09] And then after you get your assessment, right, which we're going to fast forward for just,

[00:31:13] you know, we're not going to cover the other points, but, uh, I'm just going to jump

[00:31:17] them for a second and say, you have that, um, you're going to need to do that.

[00:31:22] Yearly and save that.

[00:31:23] Right.

[00:31:24] As part, as part, as part of what the 32 CFR requires us to do.

[00:31:27] So you're having the habit of doing that because you're going to have to do that every

[00:31:31] year of making sure that you've done that.

[00:31:33] Now there's some, uh, auditors and people that I've, I've heard say, oh, it's, you just

[00:31:37] kind of review stuff.

[00:31:38] It's fine.

[00:31:38] Others that are like, no, like we want to see, um, again, mileage varies in who you're

[00:31:43] talking with.

[00:31:44] Um, so we'll just let that lay where that's.

[00:31:47] Yeah.

[00:31:48] Yeah.

[00:31:48] Um, speaking of auditors, if at this point, number 10, the point that we're trying to

[00:31:55] make is you should be reaching out to the C3PO that is going to be doing your assessment

[00:32:00] if you have not already.

[00:32:03] When do you think you should, Kaylee?

[00:32:05] I'm curious.

[00:32:05] When?

[00:32:06] Yeah.

[00:32:07] When should you start reaching out to your C3PO?

[00:32:08] What, what step would you pick?

[00:32:10] Yesterday.

[00:32:11] I don't know.

[00:32:12] I, uh, I, is there, is there a two, is there a two early just to talk with them?

[00:32:18] No, I don't think so.

[00:32:19] I mean, I, I just, I think when you feel like you're really committed and you're doing it

[00:32:23] and you're not turning back, like that's when you want to reach out to your C3PO.

[00:32:26] Cause they're picked up.

[00:32:27] Like I've talked to some that they're in Q3 already for their, for their assessment piece.

[00:32:32] So why would you want to wait until you're ready?

[00:32:36] Like go ahead.

[00:32:37] Some of them require deposits.

[00:32:38] Some don't.

[00:32:40] So mileage varies there and prices also vary.

[00:32:43] So you might want to get several different ones.

[00:32:45] Um, it's, it's critical as an MSP.

[00:32:48] You need to get your butt in gear and start listening and finding C3PO's.

[00:32:53] Do not throw your clients to the wolves, get out there and find the good ones because they

[00:32:59] may not pick the right one.

[00:33:00] And you both may be very sorry for that lesson learned.

[00:33:03] So you really need to have as an MSP, your ear to the ground and have that Rolodex deep

[00:33:08] enough to help your clients get where they need to go.

[00:33:10] And, and, and that's a really important aspect is, you know, don't, don't leave that

[00:33:14] to the last minute.

[00:33:15] They should start talking to them probably in step three or four that we mentioned.

[00:33:19] Right.

[00:33:20] When you're ready and you're an interest doing it, go ahead and get it scheduled.

[00:33:23] You can book it out months and months in advance.

[00:33:25] And if you have to kick it, you can, and most will let you do that.

[00:33:29] So, you know, there's not a penalty or fee for moving it.

[00:33:32] Um, they may, that might change, but at least try.

[00:33:36] Yeah.

[00:33:37] Right.

[00:33:37] Absolutely.

[00:33:38] So point 11, we're getting to the end.

[00:33:42] We're so close.

[00:33:44] We're talking about phase one and two of the auditing process.

[00:33:49] Right.

[00:33:50] So there, you don't just, if you guys are not familiar whatsoever with the assessment

[00:33:57] process and what happens with a C3 PAO, you don't just waltz in one day and say, I'm here,

[00:34:04] you know, and you have all of your documentation with you.

[00:34:07] And that's, you guys don't know.

[00:34:08] Kaylee has a beautiful voice.

[00:34:09] She's excellent.

[00:34:10] Excellent.

[00:34:11] Thank you.

[00:34:11] Thank you for saying that.

[00:34:12] Just a little taste.

[00:34:13] I just watched wicked last night and maybe it just, it just like, you know, the musical

[00:34:18] theater just jumped out.

[00:34:19] The melody of CMMC.

[00:34:20] I can't wait to hear it.

[00:34:21] I just feel an album in the future.

[00:34:23] You know, CMMC's greatest hits.

[00:34:25] I never have to write an album about CMMC, honestly.

[00:34:29] Um, but you have to send them information beforehand so they can be like, yeah, like we think you

[00:34:37] are good enough to be assessed.

[00:34:39] Right.

[00:34:39] So you're talking about phase one, right?

[00:34:41] Right.

[00:34:42] Phase one.

[00:34:42] Right.

[00:34:43] And then do you want to talk a little bit about how that rolls into phase two and what

[00:34:47] that looks like?

[00:34:48] Yeah.

[00:34:49] So you've got to get them ready for the go, no go.

[00:34:51] So assuming that you've kept your ear to the ground, you've found some adequate C3PO's

[00:34:55] that are going to work, you know, just because, uh, you found one and you might be happy with

[00:34:59] it.

[00:34:59] You definitely should have some alternatives because they may not have available space for

[00:35:03] you to be able to line up in the timeframe the client has.

[00:35:05] Right.

[00:35:06] I've heard of individual organizations, even booking spots in advance for their clients,

[00:35:11] which is kind of interesting.

[00:35:13] So I'm not exactly sure how that works, but, um, you know, if you're big enough and you

[00:35:18] kind of have a big enough wallet, I'm sure you could reserve a lot of spaces, but, uh,

[00:35:23] you know, mileage may vary.

[00:35:25] Uh, yeah.

[00:35:27] Uh, so, but the, yeah, the phase one, what you have to do is you, you've got to get things

[00:35:33] lined up.

[00:35:33] So you've already picked your C3PO and you provide them body of evidence and they look

[00:35:37] at it and it's basically a go, no go.

[00:35:39] They look at that and they say, okay, um, great job.

[00:35:42] The SSP is not written on a napkin.

[00:35:44] It's actually on a piece of paper and it has more than a few pages that looks like it's got

[00:35:48] the content.

[00:35:49] Now they're not assessing it.

[00:35:51] They're just looking at the validity of it.

[00:35:53] They just want to say, this looks valid.

[00:35:56] This is, this is adequate for us to move forward.

[00:35:59] And then they move forward.

[00:36:00] They're not assessing your, your, any of your body of evidence at that point.

[00:36:06] Right.

[00:36:06] Now the cap has some words and verbiage that may suggest otherwise every C3PO that I've

[00:36:12] ever talked to does not approach it that way.

[00:36:14] Um, and I have a feeling it'll be more eloquently put once the real cap comes out, which is in

[00:36:21] probably less than 30 days.

[00:36:22] Uh, cause I'm hoping they get it finished before, uh, assessments are supposed to start.

[00:36:27] Cause it'd be really weird just by our freaking butt luck is being posted tomorrow.

[00:36:31] And we're going to have to come back and update this part.

[00:36:34] Holly, you're welcome.

[00:36:35] We did it.

[00:36:36] We made the cap be released tomorrow.

[00:36:38] If you're listening to this now, we're not going to hold back.

[00:36:41] We'll release this as it is.

[00:36:42] And we'll just, we sure will get over it.

[00:36:44] That's all I'm saying deal with it.

[00:36:46] Yeah.

[00:36:47] And now phase two is basically the, the audit in earnest.

[00:36:50] Uh, that's where if you have done your homework and you've done your readiness assessment

[00:36:54] yourself and you have all that body of evidence, like we're talking about and you show you who

[00:36:58] it, it is literally the blueprint of how you walk down your assessment.

[00:37:01] And, and if you're doing it right, you could potentially cut days off of your assessment.

[00:37:06] Okay.

[00:37:07] We're getting so close.

[00:37:09] We're almost there.

[00:37:10] We're 0.12.

[00:37:11] Um, we're at the, we're at the end, which is actually just the beginning.

[00:37:17] Um, and, and that is maintaining compliance.

[00:37:22] You don't just do the assessment and then you're done.

[00:37:25] You've got to keep it going.

[00:37:27] Right.

[00:37:27] So that's good stuff.

[00:37:30] And I've heard clients, uh, not our clients, thank God.

[00:37:33] Uh, but I've heard others talk about how they've had situations where, all right, now

[00:37:37] that we have this implemented, we can, we roll it back so that we can do things like

[00:37:41] we're used to.

[00:37:42] You're like, what?

[00:37:44] You're like, never.

[00:37:45] That's a like in perpetuity.

[00:37:47] You gotta leave the dibs space, huh, buddy?

[00:37:49] Right.

[00:37:50] Yeah.

[00:37:50] I mean, once you get married, look, man, you're not throwing your clothes and shoes wherever

[00:37:53] you want.

[00:37:54] You've got someone else who says, Hey, I think you need to kind of clean up, you know?

[00:37:58] So you, you don't get to just live that life that you have in the past before CMMC.

[00:38:03] Once you get your level two certification, you have to maintain it.

[00:38:06] You have to continue to build that body of evidence.

[00:38:08] You're doing the yearly attestations like we were talking about.

[00:38:10] Uh, and you build that habit up so that when year three rolls around, um, it's not a shocker.

[00:38:17] And there are C3PO's that will actually have that as part of their cost.

[00:38:22] Uh, you can amateurize that cost.

[00:38:24] So you don't have to necessarily do a CapEx for your audit.

[00:38:27] There are some C3PO's that will have a yearly connection with you over that period and will

[00:38:32] include it in the cost of doing it.

[00:38:34] Um, and you can even leverage that to some extent for your yearly audit as well.

[00:38:38] So there's a lot of benefits of ways to look at that.

[00:38:41] So those are conversations you can have with C3PO's about that.

[00:38:43] Not all do that, but some do.

[00:38:45] It's very interesting.

[00:38:46] Yeah.

[00:38:46] Well guys, we have gone through 12 points and we've done pretty good.

[00:38:50] We're at 43 minutes right now as I'm looking here.

[00:38:52] So I think it's the best we've done with 12 points having to cover in a video.

[00:38:56] So we've gone through the first mountain.

[00:38:59] Okay.

[00:39:00] We're doing the perspective of an MSP going through a CMMC.

[00:39:04] So with the perspective of...

[00:39:06] I want to ask you, why do you think there's a second mountain?

[00:39:08] Uh, maybe people don't know why.

[00:39:10] I want to hear your thoughts.

[00:39:12] Well, you now have to figure out how to, well, sell and implement this to clients, which I...

[00:39:21] Because they've got to climb their mountain, right?

[00:39:23] I mean, they have to climb their mountain.

[00:39:24] So like, you're going too, buddy.

[00:39:26] You know what I mean?

[00:39:27] Like, even if you...

[00:39:27] And you know what?

[00:39:28] I think it's another mountain.

[00:39:30] I don't think you're just going back around and then going up the same mountain again.

[00:39:34] I think it's different.

[00:39:35] And that's why, you know, we can talk a little bit more about that in our next episode.

[00:39:40] But yeah, I think that's why the perspective is like that.

[00:39:45] And there's, comes with its own challenges, its own different parts to this.

[00:39:49] So different.

[00:39:50] And I don't know if there's going to be 12 points in that one too.

[00:39:53] It might be a few different numbers, you know?

[00:39:54] So just stay tuned.

[00:39:56] We're going to think about that.

[00:39:57] We're going to mull it over.

[00:39:58] Don't say anything yet.

[00:40:00] Okay.

[00:40:00] Well, I think it's really interesting because there's the, how you support and get clients,

[00:40:06] right?

[00:40:06] But then there's the way that you have to operate as an MSP.

[00:40:09] Yeah.

[00:40:09] You have to be successful as an MSP.

[00:40:11] You have to be able to support the clients.

[00:40:13] You have to validate what you're doing is going to be profitable.

[00:40:16] You have to track.

[00:40:17] And there's certain math as MSPs that mature MSPs know, you know, right in their bones,

[00:40:25] what they're doing is going to be profitable because if they don't, they're going to go

[00:40:29] to business, right?

[00:40:30] Yeah.

[00:40:30] All you can do is scale the wrong way and, you know, you just go to business faster.

[00:40:36] And so you have to do that in a way.

[00:40:38] And, you know, this is all new for a lot of companies that are trying to implement it

[00:40:41] at scale and MSPs are no exception.

[00:40:44] So that math equation part, if you're not really good at doing it in your commercial side

[00:40:48] and have the experience and how to implement on your CMMC side, you literally could put yourself

[00:40:53] out of business, go into CMC as an MSP if you don't know what you're doing.

[00:40:57] Right.

[00:40:57] And so, and, and also find yourself in a lot of legal waters because there's a lot of

[00:41:02] requirements and other things you got to do.

[00:41:03] This is not just, you know, Hey, you know, I got a kiddie pool.

[00:41:07] I mean, this is like chummy waters that are, you know, can be a bit scary if you don't know

[00:41:11] what you're doing.

[00:41:12] So as an MSP, you really have to perk up and pay attention.

[00:41:14] And if you're looking for MSPs, you really want to make sure you're finding those MSPs who

[00:41:19] respect and understand the sanctity of what they're trying to accomplish and how serious

[00:41:23] and sobering it needs to be taken.

[00:41:26] Mm-hmm.

[00:41:27] Sorry, that's a little scary, but I wasn't trying to be that way.

[00:41:30] Well guys, doom and gloom for the end of this.

[00:41:32] Here we go.

[00:41:33] No, I'm just kidding.

[00:41:34] No, it's, it's honestly the truth.

[00:41:36] And it can be when you find an MSP, you know, that, that works with your company or when you

[00:41:42] are an MSP and you help, you get to start helping clients do this.

[00:41:46] And, you know, it's really honestly an incredible thing as well.

[00:41:49] So stay tuned for that and stay tuned for our second mountain that we are going to climb

[00:41:54] as an MSP and walk you guys through how to climb it as an MSP.

[00:41:59] We hope you guys enjoyed today's episode, the final episode of season two.

[00:42:06] We hope you guys enjoyed all of season two.

[00:42:08] Tears, tears, wipe them away.

[00:42:10] Um, but stay tuned for some really heavy hitters for season three.

[00:42:15] Oh, it's going to be good.

[00:42:16] We are excited.

[00:42:18] So yeah, stay tuned for season three coming soon.

[00:42:21] But until then guys, keep on climbing.

[00:42:23] Bye.

[00:42:24] Yeah.

[00:42:25] Thank you guys so much for watching season two of Climbing Mount CMMC.

[00:42:31] Stay tuned in two weeks for the start of season three.