Let's Get Real (Miniseries)

[00:00:00] Welcome back climbers, I'm your co-host Kaylee Floyd and this is another episode of Climbing Mount CMMC Hello everyone and welcome back to Climbing Mount CMMC the podcast. We are so excited to share with

[00:00:18] you guys a new series that we're starting, floor part series and we're kind of calling it Lets Get Real because what we're doing in this series is really talking about the realistic

[00:00:31] expectations when you are starting your CMMC journey. Now Bobby has gotten hit in the face with a lot of these right because we're doing this right now as a company so we just wanted to share with you

[00:00:45] guys our experience so far what we've learned from it. We're going to do four episodes after this one and we're going to talk about four different realistic expectations. Now these four are cost, resource, impact and time. And I'm really excited because in today's episode Bobby is going

[00:01:07] to break these down just give you a little bit of a cliff notes version of what we're going to talk about in each one of these. So without further ado let's talk about the first one which is cost

[00:01:20] now that's a really big one to start it off it's a heavy hitter so Bobby do you want to share your experience with the realistic expectations when it comes to the cost of it?

[00:01:29] Yeah we went ahead and did a podcast last year right? Yes we did. That went over this and we tried to be very transparent through it so in this episode that we will talk about costs

[00:01:43] we're going to try to give everybody a better update about what we've seen about what we're projecting the potential cost to be now for clients we didn't really talk about that as much

[00:01:52] in that podcast it was more about our journey and so we'll definitely talk about that some as well just to get everybody more up to speed about those kinds of realities because you know CMMC is still in its infancy you know the certification process is

[00:02:10] you know the cap is out and how it's supposed to happen but it's still in proposed there's just a lot of things that are still being finalized the final rule is not quite yet dropped at the time of this recording and so all that kind of culminates

[00:02:25] together to say that while we can talk about cost and how it's affecting us now it could be different in a year right? Some more vendors might come on that might make things more friendly we'll talk about some of that as well. As other organizations get more

[00:02:40] efficient at how to do it you know remember back in the day when DVDs first came out they were like a billion dollars like if you bought a 10-pack they were like a small fortune and then eventually

[00:02:51] as the manufacturers became more efficient at it the cost dropped and CMMC will be no different in that way now it won't be such a percentage probably drastic drop but there's definitely

[00:03:03] going to be efficiencies made and so some of the costs will drop but you know if your last to the bowl and the CMMC program other organizations are going to be getting contracts for you so

[00:03:15] you know you might think well then I'll just wait you know if a large percentage of your business is through contracts it takes a year at least to get up to ramped up to speed to do it so

[00:03:27] you don't want to be the last talking to the bowl that's a bad day. Right right and so you said this a little bit about how we already covered costs in sort of a different perspective

[00:03:39] right from our perspective but this one is diving more into a few different topics. There's one thing that I did want to highlight you know the cost for the tools that you're going to have to add

[00:03:53] on as a company when when climbing this journey of CMMC which that's something that we kind of touched on in our other podcast for ourselves but you've learned even more about that and how

[00:04:06] much more it costs even from recording that podcast so just like things like that that we're going to add in that we didn't necessarily talk about in the last one. Yeah we're gonna once again

[00:04:17] try to be as transparent as we can so it's definitely something you want to tune in to get a better idea. What we're going to talk about may not necessarily perfectly translate to

[00:04:25] you but I think that can kind of give you a general idea well if he's here where they are thinking that's where they are I think it might be logical to assume I might be here. Right and

[00:04:38] that at least kind of starts to give you some some different points of data that you can then start to kind of map your your location in the three-dimensional space of CMMC. Yes yeah no

[00:04:48] that's a great point so once we talk about cost we're also going to be talking about resources so you know one thing that we mentioned when we were creating the news was you said

[00:05:02] what qualifies as a good resource right we've said a lot of the words like snake oil out there right we've settled we've said that a couple of times in this podcast and stuff like that

[00:05:13] so do you want to dive into some of the subjects that we'll be talking about in that podcast about resources yeah the the ecosystem as it's evolving you've got

[00:05:25] you've got some pretenders I guess for a lack of a better word and what do I mean by that people that say they want to help you get where you need to get in the CMMC ecosystem but like are they

[00:05:37] going to walk onto the field with you when it's game day that's really the best analogy you know they're like I'm I'm I'm team you I'm gonna I'm gonna be on your team but then when it comes to

[00:05:46] game day they don't show up you know they they're not there during your assessment they can't give you evidence to show how they're helping you meet it they just want to be there to take your

[00:05:57] money kind of give you some suggestions on a get there but when it comes time to to actually be there did they get a level two certification or level one depending on you know you don't

[00:06:08] have a certification for one itself assessment but you get my point is like they have to know where they're going to be in the ecosystem and commit to be that in that ecosystem so when they're

[00:06:17] supporting their clients and this is from an MSP or other types of consultants so you really want to know right those resources and the people that you're going to partner with where they specifically are in the ecosystem right because there's lots of companies that say I'll help

[00:06:32] you get there but really what they're trying to do is they just want to participate as best they can but they they really want to have their feet outside and inside the ecosystem

[00:06:40] because they don't want to truly commit to it and we've made no bones about where we are in that perspective you know we're all in um and and that's what you really want to be thinking about is

[00:06:51] whoever you're partnering with um you want to understand how far in they are into the ecosystem you know oh there's C3PO well they're fully committed then they went through actually being

[00:07:00] assessed by DIPCAC uh you know it doesn't really get that much more committed than that uh so that's where as you go to connect with different people and organizations and inside and start to

[00:07:12] leverage and lean on them you want to know for a fact where they're going to be so this podcast is really going to be directed towards understanding um you know the wisdom around who you're

[00:07:25] going to partner with who you're going to work with and just get a better understanding so that when you are going to go on your journey the last thing you want to do is turn around and

[00:07:34] you know you're the only person charging the hill everybody's gone you know that's that's a bad day that's a very very bad day yeah and you know you could tackle this one too like in two different

[00:07:47] ways one you could be an msp listening to this that's like us you know that needs to understand who might need to come alongside you as an msp if you're going through your cmc journey but you

[00:07:59] could also be a business owner or somebody that needs to be certified and is starting that journey as a company he needs to know who is on their side and who needs to be on their side so you can

[00:08:10] successfully accomplish that and i'm so excited i'm so excited for that one because it really is important um i've seen it in our business so far with the people that you partner with

[00:08:21] can either make your life easier or harder right so you want it to be easier and we've really enjoyed our partnerships as well along this journey and it's like it's that that challenge doesn't matter

[00:08:33] whether you're someone who needs to get assessed and you're just know what they would call an osc or you know organization sequence seeking assessment so osa but the if you're just trying to be an organization and you might need to partner with an msp you've got to think

[00:08:50] about where they're going to be but if you're an msp and you're partnering with a vendor and they're like oh man we got you yeah we're going to get our fed ramp this year and you know we know

[00:08:58] you're going for your your certification and we're going to be ready for you buddy don't worry you know and that comes time to do your assessment and you're like do you have your fed right

[00:09:07] ah you know things kind of happen we didn't really get ready so your whole sim tool just got thrown out yeah because so much of your data is being sent to that and the vendor that you

[00:09:17] might have been counting on just they just exit stage right and you're like well what are we going to do now um so you've got to really think about those types of things and it's not just you know

[00:09:28] the smb that needs to think about the managed service provider needs to think about a lots of organizations need to really think about that because it's going to have a huge impact and

[00:09:36] when it comes time to do your assessment you got to have all the evidence and be ready to do it yes yeah and you can't have anybody leaving on you at the last minute that's going to be a

[00:09:44] bad day no and you know what's funny because you literally said the word of the next thing that we're going to talk about the next episode after that is impact the impact that it's going

[00:09:56] to have on your organization so i think we kind of place this as number three because a lot of the things that we talked about in the first two also have that impact that we're going to talk about

[00:10:07] in the third one um but a lot of people are not prepared for the change that is about to happen right so we talk about that a lot so talk more about the impact and the change that that you're

[00:10:22] going to speak about in that episode unless your organization is already in a highly compliant environment in other words you're doing work that is very very very heavily regulated and

[00:10:35] compliant based this is going to be a big punch in the face for you what i mean by that is do you have a change control process in your organization already defined that you thoroughly follow not

[00:10:47] just the people that are you know pushing papers but like top down a change control process that everybody inside your organization follows and the list just goes on and on of these different

[00:10:59] practices you're going to have to follow when you adopt cmc right not a lot of organizations have those processes robustly built out they may have been doing do d contracts for years they may

[00:11:11] have signed all the paperwork that said that they were supposed to do it but it doesn't mean that they've been doing it um and if that's the case then it's going to be a bit of punch

[00:11:19] in the face and you can't just turn to a company and say hey can you make this happen we don't really want to change we don't really want to do anything different we just want you to

[00:11:28] get a certified and it's you know it's it's kind of like you know i want to be a sumo wrestler but i want to stay on the couch and i don't want to change and i want to change my eating habits

[00:11:38] help that no like if you want to be out there you know you're going to have to wear that weird garb you're going to have to eat a lot you're going to have to do a little leg thing and then

[00:11:46] you have to have visual representation but like that's that's the truth right yeah and it starts with leadership like your leadership has to understand this it if your leadership's like

[00:12:00] just handle it you know i'm going to give this the intern just make this thing go away so that we keep our contracts you're screwed yeah um because you really have to understand that your whole

[00:12:09] organization is going to change as far as in those parts because even you know let's just say that a part of your business is going to be in scope right that you build kind of this

[00:12:19] little enclave section that still doesn't mean that your admin your hr processes that have to revolve around that your change control processes you could even try to keep change control specifically to that in scope stuff but the processes all have to come for management and upper management

[00:12:38] and flow down the hr department has to handle those things that all of that kind of stuff is typically um large-scale enterprise wide that have to be and and part of that so it's just this

[00:12:50] this assumption that you can sort of dip your toe into it and not have to fully immerse your organization yeah you can do scoping to kind of reduce some of that but it's still going to be

[00:13:02] organizationally impact wide right it just it just can't that can't be understated yeah so you just need to rep your head around that and if you're an msp oh my lord you know the change

[00:13:14] has happened for us and granted we have really kind of two different businesses right now we have our our commercial side and our cmc side um and we basically had to build the cmc piece that is

[00:13:26] going to handle but it so much of what we do comes across into the enterprise side all the way around everything and how we operate and that's a good thing uh we're safer more secure

[00:13:37] now we operate but we're going to talk about all of that and sort of get real about our experiences and help you guys try to be more realistic about that as well when you do that journey yes

[00:13:49] and the last thing that we're going to talk about that we're going to discuss the realistic truth about is the time that it takes to do all of this right so not only is it cost

[00:14:05] to costly not only does it require a lot of resources and research about those resources for you and the impact is huge inside your organization also the time it takes to get all of this set up

[00:14:21] unless you're perfect like bobby was saying before and you did all this before even going on your cmc journey the time is extensive and a lot more than maybe some would expect

[00:14:35] so do you want to talk about the time um piece about it and what you're going to specifically talk about in that episode yeah uh time man i wish i had more of it i can tell you that

[00:14:55] the reason why i say that is um i'm the CEO of my company right and i have to run my company but the same time i'm i'm playing a big part in our cmc journey like i've had to split myself into

[00:15:08] and it's been a tremendous amount of work and effort on my part i can't and we'll get into that a lot more about what that looks like and even then um there are things that have to be in place before

[00:15:19] you can really quantify time and that's the reason why it's last all right we didn't talk about it first and the reason why is all those other things have to be figured out before you can

[00:15:27] start thinking about your time you've got to have the right people and knowledge to pull it off so when you see these assumptions in time they're assuming you've got that all figured out well guess

[00:15:38] what figuring that out takes time too right right so are you gonna try to do cmc more yourself well i can say it's going to take you a year or two just knowledge of immersion yourself before

[00:15:50] you're really going to have enough understanding of that ecosystem before you could even possibly guide a company through that journey so if you're like hey intern you know you got your net

[00:16:00] plus security plus or whatever you should be okay with security stuff here help us with a cmc thing and you know here's a budget and just make it happen like that person's doomed right they can't do it on

[00:16:12] their own it's going to take them a year or two just to figure out really that ecosystem and that was if they really were serious about it maybe you let them go for a ccp and try to get uh you know

[00:16:23] more studying and that's a good thing but you know that comes back to then becoming more realistic time wise with what you're trying to accomplish the shorter time from you want the more you're going to have to involve resources outside of your company that have that knowledge

[00:16:37] and are ready to rock okay but again this goes back to knowing where they're at if you're going to have that company involved in your ecosystem and helping you get your journey better know where they are in the system themselves right where are they in the ecosystem

[00:16:52] so there's just a lot to kind of think about when you're going after this challenge is that when you're thinking about that time if if i had to guess right now based on all the knowledge

[00:17:04] that that we've learned and kaley have learned adam my leadership staff uh all of us have learned it would take eight months for us just going crazy adam working full-time he working on a

[00:17:21] part-time to be ready i would say between six to eight months easy and we've already done it once now for us right so that hopefully speak some volumes about how freaking hard this is

[00:17:37] because you've got to it's not about building a system that people could do things in okay it's about building a system of people and how they operate around that system yeah right so that's changing the culture of your team how they operate how they're connecting with

[00:17:52] that system how they're using it because you could build this perfect cmc environment but if you have trained your staff they don't know how to work with it they're going to screw it up the moment

[00:18:01] they start working in it and then you're gonna no longer be compliant anymore right so you've got to factor in the time to get your staff up to speed to understand how to be accurate and compliant why they operate their business and

[00:18:18] to find an organization outside of your company to come in and understand who you are and how you operate so that you can continue to do business like you're used to in a compliant fashion in a

[00:18:29] cmc ecosystem they built it's going to take some time and if anyone's saying anything otherwise they're probably lying to you i have yet to see something that fully integrates all of that it's just it's kind of like someone says hey i can build you a great website in

[00:18:44] you know two weeks like you don't know that company even if you could build it that fast you need to understand who they are so you can put whatever they're doing on the site that's accurate does that

[00:18:53] make sense right it's that whole time piece that needs to be factored in so you're looking at at least a year for you to really pull this off honestly uh to be able to do it and so

[00:19:05] if you're waiting so long before you start to try to pull that trigger it can be a super challenge so time's definitely something that is a big one that a lot of people underestimate so

[00:19:16] that we're going to do that last because you need to make sure you're getting all that right before we really get into the the nitty gritty of that so bobby is there any other things that you want

[00:19:24] to talk about you know between these four realistic expectations that we're going to discuss before we close it out today yeah i think no one does cmc in a box in a vacuum of understanding

[00:19:37] so we're going to be learning everybody's going to be learning through this we we're going to evolve we're going to get better at how we try to approach this and start to understand how to do it cheaper

[00:19:48] how to do it in the less time so the video that we're going to this series you know in two years you might go we were we're such kids we're so silly this is how you can do it better you know

[00:19:59] it's it this is going to evolve over time uh this is going to get better as we go to refine and work on it because there's just not enough people doing it right now but doesn't matter

[00:20:12] the you know the tux the clock is ticking and certifications are going to start happening contracts are going to start dropping the primes and subprimes are going to start requiring and having conversations with their contract organizations to say hey we're going to need you to get

[00:20:29] this done uh because we don't want that 10 or 15 or 20 business to to fall off the table we i know they're doing an a phased rollout but i need plenty of you guys to be ready to do it so that

[00:20:41] we can bid on it so while it may be a phased approach uh they're going to be pushing and putting pressure on uh that to happen so i think that's really important to think about and then you know i've just seen advertisements for organizations like on

[00:20:59] Reddit and other things like that saying we can get you ready in two to three weeks i just that's like that's like someone telling you i can guarantee you a return on your investment

[00:21:12] like if you hear that you gotta run right that that is just it's misleading at best and it's a lie at worst yeah and one thing that's for sure is this podcast is always going to be real

[00:21:29] with what we've learned we're going to be truthful with what we learned that's what we believe as an organization that's why we have our name as axiom is because we believe in the truth and so

[00:21:42] um i hope that you guys can always turn to this podcast and turn to our journey you know no matter how much it evolves and changes like bobby was saying that we will be truthful with where we're

[00:21:54] at in what we've learned so let's get real well thank you kaley for helping guide me down getting the opportunity to share what i have a passion for which is cmc and trying to just be realistic

[00:22:06] and i think this is going to be a fun series you know we're not 100 sure if we're going to do all of them specifically in order we might slide some other ones in between there uh but

[00:22:16] we are going to go through just like uh kaley outlined and if you have some other suggestions or topics you want us to talk about please hit us up in the comments or whatever media that you

[00:22:25] happen to find us and connect to us on and make sure you click on follow and that we're knowing that you're you know weighted bated breath on the next episode so uh again thank

[00:22:35] you so much kaley and for all of you joining us just remember to keep on climbing make sure to follow us on linkedin and youtube to stay up to date on the latest cmc news we hope you guys

[00:22:46] enjoyed today's episode and listen out for the next one but until then keep on climbing