Let's Get Real About Cost of CMMC

[00:00:00] [SPEAKER_02]: Welcome back climbers, I'm your co-host Kaylee Floyd and this is another episode of Climbing Mount CMMC.

[00:00:11] [SPEAKER_02]: In today's episode we are getting real about the cost of a CMMC journey.

[00:00:16] [SPEAKER_02]: Now we are going to talk about our personal journey today in hopes that it will help you on yours.

[00:00:21] [SPEAKER_02]: Thank you guys so much for tuning in and we hope you enjoy today's episode.

[00:00:26] [SPEAKER_02]: Hello climbers! Today we are going to be talking about a very exciting topic.

[00:00:31] [SPEAKER_02]: I'm very thrilled to start our series Let's Get Real with talking about cost.

[00:00:39] [SPEAKER_02]: Okay, so today we're going to get real about the cost of your CMMC journey.

[00:00:44] [SPEAKER_02]: Now we are not claiming CMMC Bible here.

[00:00:47] [SPEAKER_02]: You know we are not CMMC Jesus so we don't know everything.

[00:00:51] [SPEAKER_02]: But what we do know is what we went through as a company and we're hoping that that can help you guys in your journey

[00:00:57] [SPEAKER_02]: maybe learn a little bit more from our mistakes and the things that we might have done well.

[00:01:02] [SPEAKER_02]: So we're going to talk about three specific areas that we feel like we could really break out cost.

[00:01:10] [SPEAKER_02]: And that first area is scoping in design.

[00:01:14] [SPEAKER_02]: The second area is the actual implementation.

[00:01:17] [SPEAKER_02]: And then the third is the maintenance of it all.

[00:01:19] [SPEAKER_02]: So Bobby I really want you to talk about first the reason why we felt like we needed to break up cost into those three categories.

[00:01:29] [SPEAKER_00]: Yeah, I think it's important to kind of realize that over your journey it's not like buying a new car where you can just be like,

[00:01:36] [SPEAKER_00]: okay I'm going to have this balloon payment and then amortize it over the course of five years and you're good right?

[00:01:44] [SPEAKER_00]: It doesn't work that way. You're going to have this ebb and flow of potential costs.

[00:01:47] [SPEAKER_00]: So we broke it down into those three sections because I feel like those will have an impact of the ebb and flow of your potential exposure and cost,

[00:01:53] [SPEAKER_00]: whether it be a maintenance type cost where it might be a capital type cost where you're having stuff up front.

[00:02:00] [SPEAKER_00]: And so part of the reason that I think the people want to do is they just want to put it all into one nut.

[00:02:07] [SPEAKER_00]: What do I have to pay? Just tell me the number.

[00:02:09] [SPEAKER_02]: That sounds really easy.

[00:02:13] [SPEAKER_02]: I think there's a reason too why we call this podcast Mount CMMC and not casual walk through the forest of CMMC.

[00:02:23] [SPEAKER_00]: Right, and I'm definitely not CMMC Jesus and I know you're not our Aether but I love that analogy.

[00:02:31] [SPEAKER_00]: The reality is in that first part, Karen did such a good job when we had her on earlier in our series

[00:02:38] [SPEAKER_00]: and you haven't checked out that episode. Definitely check out that one.

[00:02:42] [SPEAKER_00]: Also, Amira also covered scoping. She actually brought out paint and talked about it.

[00:02:46] [SPEAKER_02]: Microsoft paint, go love it.

[00:02:48] [SPEAKER_00]: It's a glorious, glorious thing.

[00:02:50] [SPEAKER_00]: And if you've not engaged with Amira with paint involved, you're missing out.

[00:02:56] [SPEAKER_00]: I agree.

[00:02:57] [SPEAKER_00]: So shout out to you, Amira, on your paint skills.

[00:03:00] [SPEAKER_00]: You really need to sit down and look at your design.

[00:03:04] [SPEAKER_00]: And so that infers some of the stuff that we'll be talking about in the future, which is knowledge.

[00:03:10] [SPEAKER_00]: That's going to require you to have knowledge to understand your design about what you want to have

[00:03:15] [SPEAKER_00]: and what you want to build so that you can operate and function.

[00:03:18] [SPEAKER_00]: There's a lot of solutions out there that will just kind of be the cookie cutter,

[00:03:21] [SPEAKER_00]: like let's kind of build an enclave.

[00:03:23] [SPEAKER_00]: But if you've got manufacturing, other types of things, your data is right next to you.

[00:03:28] [SPEAKER_00]: We're talking elbows, just rubbing and getting in there and trying to get stuff to work.

[00:03:33] [SPEAKER_00]: You've got PLCs and other devices that are trying to work.

[00:03:35] [SPEAKER_00]: That's the reality, right?

[00:03:36] [SPEAKER_00]: So this beautiful virtual environment just doesn't really work in real life.

[00:03:40] [SPEAKER_00]: So you've got to think about your design and that cost of design and architecture takes money.

[00:03:49] [SPEAKER_00]: So you want to talk with the CCA.

[00:03:52] [SPEAKER_00]: They charge well over $300 an hour.

[00:03:56] [SPEAKER_00]: And you want to spend probably a few days of going through the architecture

[00:04:00] [SPEAKER_00]: and working through how you want to do it.

[00:04:02] [SPEAKER_00]: Now, you could engage a consulting company that could do it for you.

[00:04:07] [SPEAKER_00]: But I would suggest talking and engaging with a C3PO organization,

[00:04:14] [SPEAKER_00]: spend that money to get with them to help get an idea of how you want to do it.

[00:04:19] [SPEAKER_00]: Then find a company that could help you implement it

[00:04:22] [SPEAKER_00]: and having that engagement with a third party company

[00:04:25] [SPEAKER_00]: that understands, that talks about design and scope.

[00:04:28] [SPEAKER_00]: That has the power of allowing you to have somebody to turn and talk to you

[00:04:33] [SPEAKER_00]: and say, hey, this is what the main service provider that I picked

[00:04:37] [SPEAKER_00]: is saying does that sound okay?

[00:04:39] [SPEAKER_00]: It's not that you're trying to create conflict,

[00:04:41] [SPEAKER_00]: but there's so much writing in your implementation.

[00:04:45] [SPEAKER_00]: You want to make sure that whatever solution you decide to go down,

[00:04:48] [SPEAKER_00]: you're not going to have to double back.

[00:04:49] [SPEAKER_00]: You don't want any dead end roads because that is kind of a good place.

[00:04:53] [SPEAKER_00]: Absolutely. Your scoping is so critical.

[00:04:55] [SPEAKER_00]: You've got to get that right.

[00:04:57] [SPEAKER_00]: Getting your scoping, you're looking at several days at $300 an hour

[00:05:02] [SPEAKER_00]: of going through and talking with a consultant.

[00:05:04] [SPEAKER_00]: That kind of gives you a general idea of what your general design costs might cost you to do that.

[00:05:12] [SPEAKER_00]: Now, a lot of people want to think about what the reoccurring maintenance costs are.

[00:05:17] [SPEAKER_00]: That's the third thing that you wanted to talk about.

[00:05:20] [SPEAKER_00]: But let's put something out front.

[00:05:21] [SPEAKER_00]: What we found in the maintenance type processes that if you're a well run organization

[00:05:27] [SPEAKER_00]: that you have good technical processes already before you started down your CMMC journey,

[00:05:32] [SPEAKER_00]: you can usually take your budget.

[00:05:34] [SPEAKER_00]: If you're doing it right, some assumption here, okay?

[00:05:38] [SPEAKER_00]: Don't come at me.

[00:05:39] [SPEAKER_00]: It's about three times what you're paying is what we've been seeing.

[00:05:42] [SPEAKER_00]: Now, if you haven't been doing patching,

[00:05:44] [SPEAKER_00]: you don't have someone who's looking at those types of things.

[00:05:46] [SPEAKER_00]: You don't have the right solutions in place.

[00:05:48] [SPEAKER_00]: Then of course, mileage varies dramatically.

[00:05:51] Right.

[00:05:53] [SPEAKER_02]: I'm glad that you said that at first because I think that is a very, very big number.

[00:06:01] [SPEAKER_02]: That's not something to take lightly.

[00:06:05] [SPEAKER_02]: That is the third thing that we're talking about.

[00:06:09] [SPEAKER_02]: Just like you were saying in the analogy in buying a car,

[00:06:15] [SPEAKER_02]: there's not necessarily an end.

[00:06:18] [SPEAKER_02]: There's phases and that maintenance continues on.

[00:06:24] [SPEAKER_02]: Although scoping in design, hopefully when you lay that foundation correctly,

[00:06:30] [SPEAKER_02]: you don't have to double back like Bobby was saying and come back to it.

[00:06:34] [SPEAKER_02]: That it is laid correctly so it stays there in place.

[00:06:38] [SPEAKER_02]: But that maintenance piece is...

[00:06:42] [SPEAKER_02]: It's there to stay.

[00:06:43] [SPEAKER_02]: It's going to stay.

[00:06:44] [SPEAKER_02]: Right.

[00:06:45] [SPEAKER_02]: That doesn't end.

[00:06:46] [SPEAKER_02]: I do think that that was great to start off this.

[00:06:50] [SPEAKER_02]: This is a marriage and we're going back to it.

[00:06:54] [SPEAKER_02]: There we go.

[00:06:55] [SPEAKER_02]: But it's not going to end if you do it correctly.

[00:07:02] [SPEAKER_02]: I really do think that if you're listening to this

[00:07:05] [SPEAKER_02]: and you are taking it seriously, let's start off with that.

[00:07:08] [SPEAKER_02]: Let's get that out of the way.

[00:07:10] [SPEAKER_02]: Then let's talk about them more in detail.

[00:07:13] [SPEAKER_00]: So to get real specific,

[00:07:14] [SPEAKER_00]: kind of that pre-scoping, you want to allocate between three to ten grand at least in cost.

[00:07:20] [SPEAKER_00]: It could be more, but in a minimum,

[00:07:23] [SPEAKER_00]: I would say a good starting point is at least 10K

[00:07:26] [SPEAKER_00]: and trying to calculate your design, talking with professionals,

[00:07:31] [SPEAKER_00]: really understanding how that's going to go.

[00:07:35] [SPEAKER_00]: Then you get into how do I get this beautiful Eiffel Tower

[00:07:40] [SPEAKER_00]: or Statue of Liberty type Golden Gate Bridge

[00:07:44] [SPEAKER_00]: design that you just architected out on paper.

[00:07:47] [SPEAKER_00]: How do you make it a reality?

[00:07:49] [SPEAKER_00]: That's where the six-figure costs, a lot of times you see people come in.

[00:07:54] [SPEAKER_00]: That's when you're into the actual implementation of the design that you just talked about.

[00:07:59] [SPEAKER_00]: Right.

[00:08:00] [SPEAKER_00]: It gets pretty darn expensive.

[00:08:04] [SPEAKER_00]: If you come out with real capital cost of less than six figures,

[00:08:10] [SPEAKER_00]: you're doing pretty freaking amazing.

[00:08:16] [SPEAKER_00]: What ends up happening is probably your biggest cost is going to be people.

[00:08:21] [SPEAKER_02]: Yeah.

[00:08:22] [SPEAKER_00]: The people and their time that they're going to spend

[00:08:25] [SPEAKER_00]: in doing the things that you need to have done.

[00:08:29] [SPEAKER_00]: So what does that mean?

[00:08:31] [SPEAKER_00]: Let's break it into two different categories.

[00:08:34] [SPEAKER_00]: Okay, Kay.

[00:08:36] [SPEAKER_00]: So let's say that you've got on the left hand over here

[00:08:39] [SPEAKER_00]: an organization that wants to do it themselves.

[00:08:42] [SPEAKER_00]: And then on the right hand, you have someone that's going to outsource

[00:08:47] [SPEAKER_00]: to try to find an organization or organizations that help them sort of get it there.

[00:08:52] [SPEAKER_00]: And those are two different approaches.

[00:08:54] [SPEAKER_00]: Yeah.

[00:08:55] [SPEAKER_00]: Option A, if you're going to do it yourself,

[00:08:57] [SPEAKER_00]: you have to pay for the cost of the education.

[00:09:00] [SPEAKER_00]: Right?

[00:09:01] [SPEAKER_00]: You either need to have somebody inside your organization that you've spent time

[00:09:05] [SPEAKER_00]: and money invested in them to go get CCP trained,

[00:09:08] [SPEAKER_00]: goes to get CCA trained, involved in the environment.

[00:09:11] [SPEAKER_00]: That's going to take time to get them ramped up.

[00:09:14] [SPEAKER_00]: Or you can go head hunt, find someone that already has the knowledge,

[00:09:18] [SPEAKER_00]: hire them and bring them into your company.

[00:09:20] [SPEAKER_00]: After a 20 or 30 person company, does that make sense?

[00:09:24] [SPEAKER_00]: Probably not, right?

[00:09:25] [SPEAKER_00]: Probably not.

[00:09:26] [SPEAKER_00]: Even if you have 100 people, these types of people that really understand

[00:09:32] [SPEAKER_00]: CMMC and have been involved in the ecosystem and know how to get you

[00:09:36] [SPEAKER_00]: to the success of getting a 110 score in your audit,

[00:09:40] [SPEAKER_00]: they're not over there working at McDonald's.

[00:09:44] [SPEAKER_00]: I mean, these are people that are six-finger...

[00:09:46] [SPEAKER_02]: They're not just hiding in your HR department.

[00:09:48] [SPEAKER_02]: Right.

[00:09:48] [SPEAKER_00]: You can't go ahead and talk to your local recruiter

[00:09:52] [SPEAKER_00]: and just pick somebody up as a temp and have them do that project.

[00:09:56] [SPEAKER_00]: That's just not a reality.

[00:09:57] [SPEAKER_01]: No.

[00:09:58] [SPEAKER_00]: These are six-figure type individuals that are very educated,

[00:10:02] [SPEAKER_00]: they understand the environment, they know how to do it,

[00:10:04] [SPEAKER_00]: they know how to get you there.

[00:10:05] [SPEAKER_01]: Yeah.

[00:10:05] [SPEAKER_00]: Do you want to have that person for many, many years inside your organization?

[00:10:10] [SPEAKER_00]: That's a judgment call.

[00:10:11] [SPEAKER_00]: It's a business decision if you want to have that person

[00:10:14] [SPEAKER_00]: embedded inside your organization for extended years.

[00:10:20] [SPEAKER_02]: Yeah.

[00:10:20] [SPEAKER_02]: So that's something to think about.

[00:10:21] [SPEAKER_02]: That's like the people that you're talking about, that process,

[00:10:26] [SPEAKER_02]: it still goes through the three stages that we're talking about.

[00:10:29] [SPEAKER_02]: That person's a part of the scoping and design,

[00:10:32] [SPEAKER_02]: that person is a part of the implementation,

[00:10:34] [SPEAKER_02]: and that person is a part of the maintenance

[00:10:37] [SPEAKER_02]: because they helped you do it all.

[00:10:38] [SPEAKER_02]: So you're not just paying for that person for a short period of time.

[00:10:43] [SPEAKER_02]: Right.

[00:10:44] [SPEAKER_00]: So let's say that you bring...

[00:10:46] [SPEAKER_00]: Let's say you even think,

[00:10:47] [SPEAKER_00]: I'm a genius, I'm going to go ahead and get a contractor,

[00:10:50] [SPEAKER_00]: someone that will have an agreed that worked for me full-time

[00:10:53] [SPEAKER_00]: for an extended period of time,

[00:10:55] [SPEAKER_00]: and then they'll turn the keys over to us.

[00:10:58] [SPEAKER_01]: Okay.

[00:10:59] [SPEAKER_00]: What we find is if you want to get it done in less than a year,

[00:11:03] [SPEAKER_00]: you're probably going to need two people.

[00:11:05] [SPEAKER_02]: Yeah.

[00:11:06] [SPEAKER_00]: Why?

[00:11:07] [SPEAKER_00]: All right.

[00:11:08] [SPEAKER_00]: You need somebody focusing on architecture and design,

[00:11:10] [SPEAKER_00]: who's helping move the needle in implementing

[00:11:13] [SPEAKER_00]: and building out the infrastructure.

[00:11:15] [SPEAKER_00]: And then you need someone else

[00:11:16] [SPEAKER_00]: who really understands the design of your documentation,

[00:11:20] [SPEAKER_00]: how you operate as an organization,

[00:11:21] [SPEAKER_00]: and make sure that your documentation,

[00:11:24] [SPEAKER_00]: your procedures and policies match with how you're operating,

[00:11:27] [SPEAKER_00]: and they don't negatively impact your CMMC journey.

[00:11:31] [SPEAKER_00]: So you've got to build this document system

[00:11:34] [SPEAKER_00]: that complies and works inside the design that you built.

[00:11:39] [SPEAKER_00]: And that's where, you know, if you just bought a templated system

[00:11:43] [SPEAKER_00]: and it doesn't line up with the design of what you're trying to do,

[00:11:47] [SPEAKER_00]: you're going to have to be ripping some stuff out

[00:11:49] [SPEAKER_00]: and put some stuff in, and that takes time.

[00:11:51] [SPEAKER_00]: That takes a lot of time.

[00:11:53] [SPEAKER_00]: And then that time for that person,

[00:11:56] [SPEAKER_00]: that's an investment.

[00:11:58] [SPEAKER_00]: Those people cost you money each month

[00:12:00] [SPEAKER_00]: for you to have them on the payroll,

[00:12:01] [SPEAKER_00]: and then they not only have to do that,

[00:12:03] [SPEAKER_00]: they also have to train your staff

[00:12:04] [SPEAKER_00]: to make sure that they're going to operate in that system

[00:12:06] [SPEAKER_00]: once you have it done.

[00:12:07] [SPEAKER_00]: Absolutely.

[00:12:09] [SPEAKER_00]: So, you know,

[00:12:10] [SPEAKER_00]: and when you start breaking those pieces apart

[00:12:12] [SPEAKER_00]: about doing it yourself,

[00:12:14] [SPEAKER_00]: it's a pretty serious commitment

[00:12:16] [SPEAKER_00]: because the first thing that you're assuming you have

[00:12:19] [SPEAKER_00]: is the knowledge to hire those people,

[00:12:21] [SPEAKER_00]: the right people, right?

[00:12:23] [SPEAKER_00]: If I wanted to hire a physics major

[00:12:27] [SPEAKER_00]: to teach college,

[00:12:29] [SPEAKER_00]: I'm screwed.

[00:12:30] [SPEAKER_00]: I don't know physics.

[00:12:32] [SPEAKER_00]: I don't know math.

[00:12:33] [SPEAKER_00]: I would not be able to appropriately qualify, quantify,

[00:12:37] [SPEAKER_00]: and pick the right person for the job.

[00:12:39] [SPEAKER_00]: That's a great point.

[00:12:40] [SPEAKER_02]: Yeah, you know nothing about physics.

[00:12:42] [SPEAKER_00]: I don't really know that.

[00:12:43] [SPEAKER_00]: And if you don't know a whole lot about CMMC,

[00:12:46] [SPEAKER_00]: picking that right person is going to be a real challenge.

[00:12:48] [SPEAKER_00]: So how could you get around that

[00:12:49] [SPEAKER_00]: if you want to go with option A?

[00:12:52] [SPEAKER_00]: That's where having that relationship with that consultant

[00:12:54] [SPEAKER_00]: that helped you did your design first.

[00:12:56] [SPEAKER_00]: They could maybe help you pick

[00:12:58] [SPEAKER_00]: that person or persons that you maybe

[00:13:00] [SPEAKER_00]: want to either have an extended contract with them

[00:13:02] [SPEAKER_00]: or hire because they're going to know

[00:13:04] [SPEAKER_00]: what someone who understands looks like

[00:13:07] [SPEAKER_00]: in that industry more than likely.

[00:13:09] [SPEAKER_00]: So you could possibly engage someone to help you that,

[00:13:12] [SPEAKER_00]: but don't do it on your own

[00:13:13] [SPEAKER_00]: because there's no way you're going to get it right.

[00:13:15] [SPEAKER_02]: That's a great point.

[00:13:16] [SPEAKER_02]: Something that I love that I've heard many of times

[00:13:18] [SPEAKER_02]: is a good leader knows

[00:13:20] [SPEAKER_02]: when somebody else can do something better

[00:13:22] [SPEAKER_02]: than they can.

[00:13:24] [SPEAKER_00]: Right, right.

[00:13:25] [SPEAKER_02]: So that's definitely...

[00:13:26] [SPEAKER_00]: So I think, do you feel like we covered option A?

[00:13:28] [SPEAKER_02]: I do.

[00:13:29] [SPEAKER_02]: I do feel like, yeah,

[00:13:31] [SPEAKER_02]: that was a really helpful way to break that out

[00:13:35] [SPEAKER_02]: because both people have to go through

[00:13:38] [SPEAKER_02]: all three of these phases of scoping and design,

[00:13:40] [SPEAKER_02]: implementation, and maintenance,

[00:13:41] [SPEAKER_02]: but they're going to go through it very differently

[00:13:44] [SPEAKER_02]: because one is going to have more on their back

[00:13:47] [SPEAKER_02]: than the other.

[00:13:49] [SPEAKER_00]: So if you want to do...

[00:13:50] [SPEAKER_00]: Let's do some numbers of time and cost for that.

[00:13:54] [SPEAKER_00]: So let's split option A into two sections.

[00:13:56] [SPEAKER_00]: Let's say that you want to organically bring someone along

[00:13:58] [SPEAKER_00]: on the journey and you want to...

[00:14:00] [SPEAKER_00]: I don't know,

[00:14:02] [SPEAKER_00]: grow someone into that position to do it.

[00:14:04] [SPEAKER_00]: You're looking at probably two years to pull that off

[00:14:06] [SPEAKER_00]: because you're going to have to find the right person.

[00:14:08] [SPEAKER_00]: You're going to have to find somebody who's really interested.

[00:14:11] [SPEAKER_00]: You're going to have to send them to classes.

[00:14:12] [SPEAKER_00]: The CCP courses are, what, for grand or something?

[00:14:17] [SPEAKER_00]: When you're trying to bring that person through that journey,

[00:14:20] [SPEAKER_00]: it's going to take time.

[00:14:20] [SPEAKER_00]: So you have to accommodate for their educational journey

[00:14:23] [SPEAKER_00]: as they kind of get into the space, they go to do it.

[00:14:27] [SPEAKER_00]: Maybe it's somebody who really likes security

[00:14:28] [SPEAKER_00]: and has a passion for it.

[00:14:30] [SPEAKER_00]: You want to invest the time in them growing

[00:14:31] [SPEAKER_00]: and learning and helping you move your company that way.

[00:14:36] [SPEAKER_00]: You're going to need at least a full-time person

[00:14:39] [SPEAKER_00]: that's going to grow into that and really do it

[00:14:41] [SPEAKER_00]: at the same time you're going to need probably

[00:14:43] [SPEAKER_00]: to consult and help that person along

[00:14:45] [SPEAKER_00]: to help inject.

[00:14:47] [SPEAKER_00]: It's going to take probably a year or two for you

[00:14:49] [SPEAKER_00]: to really, more realistically, two years to pull that off.

[00:14:53] [SPEAKER_00]: So trying to go that organic route of just throwing this

[00:14:57] [SPEAKER_00]: at someone responsibility-wise, let them kind of grow into it,

[00:15:00] [SPEAKER_00]: that's a long-term commitment.

[00:15:02] [SPEAKER_00]: It's just not very realistic in my opinion.

[00:15:05] [SPEAKER_00]: The other option would be, you know,

[00:15:08] [SPEAKER_00]: you contract someone.

[00:15:10] [SPEAKER_00]: I've seen other organizations do that.

[00:15:11] [SPEAKER_00]: They go find someone that is a CCP.

[00:15:13] [SPEAKER_00]: They contract them for six to eight months,

[00:15:16] [SPEAKER_00]: give them objectives that you want them to try to do.

[00:15:19] [SPEAKER_00]: In those situations, even with a highly skilled person,

[00:15:22] [SPEAKER_00]: you're still looking if you want to get it done

[00:15:24] [SPEAKER_00]: in less than a year, more than realistically two people.

[00:15:29] [SPEAKER_00]: Because you've got to split the design and the project,

[00:15:31] [SPEAKER_00]: because if you want them to do the actual design

[00:15:34] [SPEAKER_00]: and build of it, there's a lot of experience

[00:15:36] [SPEAKER_00]: and knowledge they're going to have to have.

[00:15:37] [SPEAKER_00]: Chances are, if you just bring on one person,

[00:15:40] [SPEAKER_00]: you're going to have to find an outsourced organization

[00:15:42] [SPEAKER_00]: that can do some of those project pieces.

[00:15:44] [SPEAKER_00]: Because it's just almost impossible to find one person

[00:15:47] [SPEAKER_00]: that knows everything about all of that stuff

[00:15:49] [SPEAKER_00]: to get it all done.

[00:15:52] [SPEAKER_00]: So it's just like starting to open people's eyes to like,

[00:15:55] [SPEAKER_00]: if I'm going with option A,

[00:15:56] [SPEAKER_00]: what am I looking down the barrel of?

[00:15:58] [SPEAKER_00]: Even if you bring a contract person on

[00:16:00] [SPEAKER_00]: and they know a lot about CMMC,

[00:16:02] [SPEAKER_00]: doesn't mean that they know how to stand up

[00:16:04] [SPEAKER_00]: in Azure GCC high environment correctly.

[00:16:07] [SPEAKER_02]: Right, right.

[00:16:08] [SPEAKER_00]: So even if you did that,

[00:16:10] [SPEAKER_00]: you're still going to have to probably find an outsourced company

[00:16:12] [SPEAKER_00]: to get the physical implementation of it.

[00:16:16] [SPEAKER_00]: So you're looking at well over 100,000

[00:16:19] [SPEAKER_00]: more realistically somewhere around 200,000

[00:16:22] [SPEAKER_00]: and costs for the actual project piece

[00:16:24] [SPEAKER_00]: to get you where you need to do time and labor

[00:16:28] [SPEAKER_00]: and that doesn't even include licensing costs

[00:16:31] [SPEAKER_00]: and other things that you have to do.

[00:16:32] [SPEAKER_00]: So if we talk about option B next,

[00:16:35] [SPEAKER_00]: option B is going to be you're going to find

[00:16:37] [SPEAKER_00]: an outsourced organization.

[00:16:39] [SPEAKER_00]: They're going to do all,

[00:16:41] [SPEAKER_00]: if not most of everything that you're going to need to do.

[00:16:44] [SPEAKER_00]: So that's where you actually are going to

[00:16:46] [SPEAKER_00]: carve up what needs to be done

[00:16:48] [SPEAKER_00]: and you're going to just give them those objectives

[00:16:51] [SPEAKER_00]: to get done and they're going to start knocking them out,

[00:16:53] [SPEAKER_00]: building the design of it, implementing it.

[00:16:56] [SPEAKER_00]: And those are a little easier to budget

[00:16:58] [SPEAKER_00]: from the perspective of you can get the scope of work

[00:17:01] [SPEAKER_00]: from each of those as you're doing it

[00:17:02] [SPEAKER_00]: and you start to understand what your costs are

[00:17:04] [SPEAKER_00]: as they're knocking those things out. Does that make sense?

[00:17:07] [SPEAKER_00]: Yeah.

[00:17:09] [SPEAKER_00]: And then you can start getting the needle moved

[00:17:12] [SPEAKER_00]: with not as much effort from your staff.

[00:17:15] [SPEAKER_00]: So that's where they're getting those pieces built out

[00:17:19] [SPEAKER_00]: without you necessarily getting a ton of your staff

[00:17:24] [SPEAKER_00]: consumed by that.

[00:17:26] [SPEAKER_00]: But you still need to have someone who's going to be

[00:17:29] [SPEAKER_00]: a representative of point of contact for that organization

[00:17:31] [SPEAKER_00]: who's going to be working with those consulting companies

[00:17:33] [SPEAKER_00]: making sure that they're staying on task

[00:17:35] [SPEAKER_00]: with the design of what you have outlined

[00:17:37] [SPEAKER_00]: and that you make sure that when they turn the keys over

[00:17:40] [SPEAKER_00]: to what you have, it's what you were expecting.

[00:17:42] [SPEAKER_00]: Yeah.

[00:17:43] [SPEAKER_02]: So it still kind of goes back to what you were saying

[00:17:45] [SPEAKER_02]: with option A where realistically it takes two people.

[00:17:49] [SPEAKER_00]: Right.

[00:17:50] [SPEAKER_02]: So that second person technically for option B

[00:17:52] [SPEAKER_02]: has to be somebody inside of your organization

[00:17:56] [SPEAKER_02]: that knows your organization.

[00:17:57] [SPEAKER_02]: Yeah.

[00:17:58] [SPEAKER_00]: You're going to have a point of contact,

[00:17:59] [SPEAKER_00]: but they're not going to be as responsible

[00:18:02] [SPEAKER_00]: for the actual implementation of it

[00:18:05] [SPEAKER_00]: by turning the dials and the knobs and switches.

[00:18:08] [SPEAKER_00]: They're just there to make sure that the vision

[00:18:10] [SPEAKER_00]: is actually happening,

[00:18:11] [SPEAKER_00]: but they're not really turning those knobs.

[00:18:13] [SPEAKER_00]: Whereas in option A,

[00:18:14] [SPEAKER_00]: they're active participant in doing a lot of those pieces.

[00:18:18] [SPEAKER_00]: So in option B,

[00:18:19] [SPEAKER_00]: you're really just taking the big design that you have

[00:18:23] [SPEAKER_00]: and you're just carving it up into bite-sized chunks

[00:18:25] [SPEAKER_00]: and you're just doing them in projects.

[00:18:27] [SPEAKER_00]: And that includes the architecture design,

[00:18:30] [SPEAKER_00]: the documentation piece,

[00:18:31] [SPEAKER_00]: and making sure they all combine together

[00:18:34] [SPEAKER_00]: and having all those deliverables given back to you

[00:18:37] [SPEAKER_00]: so that you do that.

[00:18:38] [SPEAKER_00]: But now you've got that, right?

[00:18:42] [SPEAKER_00]: That's when you kick into the maintenance piece.

[00:18:43] [SPEAKER_00]: Like how do you,

[00:18:44] [SPEAKER_00]: what do you do after you know how this thing

[00:18:46] [SPEAKER_00]: turned over to you?

[00:18:47] [SPEAKER_00]: It doesn't just all stop.

[00:18:49] [SPEAKER_00]: Right.

[00:18:49] [SPEAKER_00]: So it's going to take somebody on staff

[00:18:52] [SPEAKER_00]: a significant amount of time to make sure that that maintenance piece,

[00:18:57] [SPEAKER_00]: that's where you've got to really think about,

[00:18:58] [SPEAKER_00]: well,

[00:18:59] [SPEAKER_00]: what it would be better to engage with the managed service company

[00:19:02] [SPEAKER_00]: that is going to do those projects pieces

[00:19:05] [SPEAKER_00]: and they're going to be there for an maintenance piece

[00:19:07] [SPEAKER_00]: to reduce our overhead of our labor consumption

[00:19:11] [SPEAKER_00]: inside our staff.

[00:19:13] [SPEAKER_00]: Because you got Sally or Bob

[00:19:14] [SPEAKER_00]: and they're doing your estimating,

[00:19:17] [SPEAKER_00]: but they also get 80% of their day is tied up

[00:19:19] [SPEAKER_00]: just CMMC things,

[00:19:21] [SPEAKER_00]: even if you don't want them to do that

[00:19:23] [SPEAKER_00]: because you don't have,

[00:19:27] [SPEAKER_00]: the sight or vision to see what that's going to do to that person

[00:19:31] [SPEAKER_00]: and you want them to have a lot of responsibilities

[00:19:34] [SPEAKER_00]: around that CMMC engagement.

[00:19:35] [SPEAKER_00]: It's going to tie them up quite a bit.

[00:19:38] [SPEAKER_00]: So that's where,

[00:19:39] [SPEAKER_00]: and if you go with option B,

[00:19:40] [SPEAKER_00]: you want to think about

[00:19:43] [SPEAKER_00]: what that consulting company is going to do

[00:19:46] [SPEAKER_00]: not only to get you ready

[00:19:48] [SPEAKER_00]: and get you what you need,

[00:19:49] [SPEAKER_00]: but moving forward,

[00:19:50] [SPEAKER_00]: how are they going to help make sure that what you need

[00:19:53] [SPEAKER_00]: is going to be a continuous maintenance process

[00:19:56] [SPEAKER_00]: that you're not going to just do one of your staff members

[00:19:59] [SPEAKER_00]: to 80% of their day for the rest of their life.

[00:20:02] [SPEAKER_02]: Right.

[00:20:03] [SPEAKER_00]: Be doing that or is the company

[00:20:04] [SPEAKER_00]: that you're engaging with going to do that?

[00:20:06] [SPEAKER_00]: Are they going to do that maintenance piece?

[00:20:08] [SPEAKER_00]: So that's where the shared matrix really comes into play.

[00:20:11] [SPEAKER_00]: Yes.

[00:20:12] [SPEAKER_00]: Understanding who's going to take the assumption

[00:20:13] [SPEAKER_00]: responsibilities of those maintenance pieces.

[00:20:16] [SPEAKER_02]: Yes.

[00:20:16] [SPEAKER_02]: And we talked literally just our last episode

[00:20:20] [SPEAKER_02]: was about asking the questions to an MSP,

[00:20:24] [SPEAKER_02]: you know, that consultant piece

[00:20:26] [SPEAKER_02]: to make sure that you're picking the right one.

[00:20:29] [SPEAKER_02]: I do have a specific question about that process though.

[00:20:32] [SPEAKER_02]: That person inside of the organization

[00:20:36] [SPEAKER_02]: that would be working with that consultant

[00:20:39] [SPEAKER_02]: outside of the organization.

[00:20:41] [SPEAKER_02]: What are your thoughts about,

[00:20:43] [SPEAKER_02]: do they need to have any sort of education?

[00:20:45] [SPEAKER_02]: Do you think like, would you recommend them to know something?

[00:20:49] [SPEAKER_02]: Go through some sort of course.

[00:20:50] [SPEAKER_02]: What are your thoughts about that?

[00:20:52] [SPEAKER_00]: Yeah, that's a good question.

[00:20:53] [SPEAKER_00]: I think the person that you're going to make the point of contact

[00:20:55] [SPEAKER_00]: depending on how you want to engage,

[00:20:57] [SPEAKER_00]: you want to think about how much time do you want that person

[00:20:59] [SPEAKER_00]: to be allocated to that responsibility of CMMC.

[00:21:03] [SPEAKER_00]: If you're like, I only want them to spend a few hours a week on it.

[00:21:09] [SPEAKER_00]: If that's the case,

[00:21:10] [SPEAKER_00]: do you really want to spend a lot of time

[00:21:12] [SPEAKER_00]: on that person being pretty well educated,

[00:21:16] [SPEAKER_00]: well rounded around CMMC?

[00:21:18] [SPEAKER_00]: That's where you start really having to lean into your consultant

[00:21:21] [SPEAKER_00]: that you're going to have on a maintenance continuous process.

[00:21:25] [SPEAKER_00]: I mean, a service provider or, you know,

[00:21:27] [SPEAKER_00]: a consultant that you're going to have that engagement with

[00:21:29] [SPEAKER_00]: for many years to come.

[00:21:30] [SPEAKER_00]: That's where you could possibly slide that across the table

[00:21:34] [SPEAKER_00]: and say, you know, these are the types of things

[00:21:36] [SPEAKER_00]: that we need you to do.

[00:21:37] [SPEAKER_00]: We'll handle some basic change control processes

[00:21:41] [SPEAKER_00]: that we have to hand over to you.

[00:21:43] [SPEAKER_00]: We'll handle background checks.

[00:21:45] [SPEAKER_00]: We'll handle doing some things like the camera controls

[00:21:48] [SPEAKER_00]: or other types of things.

[00:21:50] [SPEAKER_00]: You know, they could take a smaller,

[00:21:51] [SPEAKER_00]: much smaller subsection of those pieces

[00:21:53] [SPEAKER_00]: and not have to have such a responsibility burden.

[00:21:56] [SPEAKER_00]: But that's where the design you kind of have to think about.

[00:21:59] [SPEAKER_00]: How are you going to hash that up?

[00:22:01] [SPEAKER_00]: That's where the Sure Matrix kind of comes into play.

[00:22:04] [SPEAKER_00]: If you want that person to consume a much larger piece

[00:22:09] [SPEAKER_00]: of that puzzle and the main responsibility,

[00:22:11] [SPEAKER_00]: absolutely need to get education.

[00:22:13] [SPEAKER_00]: They need to really dive into learning.

[00:22:15] [SPEAKER_00]: And I would start off with the CCP.

[00:22:19] [SPEAKER_00]: Yeah, that's where I would kind of like,

[00:22:22] [SPEAKER_00]: first, how much time do I want to spend?

[00:22:24] [SPEAKER_00]: If I wanted to eat a lot more of the CMMC pie,

[00:22:28] [SPEAKER_00]: then definitely send them down the education piece.

[00:22:31] [SPEAKER_02]: Yeah.

[00:22:32] [SPEAKER_02]: Okay.

[00:22:32] [SPEAKER_02]: Yeah, that's good to know.

[00:22:33] [SPEAKER_02]: And so really the moral of the story is this CMMC journey

[00:22:39] [SPEAKER_02]: is going to cost a lot.

[00:22:41] [SPEAKER_02]: But the options that we just said, option A or option B,

[00:22:44] [SPEAKER_02]: option A is definitely going to cost a company more

[00:22:50] [SPEAKER_02]: than option B, would you say?

[00:22:53] [SPEAKER_00]: I think so.

[00:22:54] [SPEAKER_00]: And you think yourself, wait a minute.

[00:22:56] [SPEAKER_00]: I just hired the people.

[00:22:57] [SPEAKER_00]: Wouldn't it be cheaper than it would be to just kind of,

[00:23:02] [SPEAKER_00]: organizations to just outsource that responsibility?

[00:23:05] [SPEAKER_00]: I don't think so.

[00:23:06] [SPEAKER_00]: I think when you take the cost of hiring those people

[00:23:08] [SPEAKER_00]: and stretching it across a year to two time,

[00:23:11] [SPEAKER_00]: and you look at all the effort and costs

[00:23:13] [SPEAKER_00]: that's going to get you there,

[00:23:14] [SPEAKER_00]: I think doing a targeted outsourced solution

[00:23:18] [SPEAKER_00]: of getting you ready for CMMC is probably the best bet

[00:23:21] [SPEAKER_00]: for you unless you're well north of 100 people.

[00:23:24] [SPEAKER_00]: You really are much larger company

[00:23:26] [SPEAKER_00]: and you need to have full-time staff

[00:23:30] [SPEAKER_00]: and build your own IT infrastructure

[00:23:32] [SPEAKER_00]: and your own IT department that are doing those types of things.

[00:23:36] [SPEAKER_00]: And to be honest with you,

[00:23:36] [SPEAKER_00]: you should already have that in place, right?

[00:23:38] [SPEAKER_00]: Yeah, right.

[00:23:39] [SPEAKER_00]: If you're of that size,

[00:23:40] [SPEAKER_00]: you should probably already have that.

[00:23:41] [SPEAKER_00]: Now you're just talking about,

[00:23:42] [SPEAKER_00]: well how can we use the people that we've got

[00:23:44] [SPEAKER_00]: and what do we might need to do

[00:23:46] [SPEAKER_00]: to move our organization in a safer direction to do that?

[00:23:49] [SPEAKER_00]: That's a different conversation.

[00:23:50] [SPEAKER_02]: Yeah, well that's a conversation

[00:23:52] [SPEAKER_02]: that we're going to have later

[00:23:53] [SPEAKER_02]: because that really goes into time, right?

[00:23:57] [SPEAKER_02]: Because we're going to then start talking about,

[00:24:02] [SPEAKER_02]: okay, if you already have some of those people

[00:24:04] [SPEAKER_02]: and they're on your staff,

[00:24:06] [SPEAKER_02]: but that's still going to cost some kind of money

[00:24:08] [SPEAKER_02]: because that's going to cost their time,

[00:24:10] [SPEAKER_02]: which is your money, right?

[00:24:14] [SPEAKER_02]: So it goes into another lane

[00:24:17] [SPEAKER_02]: that we'll definitely be talking about later.

[00:24:20] [SPEAKER_00]: I'm looking forward to that one.

[00:24:21] [SPEAKER_00]: But let's kind of close the book

[00:24:23] [SPEAKER_00]: on that last piece of maintenance.

[00:24:25] [SPEAKER_00]: We sort of talked about it early

[00:24:26] [SPEAKER_00]: and we said, hey look, it's, you know,

[00:24:28] [SPEAKER_00]: if you're well designed and set up as an organization,

[00:24:32] [SPEAKER_00]: if you've got good passing processes,

[00:24:35] [SPEAKER_00]: if you've got the good updates,

[00:24:37] [SPEAKER_00]: you've got good change control processes,

[00:24:39] [SPEAKER_00]: you've got those things in place already,

[00:24:41] [SPEAKER_00]: but you're not really tackling CMMC yet.

[00:24:44] [SPEAKER_00]: You could take your budget that you have

[00:24:46] [SPEAKER_00]: for your 365 and other types of services

[00:24:48] [SPEAKER_00]: and your IT budget that you have.

[00:24:50] [SPEAKER_00]: If you multiply that times three,

[00:24:52] [SPEAKER_00]: you're going to be within probably the ballpark

[00:24:54] [SPEAKER_00]: of what you're looking at potentially cost wise.

[00:24:56] [SPEAKER_00]: Could be two, could be four times what you're paying.

[00:24:59] [SPEAKER_00]: This just depends on the maturity level

[00:25:01] [SPEAKER_00]: of your organization and where you're at when you start.

[00:25:04] [SPEAKER_02]: Which we can't answer that.

[00:25:06] [SPEAKER_02]: We're not all knowing.

[00:25:08] [SPEAKER_00]: You can't, but it does give you a general idea

[00:25:11] [SPEAKER_00]: of where you can kind of put your thumb in the air

[00:25:14] [SPEAKER_00]: and go, hmm, okay, that doesn't sound great

[00:25:17] [SPEAKER_00]: or that sounds awesome.

[00:25:19] [SPEAKER_00]: And the reason why I wanted to talk about

[00:25:22] [SPEAKER_00]: the maintenance piece is you need to have someone

[00:25:26] [SPEAKER_00]: who is going to be responsible

[00:25:27] [SPEAKER_00]: for generating the evidence after you've built the system.

[00:25:32] [SPEAKER_02]: Yeah.

[00:25:33] [SPEAKER_00]: Okay, so let's pretend, Kaylee,

[00:25:35] [SPEAKER_00]: that I give you a perfectly designed CMMC ecosystem.

[00:25:38] [SPEAKER_00]: I've got the documents, the policies, the procedures,

[00:25:41] [SPEAKER_00]: the architecture, all of that.

[00:25:43] [SPEAKER_00]: I've got it ready.

[00:25:44] [SPEAKER_00]: But I don't have any evidence.

[00:25:47] [SPEAKER_00]: It's not going to pass.

[00:25:48] [SPEAKER_02]: Yeah.

[00:25:49] [SPEAKER_00]: Because the auditor needs to be able to say,

[00:25:50] [SPEAKER_00]: okay, did you have a change control system?

[00:25:53] [SPEAKER_00]: Well, show me your change control process.

[00:25:55] [SPEAKER_00]: Yeah.

[00:25:55] [SPEAKER_00]: You went through it.

[00:25:56] [SPEAKER_00]: Well, I have this policy here, but you never did it.

[00:25:58] [SPEAKER_00]: You haven't done it.

[00:26:00] [SPEAKER_00]: You haven't actually completed any of that.

[00:26:03] [SPEAKER_02]: For the GenC people listening,

[00:26:05] [SPEAKER_02]: we like to call that the receipts.

[00:26:07] [SPEAKER_00]: Okay.

[00:26:08] [SPEAKER_00]: All right.

[00:26:09] [SPEAKER_02]: Show me the receipts.

[00:26:11] [SPEAKER_02]: That's what we would say.

[00:26:12] [SPEAKER_00]: I feel so educated now.

[00:26:14] [SPEAKER_02]: That's the one part that I can bring to this table.

[00:26:17] [SPEAKER_00]: Thank you.

[00:26:18] [SPEAKER_00]: You're welcome.

[00:26:20] [SPEAKER_00]: The translator today for GenC will be Kaylee Floyd.

[00:26:24] [SPEAKER_00]: So you've got to really think about building that evidence.

[00:26:29] [SPEAKER_00]: So that person is not only maintaining the basic checklist of things

[00:26:33] [SPEAKER_00]: that have to happen,

[00:26:34] [SPEAKER_00]: they have to do the fastidious, diligent work of keeping the

[00:26:38] [SPEAKER_00]: evidence and putting it away that as you've built the system

[00:26:41] [SPEAKER_00]: and spent the time and money to get it done,

[00:26:43] [SPEAKER_00]: that you're now building the evidence that's going to help you

[00:26:46] [SPEAKER_00]: pass.

[00:26:47] [SPEAKER_00]: This is, I tell you, it is the red zone of the end zone when it

[00:26:51] [SPEAKER_00]: comes to football.

[00:26:53] [SPEAKER_00]: So many people will focus on the design.

[00:26:55] [SPEAKER_00]: They'll get there and they will not put it in the end zone

[00:26:58] [SPEAKER_00]: because they just can't get the evidence process going.

[00:27:03] [SPEAKER_00]: What typically the failure is is they haven't built the

[00:27:07] [SPEAKER_00]: design but they haven't translated it to the people to

[00:27:09] [SPEAKER_00]: understand that this is how they need to operate so as

[00:27:12] [SPEAKER_00]: they're operating, they can build the evidence for you.

[00:27:15] [SPEAKER_00]: So as they go about doing their business the way they're

[00:27:18] [SPEAKER_00]: supposed to be doing it,

[00:27:18] [SPEAKER_00]: they should be building the evidence in your collective.

[00:27:21] [SPEAKER_00]: So that's the first challenge with the maintenance piece

[00:27:23] [SPEAKER_00]: that you need to think about is doing that,

[00:27:29] [SPEAKER_00]: building that evidence over time that you have to stay on top

[00:27:33] [SPEAKER_00]: of and make sure that you're doing that.

[00:27:35] [SPEAKER_00]: And that's either if you're outsourcing to some other

[00:27:38] [SPEAKER_00]: company, they need to be making sure they're tracking the

[00:27:40] [SPEAKER_00]: evidence and the stuff that is on your plate that you have to

[00:27:43] [SPEAKER_00]: be doing.

[00:27:44] [SPEAKER_02]: Yeah, it still needs to be happening.

[00:27:45] [SPEAKER_02]: It's either option A or option B.

[00:27:47] [SPEAKER_02]: Yeah.

[00:27:49] [SPEAKER_00]: Absolutely.

[00:27:50] [SPEAKER_00]: And the last piece a lot of times people don't think

[00:27:51] [SPEAKER_00]: about this for the maintenance piece is as you're coming

[00:27:54] [SPEAKER_00]: into after you've completed the design,

[00:27:56] [SPEAKER_00]: you have the capital expenses,

[00:27:58] [SPEAKER_00]: the other project pieces that you had to do.

[00:28:01] [SPEAKER_00]: How are you going to return on investment?

[00:28:04] [SPEAKER_00]: How are you going to take this whole CMMC journey

[00:28:07] [SPEAKER_00]: that you've just done?

[00:28:09] [SPEAKER_00]: You put it in the end zone, everybody's high five and you do

[00:28:11] [SPEAKER_00]: your little end zone dance.

[00:28:13] [SPEAKER_00]: And then like how are you going to take that cost and apply

[00:28:17] [SPEAKER_00]: that to the different bids that you might be doing

[00:28:21] [SPEAKER_00]: or the services you're going to be providing to clients

[00:28:24] [SPEAKER_00]: or whatever that might be.

[00:28:26] [SPEAKER_00]: You need to be thinking about now that I've gotten

[00:28:30] [SPEAKER_00]: to the end zone, how do I recoup this cost?

[00:28:33] [SPEAKER_00]: How do I look at the maintenance piece and inject

[00:28:35] [SPEAKER_00]: that into our costs that we have so that we are making sure

[00:28:38] [SPEAKER_00]: that we are getting the right margins moving forward?

[00:28:41] [SPEAKER_00]: And that's something that a lot of people I think don't

[00:28:44] [SPEAKER_00]: necessarily always think about as they're starting

[00:28:46] [SPEAKER_00]: that journey, but you really want to be eye on the prize

[00:28:49] [SPEAKER_00]: that once we get the end zone, how can we amitrize

[00:28:52] [SPEAKER_00]: that across our costs to make sure that we're making

[00:28:54] [SPEAKER_00]: the margins for the part that we're building or whatever

[00:28:56] [SPEAKER_00]: it is that you're doing.

[00:28:57] [SPEAKER_02]: Yeah.

[00:28:58] [SPEAKER_02]: Yeah.

[00:28:58] [SPEAKER_02]: You definitely do need to make money.

[00:29:01] [SPEAKER_02]: This isn't all just for funsies, right?

[00:29:03] [SPEAKER_01]: Right.

[00:29:05] [SPEAKER_02]: Yeah.

[00:29:06] [SPEAKER_02]: Anything else that you want to talk about specifically

[00:29:09] [SPEAKER_02]: when it comes to cost in the Scoping and Design

[00:29:12] [SPEAKER_02]: Implementation or Maintenance Pieces?

[00:29:15] [SPEAKER_00]: Yeah.

[00:29:15] [SPEAKER_00]: When you start looking at that return of investment,

[00:29:17] [SPEAKER_00]: that's where tracking that cost is so critical.

[00:29:20] [SPEAKER_00]: Oh yeah.

[00:29:20] [SPEAKER_00]: As you're going through, you want to look at the project

[00:29:23] [SPEAKER_00]: piece, the maintenance piece and all that

[00:29:25] [SPEAKER_00]: and you start want to tallying that number

[00:29:27] [SPEAKER_00]: because most organizations that are really successful,

[00:29:30] [SPEAKER_00]: they're used to knowing how to do that on a normal basis

[00:29:33] [SPEAKER_00]: of how they operate.

[00:29:34] [SPEAKER_00]: They just need to take that and follow the knowledge

[00:29:36] [SPEAKER_00]: that they have and re-implement that back into

[00:29:39] [SPEAKER_00]: the costs that they're having.

[00:29:40] [SPEAKER_00]: And that's not a lot of things that people talk about

[00:29:42] [SPEAKER_00]: when it comes about maintenance because they just assume

[00:29:44] [SPEAKER_00]: businesses know how to do the business things.

[00:29:47] [SPEAKER_00]: But a lot of times, I think organizations are put

[00:29:50] [SPEAKER_00]: under such pressure to get CMMC done that.

[00:29:53] [SPEAKER_00]: They don't necessarily always think about that.

[00:29:55] [SPEAKER_02]: Right?

[00:29:56] [SPEAKER_01]: Yeah.

[00:29:56] [SPEAKER_00]: And some of those contracts can take a period of time,

[00:29:59] [SPEAKER_00]: right?

[00:30:00] [SPEAKER_01]: Mm-hmm.

[00:30:01] [SPEAKER_00]: If you get priced out, you may not have included

[00:30:05] [SPEAKER_00]: all those costs that you think you might have,

[00:30:07] [SPEAKER_00]: but you already have those contracts out.

[00:30:09] [SPEAKER_00]: So you need to kind of think about kind of that

[00:30:11] [SPEAKER_00]: queue time and the hopper that you have to do

[00:30:13] [SPEAKER_00]: and how you want to space that out so that then

[00:30:16] [SPEAKER_00]: you can kind of pick the time, okay,

[00:30:18] [SPEAKER_00]: I want to get certified now at this point.

[00:30:21] [SPEAKER_00]: And I'm going to take this cost.

[00:30:22] [SPEAKER_00]: I'm going to drag this across.

[00:30:24] [SPEAKER_00]: Mm-hmm.

[00:30:24] [SPEAKER_00]: And then as we're bidding here is we're going

[00:30:26] [SPEAKER_00]: to start raising our costs to accommodate for this piece

[00:30:29] [SPEAKER_00]: because this is, and these are the things that you

[00:30:31] [SPEAKER_00]: sort of want to be tracking so that you can go ahead

[00:30:34] [SPEAKER_00]: and recoup those costs for CMMC.

[00:30:36] [SPEAKER_00]: And now a lot of people are hoping that they might be able

[00:30:40] [SPEAKER_00]: to get some grants and other things.

[00:30:41] [SPEAKER_00]: Not really an expert about that, but I think there might be

[00:30:44] [SPEAKER_00]: some in different state and local governments

[00:30:47] [SPEAKER_00]: that might help in some of those areas.

[00:30:48] [SPEAKER_00]: I've heard some people say in Texas and other places

[00:30:50] [SPEAKER_00]: have been able to get some interesting funding

[00:30:54] [SPEAKER_00]: and some other things, especially for SMBs.

[00:30:57] [SPEAKER_02]: Mm-hmm.

[00:30:58] [SPEAKER_02]: Okay.

[00:30:59] [SPEAKER_02]: Yeah, that's really helpful.

[00:31:01] [SPEAKER_02]: The more we talk about this subject of time,

[00:31:04] [SPEAKER_02]: getting real about time, I'm getting more excited

[00:31:07] [SPEAKER_02]: about the next ones too.

[00:31:09] [SPEAKER_02]: You know, it's like a little hidden piece

[00:31:11] [SPEAKER_02]: and I'm ready to unlock kind of.

[00:31:12] [SPEAKER_00]: Yeah, and me and Adam are actually going to be doing

[00:31:15] [SPEAKER_00]: a podcast that's going to be coming out.

[00:31:18] [SPEAKER_00]: We're going to be talking about how do you know

[00:31:19] [SPEAKER_00]: when you're ready and the time that's going to be

[00:31:21] [SPEAKER_00]: involved in knowing when you're ready.

[00:31:24] [SPEAKER_00]: That was, you know, this is based on our experience

[00:31:26] [SPEAKER_00]: of what we did and it's not freaking easy.

[00:31:28] [SPEAKER_00]: Let me tell you.

[00:31:29] [SPEAKER_00]: No.

[00:31:30] [SPEAKER_00]: It's tough.

[00:31:31] [SPEAKER_01]: Yeah.

[00:31:32] [SPEAKER_02]: No, I'm excited for that one too.

[00:31:34] [SPEAKER_02]: I'm sure Adam's got those nuggets of wisdom

[00:31:37] [SPEAKER_02]: that are just going.

[00:31:38] [SPEAKER_00]: Oh yeah, he's chopping at the bit to get going.

[00:31:40] [SPEAKER_02]: He's ready.

[00:31:41] [SPEAKER_02]: He's ready to talk about it.

[00:31:42] [SPEAKER_02]: He just went through it and he's ready to talk about it.

[00:31:45] [SPEAKER_00]: I'm sure you are too.

[00:31:46] [SPEAKER_00]: He's got any.

[00:31:47] [SPEAKER_00]: I'm going to do a Gen Z term here.

[00:31:48] [SPEAKER_00]: He's got the T.

[00:31:49] [SPEAKER_02]: Wow, he's got the T.

[00:31:51] [SPEAKER_02]: Did I say that right?

[00:31:53] [SPEAKER_02]: Yeah, I love it.

[00:31:54] [SPEAKER_02]: That's great.

[00:31:54] [SPEAKER_00]: I feel, I feel so Gen Z.

[00:31:57] [SPEAKER_02]: There is going to be a part of this podcast where I realize

[00:32:00] [SPEAKER_02]: that I am now getting old and that is just unfortunate.

[00:32:04] [SPEAKER_02]: You know,

[00:32:04] [SPEAKER_00]: We have in the wings Cassie my daughter.

[00:32:07] [SPEAKER_00]: So we can step her in and yeah.

[00:32:09] [SPEAKER_00]: And at this point you've sat in and so many C.

[00:32:11] [SPEAKER_00]: M.

[00:32:11] [SPEAKER_00]: C.

[00:32:12] [SPEAKER_00]: Discussions you probably could just move over to the

[00:32:13] [SPEAKER_00]: engineer's spot and she can take over hosting.

[00:32:17] [SPEAKER_02]: I won't promise any title change at this moment, but.

[00:32:22] [SPEAKER_02]: We'll see.

[00:32:24] [SPEAKER_02]: I love it.

[00:32:25] [SPEAKER_02]: Well, thank you Bobby for being real about the cost as much as we

[00:32:29] [SPEAKER_02]: can.

[00:32:29] [SPEAKER_02]: Again,

[00:32:30] [SPEAKER_02]: We do not own the C. M. M. C. Bible and we are not C. M. M.

[00:32:33] [SPEAKER_02]: C. Jesus.

[00:32:34] [SPEAKER_02]: So this is just our perspective on this topic.

[00:32:38] [SPEAKER_00]: So don't troll us.

[00:32:39] [SPEAKER_02]: Yeah, please.

[00:32:39] [SPEAKER_02]: I'm begging you.

[00:32:40] [SPEAKER_02]: I can't take much.

[00:32:42] [SPEAKER_02]: Yeah.

[00:32:42] [SPEAKER_02]: So I just hope that our journey and what we've learned

[00:32:47] [SPEAKER_02]: will help you guys as much as, as much as we can.

[00:32:51] [SPEAKER_02]: And you know, we want to hear from you.

[00:32:53] [SPEAKER_02]: So if you have anything to add questions, comments, your

[00:32:57] [SPEAKER_02]: opinions on, you know, where your company's at through it,

[00:33:00] [SPEAKER_02]: we'd love to hear your journeys.

[00:33:01] [SPEAKER_02]: Please share it with us either on LinkedIn on YouTube in

[00:33:05] [SPEAKER_02]: the comment section and make sure to, you know, like our

[00:33:08] [SPEAKER_02]: podcast and follow it just so that you're notified anytime

[00:33:11] [SPEAKER_02]: we post a new video.

[00:33:13] [SPEAKER_02]: But just remember Thursdays are the climbing Mount C.

[00:33:16] [SPEAKER_02]: M.

[00:33:16] [SPEAKER_02]: M.

[00:33:16] [SPEAKER_02]: C.

[00:33:16] [SPEAKER_02]: Day.

[00:33:16] [SPEAKER_02]: So we'll promise, we'll promise a podcast every Thursday.

[00:33:19] [SPEAKER_02]: We're here for you.

[00:33:20] [SPEAKER_02]: Um, we hope you guys enjoyed today's let's get real about

[00:33:24] [SPEAKER_02]: cost podcast and make sure to look out for the next,

[00:33:28] [SPEAKER_02]: next one on let's get real.

[00:33:31] [SPEAKER_02]: And I believe the next one is actually going to be talking

[00:33:35] [SPEAKER_02]: about time, which I'm very excited about.

[00:33:38] [SPEAKER_02]: So be on the lookout for that one.

[00:33:40] [SPEAKER_02]: We hope you guys enjoyed sitting down with us today

[00:33:43] [SPEAKER_02]: and make sure to keep on climbing.

[00:33:46] [SPEAKER_02]: Bye guys.

[00:33:47] [SPEAKER_02]: Make sure to follow us on LinkedIn and YouTube to stay up

[00:33:50] [SPEAKER_02]: to date on the latest CMMC news.

[00:33:53] [SPEAKER_02]: We hope you guys enjoyed today's episode and listen

[00:33:55] [SPEAKER_02]: out for the next one, but until then, keep on climbing.