Our Journey to CMMC Compliance

[00:00:01] Welcome back climbers. You're listening to another episode of Climbing Mount CMMC.

[00:00:11] In today's episode, Bobby and Adam are going to get personal about their CMMC journey

[00:00:16] and why they decided to jump into the space to begin with.

[00:00:20] So buckle up, sit back and enjoy today's episode.

[00:00:27] Climbers, today we are going to be talking with Bobby and Adam

[00:00:31] about why Axiom decided to join the CMMC ecosystem.

[00:00:35] What are some of their fears going into it? What have they learned?

[00:00:39] We're going to get into really a lot of questions that a lot of you have asked us via YouTube or LinkedIn.

[00:00:45] And we're really excited to talk about some new steps that we're taking as a company.

[00:00:49] So first I'd love to just let's zoom out for a second, okay, Bobby and Adam.

[00:00:54] And we're just going to talk a little bit more specifically to Bobby

[00:00:58] about why you wanted to start an MSP in the first place.

[00:01:02] Like what drove you to even start this journey?

[00:01:06] Yeah, I mean it was pretty scary.

[00:01:09] I had been serving and working doing IT things for several companies.

[00:01:17] In 2002, like the company I was working for had some financial difficulties

[00:01:21] and I'm like, alright, I want to go ahead and start my own business.

[00:01:25] And it was super scary to step out on my own.

[00:01:27] I didn't have any investors.

[00:01:30] Judy, my wife and I kind of talked about it and we just went after it.

[00:01:35] And it's been a wild ride.

[00:01:37] So we've been an MSP since 2002.

[00:01:41] So in dog years that's like forever.

[00:01:43] And we've learned a lot.

[00:01:45] Like when we first started, when I first started doing it,

[00:01:47] it was just me driving around and I could only see like four clients in a year

[00:01:52] or not a year a day.

[00:01:53] It felt like a year but I could only see four of them

[00:01:56] because at the time there wasn't a good remote support methodology.

[00:02:01] So if you wanted to support a client,

[00:02:02] you got in your car and drove out there and helped them.

[00:02:04] You couldn't just remote in and support them

[00:02:05] because there wasn't like Screen Connect or Splashtop

[00:02:11] or TeamViewer or any of these other remote support things.

[00:02:15] None of that was really around yet

[00:02:16] at a level that was safe and secure to use at a mass scale with a lot of clients.

[00:02:21] Just to put things in perspective on that, 2002,

[00:02:24] the iPod was a thing.

[00:02:26] We were still carrying our Sony Walkman CD players.

[00:02:29] The iPhone didn't exist yet.

[00:02:31] That was a while ago.

[00:02:32] In technology terms, it was a completely different planet to do what we did.

[00:02:37] Right.

[00:02:38] And managed services like we think of today didn't even exist then.

[00:02:41] It was more just purely break fix.

[00:02:42] Someone called you and you drove out there and you tried to help them.

[00:02:45] But over the years, it's evolved into a more proactive approach

[00:02:48] and that's something that we...

[00:02:50] It took some time for me to learn as we grew to understand

[00:02:53] you got to be proactive.

[00:02:54] You got to try to help the client.

[00:02:55] You have to understand their business.

[00:02:56] That's why our tagline is,

[00:02:58] your success is our business.

[00:03:00] You have to be as a client successful

[00:03:02] because if they're not successful, we're failing them.

[00:03:05] They're paying us to provide the efficiency and security

[00:03:08] so they don't have to look over their shoulder.

[00:03:10] And once we started to understand really what that sacred duty was

[00:03:15] it transformed the business and how we operated, how we thanked,

[00:03:18] how we hold ourselves accountable.

[00:03:20] It was quite the journey.

[00:03:22] So now that you have kind of zoomed out on the MSP, Axiom as a whole.

[00:03:30] Now Axiom has decided to really change how they operate

[00:03:36] as a company, what they're striving for in the sense of the CMMC ecosystem now.

[00:03:44] Right?

[00:03:44] So now we are climbing this mountain of CMMC and specifically

[00:03:50] certification.

[00:03:53] And so let's talk about why you decided to step into this space.

[00:03:59] So now that you have been an MSP for over 21 years, right?

[00:04:06] Now you've decided to switch to something a little bit different.

[00:04:11] A lot of it different.

[00:04:12] A lot of money different.

[00:04:14] A lot of time different.

[00:04:16] So let's talk about that because that's a really big decision for you

[00:04:19] that you've made.

[00:04:20] What made you decide to make that decision?

[00:04:23] Well, I mean, first off, like we're not doing just that.

[00:04:28] We still are serving our existing clients that we had.

[00:04:30] But what we realized is that the Defense Industrial Base was going

[00:04:38] to need somebody that had a passion for what we started back in 2002

[00:04:43] and really had and grew as a company and wanted to do.

[00:04:45] And we wanted to provide that into that space because as we started

[00:04:51] some years ago, trying to get more into making sure that we were

[00:04:55] providing that level of security that we need to.

[00:04:59] You know, me and Adam talk about all the time about where that

[00:05:02] bar needs to be for our clients.

[00:05:04] Like you want to make sure that you're not the lowest fruit

[00:05:07] on the tree because that you're going to get hit by the threat actors.

[00:05:10] You want to make sure that your security posture is well

[00:05:13] and above and that you have that bar in a position where your

[00:05:18] organization is safe and secure and you can operate.

[00:05:21] And so we wanted to do that.

[00:05:22] And we saw that as CMMC was coming out, we're like, this is going

[00:05:26] to be a challenge for a lot of companies.

[00:05:28] We love what we do.

[00:05:29] But could we do that in that space?

[00:05:32] And so that started the journey.

[00:05:34] And as I was doing it on my own, we've been on this journey

[00:05:39] for about three years now, I guess, roughly.

[00:05:42] And I started and I went and got my CCP, got certified in that.

[00:05:45] Then I tried to say, yeah, let me try doing this on my own.

[00:05:48] And I realized that it was such a massive beast to undertake.

[00:05:54] I'm like, I can't do this on my own.

[00:05:56] So last year I reached out to Adam and said, hey, you know,

[00:06:00] we've been talking over the years of just casual conversation

[00:06:03] as peers.

[00:06:04] I know you have a passion for CMMC and NIST.

[00:06:07] How about you come over here and let's try to do something

[00:06:09] that is very unique that not many MSPs, if any, have done.

[00:06:15] And you were very excited about that, right, Adam?

[00:06:18] Yeah, I think there's a little chance to get into my backstory on this.

[00:06:23] So I've pretty much worked in MSPs, pretty much my entire career.

[00:06:27] And one day at a few MSPs ago, was sitting there.

[00:06:32] I get a service ticket from a client.

[00:06:33] They made aircraft components as well as other just precision

[00:06:36] manufacturing, small shop, less than 100 people, just 20 minutes

[00:06:41] down the road.

[00:06:42] So local community, all that fun stuff, family owned business,

[00:06:45] all that jazz.

[00:06:46] And they said, hey, we need help with the cybersecurity

[00:06:49] compliant stuff for one of our DoD contracts called NIST 800-171.

[00:06:54] Can you help us out with that?

[00:06:55] And I said, ooh, cybersecurity compliance.

[00:06:57] That sounds fun.

[00:06:57] How bad could this be?

[00:07:01] Yeah, that was very young and naive of me, but it was my

[00:07:04] first taste into that.

[00:07:05] I worked with a couple other companies.

[00:07:07] I continued to kind of grow my career in that, but I kept always

[00:07:09] finding myself coming back to those frameworks and those standards.

[00:07:14] And 800-171 really kind of kept my attention.

[00:07:19] For those that don't know, I'm a huge aviation nerd and all

[00:07:22] that other fun stuff.

[00:07:22] And CMMC kind of got started because of just the sheer amount

[00:07:25] of confidential data that just leaked out of the supply chain

[00:07:28] to our adversaries.

[00:07:30] Jacob Horn has done a really good history of CMMC video

[00:07:33] and you can directly trace some of these requirements that

[00:07:36] we're dealing with back to the theft of intellectual property

[00:07:38] data from aviation systems.

[00:07:41] So here we are full circle where that's all kind of come together.

[00:07:46] And continue to try to focus on that, but CMMC 800-171,

[00:07:51] that's not the majority of SMBs out there.

[00:07:55] It's a big hill for MSPs to tackle.

[00:07:59] And I was sitting there trying to think through my next steps

[00:08:02] of my career and everything, and I get this message from this guy

[00:08:04] named Bobby on LinkedIn.

[00:08:05] And I'm like, oh, I haven't talked to him in a while.

[00:08:08] Wonder what's going on?

[00:08:09] And sure enough, that was the, hey, I know this might be a long

[00:08:11] shot, but would you be interested in just perfect timing,

[00:08:15] right opportunity, and the rest is history, so to speak.

[00:08:19] Well, it's...

[00:08:20] I don't know of very many, if any, MSPs that are this far

[00:08:27] down the path of being ready.

[00:08:28] Yeah.

[00:08:29] At the time of this recording, we went through our gap assessment

[00:08:35] and we picked our C3PO.

[00:08:38] They're actually in the process of auditing us and going through all of that.

[00:08:43] And we have to get prepared for that.

[00:08:45] It's a massive commitment.

[00:08:46] We're going to do a video to talk about that more specifically.

[00:08:49] That'll be coming out soon.

[00:08:51] If it hasn't already, I'm not...

[00:08:52] We're never really sure that the order of what the podcasts are going

[00:08:55] to be released in.

[00:08:56] I mean...

[00:08:56] Only Kayleigh knows.

[00:08:59] That's where it gets to me.

[00:09:00] Yeah.

[00:09:01] And so, but we get a lot of questions about people like,

[00:09:06] the number one question I get from MSPs is what, Adam?

[00:09:09] I'm curious to see if you're thinking the same thing I am,

[00:09:12] but what's the common question your peers that want to ask

[00:09:15] you about being an MSP doing CMMC, trying to get it set up?

[00:09:20] What's the number one thing they ask?

[00:09:23] Usually, boy, are you crazy trying to do this?

[00:09:27] Or time, right?

[00:09:28] They want to know how much time investment because a good

[00:09:32] managed service provider, one of the things they have to think about

[00:09:35] is if I'm implementing or having to set up something,

[00:09:38] what am I looking down the barrel of having to do?

[00:09:42] And I would be lying if I didn't say I wasn't eating

[00:09:46] a healthy dose of concern and fear about that

[00:09:49] and trying to make sure that we handled it with the right

[00:09:54] level of responsibility to make sure that we rose to the occasion

[00:09:58] of that because those controls, those 110 controls are no joke

[00:10:02] and they're very hard to implement for just a company by itself.

[00:10:07] But as a managed service provider, you have to then turn around

[00:10:09] and provide and help provide those to your clients.

[00:10:13] That's just...

[00:10:14] That's not easy to do.

[00:10:15] And we have a video where we've talked about the cost

[00:10:18] and we're going through that in more detail.

[00:10:20] So you can refer to those.

[00:10:22] But that was something that was really scary because

[00:10:25] we couldn't go to a peer group and say,

[00:10:27] hey, how long is this going to take?

[00:10:29] Nobody knew that.

[00:10:30] But we had a passion for the industry because we grew up

[00:10:33] knowing and loving and wanting to be in this

[00:10:36] and serve the community.

[00:10:38] And we saw immediately in the dib space that there was going to be

[00:10:41] a huge void of MSPs like us that had the experience

[00:10:44] and that passion to provide that for them.

[00:10:47] And we're like, we've got to get into this space.

[00:10:49] This is what we want to do.

[00:10:50] It's not going to be easy.

[00:10:51] But we love working hard at this.

[00:10:55] And this is going to give us an opportunity for us

[00:10:57] to differentiate ourselves to really show the people

[00:10:59] that we really care about this community

[00:11:02] and we're willing to do the work that's required

[00:11:03] to make that happen.

[00:11:05] Yeah.

[00:11:05] And I think to your point on that,

[00:11:06] the DoD themselves have said just there's tens of thousands

[00:11:09] of small businesses in the supply chain

[00:11:12] working directly with the DoD

[00:11:14] that doesn't take into account all the small to medium businesses

[00:11:17] that are subcontractors of those other businesses.

[00:11:20] So this supply chain is huge.

[00:11:22] And when you look at the data that comes out of the U.S.

[00:11:24] government, most small businesses are in fact that they're small.

[00:11:30] I think the majority of them are less than 10 employees.

[00:11:32] The majority that we deal with and see on a regular basis

[00:11:35] are less than 100 employees.

[00:11:37] And these aren't just some random person that set up a shop.

[00:11:40] They're especially where I'm from out of Northeast Ohio.

[00:11:42] They're machine shops that have been in their families

[00:11:44] for generations.

[00:11:47] That one I mentioned, I think as of, if I remember it correctly,

[00:11:50] they would have been in business for over 100 years at this point.

[00:11:53] Wow.

[00:11:54] A lot of rich history and dedication being in that.

[00:11:57] Yeah, a lot of good hard work and folks.

[00:11:58] You've got to care about that.

[00:11:59] And the data that we have for our country

[00:12:02] is important to have.

[00:12:04] And so we felt like we had a hard calling.

[00:12:07] And I knew that Adam had felt the same way

[00:12:08] as we'd had some casual conversations about it.

[00:12:10] So I was like, I got to reach out to this guy and see how we can

[00:12:14] get him to come on board and really go after this.

[00:12:17] Yeah.

[00:12:18] And it has been a crazy hard journey for us to do.

[00:12:23] Wouldn't you say?

[00:12:25] Oh, absolutely.

[00:12:26] But it's, you know, was always told, you know,

[00:12:30] work is supposed to be hard.

[00:12:32] And there's that hard work that's just worth doing.

[00:12:34] And CMMC is one of those just to kind of bring that home.

[00:12:38] Something that came up in a random phone call with a member of our

[00:12:40] team over the last week.

[00:12:43] Like I said, I'm a huge aviation nerd.

[00:12:45] So down in Dayton, we've got the National Museum of the United

[00:12:47] States Air Force and they just put out on display at one of the

[00:12:50] KC 10 aerial refueling tankers.

[00:12:54] I mentioned that to one of our teammates who served in the Air

[00:12:58] Force.

[00:12:59] And it turns out the plane that just went on display was one

[00:13:01] of the planes he likely worked on when he was in the Air

[00:13:03] Force.

[00:13:04] So this is coming full circle now because not only is it having

[00:13:07] that direct impact on us as a country, us as a community,

[00:13:10] but it's impacting our team as well.

[00:13:12] We do have several members on the team who are former military.

[00:13:16] And this kind of work directly goes to show what they,

[00:13:19] you know, goes to show and words are apparently hard today.

[00:13:23] I need more coffee.

[00:13:24] It directly impacts what they do because when, you know,

[00:13:28] our teammate would have been working on that plane,

[00:13:30] he's got to get those screws, those tools, etc.

[00:13:32] If those schematics and that sensitive data falls into the wrong

[00:13:35] hands, that could be a huge problem for those war fighters.

[00:13:39] And that's kind of that personal mission for us to really make

[00:13:42] sure we're getting it, we're getting it right in a way that

[00:13:45] kind of envelops that protection of country,

[00:13:47] our servers back to our community and just work that

[00:13:50] we enjoy doing.

[00:13:51] Yeah.

[00:13:51] And I think one of the things that's really important and

[00:13:54] a reason why we got into this space is there's going

[00:13:58] to be a rich history that's developing over time in this

[00:14:01] ecosystem.

[00:14:03] There just isn't many, if any MSPs that have come in and it

[00:14:06] reminded me of when I started my company.

[00:14:09] It reminded me of like being part of that story of growing

[00:14:15] and being better and serving the community.

[00:14:17] Like, like to me, I was like, this is a thing.

[00:14:19] This is a big thing.

[00:14:20] This is a huge deal as the, as the Deb is now switching to

[00:14:24] compliance and having to really take into consideration

[00:14:27] the security well-being of the industry as a whole and having

[00:14:30] to implement these security controls,

[00:14:32] implementing the certification, staying up to compliance

[00:14:36] levels, maintaining that.

[00:14:37] It's going to require a huge amount of dedication.

[00:14:40] And I am, I am just gobsmacked at how much of

[00:14:46] responsibility it is and how few people are up to snuff

[00:14:49] to be ready to do it.

[00:14:51] I have very real concerns that we're going to have enough

[00:14:55] MSPs to support the need and demand that is going to come

[00:15:00] our way.

[00:15:01] You know, we're kind of more of a boutique MSP.

[00:15:05] I mean, we might take 15, 20 new clients a year, if

[00:15:09] that.

[00:15:11] And the DIP space is going to need thousands in the

[00:15:16] first year of potential audits and organizations that

[00:15:20] are going to need to be taken care of.

[00:15:23] And they're going to need an MSP like us that's going to be

[00:15:26] level two certified.

[00:15:28] We're thinking that probably in the first year at them, what

[00:15:31] less than 10 MSPs will probably have a level two

[00:15:34] certification.

[00:15:35] Yeah, it's going to be a small number just because you

[00:15:38] know, going back to our previous episodes and whatnot,

[00:15:40] you know, climbing this mountain isn't easy.

[00:15:42] Yeah.

[00:15:43] And it takes plenty of time and we'll definitely be

[00:15:45] getting into that a lot more.

[00:15:47] But I know there's been plenty of MSPs that have

[00:15:49] been kind of watching from the sidelines the whole

[00:15:51] time saying we're not sure if this is what we want to do

[00:15:53] or not.

[00:15:54] Right.

[00:15:55] And it's getting very real that those decisions are going

[00:15:57] to have to be made.

[00:15:59] And the unfortunate thing is, as we know from the proposed

[00:16:01] rules that have come down in the final rules even, that

[00:16:05] SMB is selecting an MSP within the space, have to

[00:16:08] select an MSP that's been certified.

[00:16:12] And that's huge.

[00:16:13] There's not a ton of MSPs that have gone down that

[00:16:15] road yet.

[00:16:17] We know there are more in the wings waiting to go

[00:16:19] down that road or in the queue to get assessed

[00:16:21] themselves.

[00:16:22] But still, when you look at the sheer amount of SMBs

[00:16:24] in the dib, there's not enough.

[00:16:27] So I mean, we need you if you're a managed service

[00:16:29] provider and you're listening to this, like you

[00:16:31] need to get into space.

[00:16:32] You need to, it's a huge commitment.

[00:16:34] It's a very, very big deal.

[00:16:38] But you're desperately needed because, I mean,

[00:16:43] people are worried about the amount of assessors

[00:16:46] and the audit and certification bodies.

[00:16:49] Like they're called C3PO's.

[00:16:51] Are they going to have enough organizations that can

[00:16:53] do the audits?

[00:16:54] But I think the number one limiting factor is going

[00:16:56] to be companies like us.

[00:16:57] There's just not going to be very many of them.

[00:16:59] And it's going to be a real problem for the SMBs.

[00:17:03] And so we need you, you know, to step into that

[00:17:05] space.

[00:17:05] And we're kind of doing this video and hope to show

[00:17:08] people about why we got into this space and

[00:17:10] hopefully encourage others to step into it as well.

[00:17:12] Yeah.

[00:17:13] Something that I love about how you guys are

[00:17:15] talking about this is like the selfless nature that

[00:17:19] you've taken to the climb of CMMC.

[00:17:23] And what I mean by that is many of you guys, I

[00:17:25] mean, I don't feel like we fully explained why we

[00:17:29] even wanted to call this or we decided to call

[00:17:32] this podcast climbing Mount CMMC.

[00:17:35] But one of the main reasons is like we wanted to

[00:17:39] as a company climate so that we could help our

[00:17:42] clients up and it would be easier for them.

[00:17:46] You know, like if you're on a trail and there

[00:17:48] there is somebody that went before you, right?

[00:17:51] Maybe cleared some bushes away and whatnot that

[00:17:53] that climb is going to be easier for you.

[00:17:55] And that's part of the reason why we called this

[00:17:57] climbing Mount CMMC is because we wanted to

[00:18:01] climb it to be able to help others after,

[00:18:03] which I mean reflects a lot about how you guys

[00:18:05] are talking as well and the selfless nature

[00:18:07] of caring for other companies and caring for

[00:18:11] the United States, you know, and in the

[00:18:14] government contracting.

[00:18:16] And I think that that leads in to the next

[00:18:21] question that I was going to ask you guys,

[00:18:23] which is and we've touched on parts of this,

[00:18:27] but there it is a climb.

[00:18:29] There are fears going into the space.

[00:18:31] What were your top fears when entering into

[00:18:34] the space?

[00:18:35] Maybe they have changed since climbing this

[00:18:40] mountain, right?

[00:18:42] You could say maybe what your first fears were

[00:18:45] and then now going into helping clients and

[00:18:48] whatnot.

[00:18:49] What are some of your fears going into that?

[00:18:52] Bobby, maybe if you have one, you can share

[00:18:53] first and then I'll kick it over to Adam.

[00:18:57] I think the first fear that I had was

[00:19:00] when I kind of mentioned it is like when

[00:19:02] I sort of did the Google search of who out

[00:19:05] there has this knowledge that we're going

[00:19:07] to need to do because in our space,

[00:19:10] like a maintenance service provider, there's

[00:19:12] tons of peer groups that you could turn to

[00:19:14] and it's highly suggested that you be part

[00:19:16] of those because they'll help pour into

[00:19:18] you get to work with your peers and you

[00:19:20] get to see a lot of maintenance service

[00:19:22] providers how they do things and do it

[00:19:24] better.

[00:19:25] It's great.

[00:19:25] It's wonderful.

[00:19:26] There's nothing like that really until

[00:19:29] just recently you're starting to see some

[00:19:31] glimmers of hope of that starting to develop.

[00:19:33] Right?

[00:19:33] That doesn't exist for anybody in the

[00:19:36] CMMC space trying to do what we're trying

[00:19:38] to do.

[00:19:38] So quickly I realized we are literally

[00:19:41] the tip of the spear on this.

[00:19:43] We're that ship that you see in the

[00:19:47] Arctic that's kind of plowing that stuff.

[00:19:50] Like, that's us.

[00:19:51] That's what we're doing and it's

[00:19:53] painful.

[00:19:54] It's hard to do and we kind of looked

[00:19:56] at that and said but we've got a

[00:19:57] higher calling.

[00:19:58] That's what we want to do and I knew

[00:20:00] that Adam had that attitude and I know

[00:20:02] our team did and that's part of the

[00:20:04] reason why we really leaned

[00:20:06] their shoulders in and went after that.

[00:20:08] But I would say that was my number one

[00:20:09] fear going into it.

[00:20:10] It's changed over time but I'm curious

[00:20:13] what yours is on.

[00:20:15] So when I first got into

[00:20:18] 800171 and everything I looked over

[00:20:19] the controls was very young and very

[00:20:21] stupid and said this doesn't seem

[00:20:23] that hard.

[00:20:24] Like let's just go.

[00:20:25] Let's yeah encryption.

[00:20:26] Let's put encryption in there.

[00:20:27] Cool.

[00:20:28] Yeah, not a big deal.

[00:20:30] But I vividly remember Adam

[00:20:32] at the conference a good couple years

[00:20:33] ago.

[00:20:34] Good friend of mine, Joy Belinda.

[00:20:36] I think she's been a guest on the

[00:20:37] podcast as well was speaking about

[00:20:39] just CMMC and MSPs and it was going

[00:20:42] through like some of the realities.

[00:20:44] Are you an MSP that does this?

[00:20:45] Raise your hand.

[00:20:46] We're going down that route and then

[00:20:48] she starts talking about the false

[00:20:50] claims act.

[00:20:52] And my biggest fear at that point

[00:20:53] was what have I gotten wrong?

[00:20:56] Right.

[00:20:57] And what are the consequences of

[00:20:58] getting it wrong?

[00:21:00] Looking like and that's probably the

[00:21:01] thing that keeps me up at night.

[00:21:03] And Bobby you've known from as we've

[00:21:04] worked through this, like I will

[00:21:05] pick apart our controls are

[00:21:06] interpretation to the nth degree

[00:21:08] to try to figure out every possible

[00:21:09] way this could go wrong.

[00:21:11] So as you're saying, oh, I want to do

[00:21:13] it this way.

[00:21:13] I'm coming at you with the here's

[00:21:15] the 20,000 reasons this can blow

[00:21:17] up in our face.

[00:21:18] How are we going to handle that?

[00:21:19] What are we going to do about this

[00:21:21] to the point where finally I can still

[00:21:22] keep speculating about all the things

[00:21:24] that can go wrong.

[00:21:25] But we're now we're going into those

[00:21:25] weird scenarios of, you know, every

[00:21:28] planet has to align at the exact

[00:21:29] date in time.

[00:21:30] And then this one thing has to

[00:21:32] happen for to blow up in our face.

[00:21:33] But I think this is our own way of

[00:21:35] risk managing the process.

[00:21:36] Still, it still keeps me up at

[00:21:38] night, especially when we think

[00:21:39] through clients and we know that

[00:21:40] it's their businesses, their

[00:21:41] livelihoods on the line.

[00:21:43] Because if, you know, I get it

[00:21:45] wrong in those instances and they

[00:21:46] don't get a contract.

[00:21:47] Does that mean someone just

[00:21:49] lost their job because they were

[00:21:50] hurting financially?

[00:21:51] That has a direct impact on

[00:21:52] families.

[00:21:53] And I would be terrified to think

[00:21:54] that could be the result of just

[00:21:55] a sentence, I say, being taken out

[00:21:58] of context or something close

[00:21:59] lines.

[00:21:59] That's the right.

[00:22:00] I literally woke up last night

[00:22:02] having a I'm not joking, a

[00:22:04] nightmare about failing

[00:22:07] this assessment based on

[00:22:09] just one simple thing.

[00:22:12] Because if you look at

[00:22:13] the current scoring methodology

[00:22:16] of how the cap is written, 60%

[00:22:20] of the 110, let's just call them

[00:22:22] questions, but they're actually

[00:22:23] controls.

[00:22:24] But let's just simplify it and say

[00:22:25] 110 of the questions on the

[00:22:28] test, let's just make it super

[00:22:29] simple.

[00:22:30] 60 over 60% of them, if you get

[00:22:33] any of them wrong, any doesn't

[00:22:35] matter what your score is, any of

[00:22:36] them wrong, it's a fail.

[00:22:38] It's a straight fail.

[00:22:39] Like what test have you ever

[00:22:40] taken that has scored that way?

[00:22:43] None.

[00:22:44] Like, you know, I'm going to

[00:22:44] take the SAT, you know, but

[00:22:46] if I get 60% of, you know,

[00:22:47] any of those 60% questions

[00:22:49] wrong, I just fail.

[00:22:50] It doesn't matter if I got 99%,

[00:22:52] you know, whatever it's like,

[00:22:53] it's a straight fail.

[00:22:55] When you deal with that level

[00:22:58] of razor edge assessment

[00:23:02] and you factor in just what Adam

[00:23:04] was talking about that these

[00:23:05] are these companies livelihoods

[00:23:07] they've got lots of people.

[00:23:08] There's a ton of pressure.

[00:23:10] Yeah.

[00:23:10] Riding on the shoulders the

[00:23:12] MSPs that step into that space.

[00:23:13] I might not really be selling

[00:23:15] it really well for those MSPs

[00:23:17] that are thinking about getting

[00:23:17] into the space or like, that

[00:23:19] doesn't sound great.

[00:23:20] You know, it is great and

[00:23:21] I believe it's a service that is

[00:23:24] a higher calling that needs to

[00:23:25] be done.

[00:23:25] Yeah.

[00:23:26] But there's more to it than

[00:23:27] that obviously.

[00:23:27] But I think that's those

[00:23:30] kind of MSPs, like your kind

[00:23:32] of MSPs, the way that you

[00:23:33] guys are thinking that's what

[00:23:34] clients want and I'm guessing

[00:23:36] that's what they need because

[00:23:38] on the other hand, there are

[00:23:40] people that might not take

[00:23:41] this as seriously and might

[00:23:43] share a few lies here and

[00:23:45] there to try to convince

[00:23:47] somebody to go with them and

[00:23:49] they don't actually care about

[00:23:51] that business.

[00:23:52] You know, it might be stressful

[00:23:53] for you and Adam and maybe

[00:23:55] other MSPs out there that really

[00:23:57] do care about this.

[00:23:58] It's going to be stressful

[00:23:59] because you're carrying these

[00:24:01] clients on your back, you

[00:24:03] know, but that's what they

[00:24:05] need is somebody who cares

[00:24:07] for them.

[00:24:08] So I think although it might

[00:24:09] be scary, that should be

[00:24:11] inspiring to other MSPs

[00:24:13] listening to this that may

[00:24:14] care just as much as you do

[00:24:15] about their clients.

[00:24:17] If you do care, this is a

[00:24:18] great place to be.

[00:24:19] The the Dib industry is a small

[00:24:21] knit group of people and

[00:24:23] they help each other.

[00:24:25] I mean, we're part of other

[00:24:26] managed service team now that

[00:24:27] like I said, it just

[00:24:30] MSP cyber acts, which

[00:24:31] Brian Hubbard started.

[00:24:32] We're part of that now.

[00:24:34] Yeah.

[00:24:34] There's the protection for

[00:24:36] critical infrastructure, which

[00:24:37] is systems, some at

[00:24:40] seven and there's another

[00:24:43] bigger companies that kind of

[00:24:45] came together.

[00:24:46] So you're starting to see that

[00:24:47] peering that's starting to

[00:24:48] happen and they're all

[00:24:50] sharing and talking because

[00:24:52] they realize that like there's

[00:24:54] more need than any of us can

[00:24:55] handle.

[00:24:56] So we need people to be

[00:24:58] involved in.

[00:24:58] Absolutely.

[00:25:00] So I want to end today

[00:25:01] with asking we talked about

[00:25:03] the fears, but let's talk

[00:25:05] about the inspiration for a

[00:25:07] second.

[00:25:08] Like what inspired we'll

[00:25:10] talk with Adam first as

[00:25:11] Adam first.

[00:25:12] Adam, what inspired you to

[00:25:15] get into this space personally?

[00:25:17] Maybe not just as an XCM as a

[00:25:19] company itself, but you

[00:25:21] personally getting into the

[00:25:22] CMMC ecosystem.

[00:25:24] For me, it was just

[00:25:26] that happy accident that kind

[00:25:28] of worked out in the end.

[00:25:28] Like I said, I got that

[00:25:29] service ticket from that

[00:25:31] initially kicked everything

[00:25:32] off.

[00:25:33] But once I started drilling

[00:25:34] into it, it just it made my

[00:25:35] brain happy.

[00:25:36] It might, you know, it made

[00:25:36] the brain produce all those

[00:25:37] happy chemicals that you

[00:25:38] know we all love and

[00:25:39] appreciate.

[00:25:41] And it was the big, the big

[00:25:42] challenge and the big puzzle

[00:25:44] because you have all those

[00:25:45] individual controls as

[00:25:46] assessment objectives and then

[00:25:47] you got to figure out how to

[00:25:48] implement them.

[00:25:49] And I love being able to

[00:25:51] figure those things out.

[00:25:52] And then when you take that

[00:25:53] you implement it, everything

[00:25:54] happens.

[00:25:55] You can start to see the

[00:25:56] direct result that it has in

[00:25:57] those businesses when

[00:25:58] they're like, Hey, we got

[00:25:59] that government contract.

[00:26:00] Oh cool.

[00:26:01] And they're like, check this

[00:26:02] out.

[00:26:02] We just made a bolt that went

[00:26:03] on the international

[00:26:04] space station.

[00:26:05] I'm like, that's awesome.

[00:26:07] That's freaking cool.

[00:26:10] You know, or like here's this

[00:26:11] little this washer that goes in

[00:26:13] this jet engine and I'm like.

[00:26:15] Okay, cool.

[00:26:16] Here's the fuel pump internals

[00:26:17] for this one.

[00:26:17] I'm like, I don't know what

[00:26:19] this hunk of metal is, but it

[00:26:20] looks really cool.

[00:26:21] And then it's going to do

[00:26:22] something cool.

[00:26:22] So it's cool to be able to

[00:26:24] watch that journey as you

[00:26:25] work through those engagements

[00:26:26] and then finally see the

[00:26:27] finished product at the end

[00:26:28] where you're just like

[00:26:29] that's that's pretty neat.

[00:26:31] Yeah, absolutely.

[00:26:32] That's kind of how it fits

[00:26:33] for me.

[00:26:33] I love it.

[00:26:34] What about you, Bobby?

[00:26:35] I love serving.

[00:26:37] I love helping and I just saw

[00:26:40] this industry needing a ton

[00:26:42] of help.

[00:26:43] They were going to need a lot

[00:26:44] of help.

[00:26:44] They're going to need somebody

[00:26:45] that had a passion and care

[00:26:46] for it.

[00:26:47] And that's what I love to do

[00:26:48] or really do.

[00:26:49] I do enjoy it.

[00:26:50] And I'm like, we're going to

[00:26:52] be able to step into this

[00:26:53] space and take that that

[00:26:55] passion and care that we have

[00:26:56] and know that we're going

[00:26:57] to be able to do it now.

[00:26:59] Yes, there's an opportunity

[00:27:00] for growth.

[00:27:01] Yes, there's an opportunity

[00:27:01] to generate revenue.

[00:27:03] But it's not a money grab

[00:27:05] because you've got to think

[00:27:05] about it from the perspective

[00:27:07] of a lot of these companies

[00:27:09] have been in generational

[00:27:14] passing down of

[00:27:15] these manufacturing companies.

[00:27:17] So it's not like they're just

[00:27:18] sitting on this mountain

[00:27:20] of cash and there's some

[00:27:21] prime organization.

[00:27:23] Those are the companies we're

[00:27:24] probably going to be working

[00:27:25] with.

[00:27:25] We're going to be dealing

[00:27:26] with the companies like Adam

[00:27:27] was talking about.

[00:27:29] And so how can we provide

[00:27:30] that CMMC experience

[00:27:32] and certification and guidance?

[00:27:35] It's not going to be cheap.

[00:27:37] A good Adam saying is

[00:27:39] none of the C's and CMMC

[00:27:40] stand for cheap.

[00:27:42] They are not.

[00:27:43] So it's going to be

[00:27:44] it's going to be a

[00:27:45] position, but it's not like

[00:27:48] we got into this because

[00:27:49] we thought, boy, this is

[00:27:51] going to be golden in their

[00:27:52] hills.

[00:27:52] Let's just mine the crap out

[00:27:53] of it.

[00:27:55] These companies need to

[00:27:56] still be profitable.

[00:27:57] So we have to be able

[00:27:58] to provide that for them.

[00:28:00] And that's how we've always

[00:28:01] been when we weren't in

[00:28:03] the space and we're taking

[00:28:04] that mentality.

[00:28:05] We want to come in this space.

[00:28:06] We want to serve the community

[00:28:07] and we want to be able to

[00:28:08] help provide that compliance.

[00:28:09] And we just saw a lot more

[00:28:11] opportunity for us to do that.

[00:28:12] And I like the fact

[00:28:13] that there is certification

[00:28:15] requirements

[00:28:17] that level the playing field.

[00:28:19] It's harder for a client

[00:28:21] to pick an abandoned

[00:28:22] service provider if any of them

[00:28:23] can kind of step into the

[00:28:24] shadows and pretend like

[00:28:26] they know what they're

[00:28:26] doing and it's hard for

[00:28:27] the client to figure that out.

[00:28:29] But now that us MSPs

[00:28:31] have to be assessed,

[00:28:32] they can't cheat that.

[00:28:34] They have to know the controls.

[00:28:35] They have to pass.

[00:28:36] We all have to jump that hurdle

[00:28:38] before we can participate

[00:28:39] appropriately in the space.

[00:28:41] And I just thought that was awesome

[00:28:42] because then it forces

[00:28:44] us to eat our own dog food

[00:28:45] and really do what we say

[00:28:47] we're doing and be able

[00:28:48] like you're saying, Kaley,

[00:28:50] and I love the little diagram

[00:28:51] that we have or not the

[00:28:53] diagram but the intro video

[00:28:54] of that person helping

[00:28:56] up onto the hill.

[00:28:57] Like that's what

[00:28:58] we're trying to do.

[00:28:59] And we have to be there first.

[00:29:00] You've got to be on that hill.

[00:29:01] And that just excited me.

[00:29:04] I know it's crazy hard

[00:29:06] and it has been crazy hard

[00:29:07] and it's going to be a difficult journey.

[00:29:09] But we're excited about being on top

[00:29:11] of the hill and helping other people

[00:29:12] get there.

[00:29:13] It's just something that

[00:29:14] we've just got a passion for.

[00:29:15] It's hard to explain, I guess.

[00:29:17] Yeah.

[00:29:17] At the end of the day,

[00:29:18] a rising tide reaps all flips.

[00:29:20] Yes, absolutely.

[00:29:21] So that's kind of part of this whole thing too.

[00:29:22] Why I started doing more

[00:29:23] speaking engagements

[00:29:24] and getting out there.

[00:29:26] Just to basically take all the lessons learned,

[00:29:28] those fears that kept me up at night,

[00:29:30] those wins that I've gotten,

[00:29:31] share those with the community

[00:29:33] so that we can all be a little bit better.

[00:29:34] So we can all do our part, help out and

[00:29:36] make the world a slightly better place

[00:29:38] than we found it.

[00:29:39] Absolutely.

[00:29:40] Well, thank you Adam and Bobby

[00:29:42] for sharing your perspective on this.

[00:29:44] I love this episode for two reasons.

[00:29:47] One, I hope that it gets

[00:29:50] our listeners to know a little bit about

[00:29:52] Axiom and who we are behind this podcast

[00:29:54] and who these people are

[00:29:56] that they hear a lot from every Thursday.

[00:29:58] But also too,

[00:29:59] the inspiration of inspiring people

[00:30:02] that maybe haven't gotten into the space yet

[00:30:05] to get into the space

[00:30:06] if this resonates with them and their company.

[00:30:09] Or maybe it's somebody who's on the climb

[00:30:12] that's feeling a little defeated right now

[00:30:14] to keep going, you know?

[00:30:16] And you've got this

[00:30:17] and you can get there

[00:30:19] and we're there too, you know?

[00:30:21] And so I really hope

[00:30:23] that that was inspiring to you

[00:30:25] or helped you just even just a little bit

[00:30:27] on your climb as a company.

[00:30:30] But also if you guys

[00:30:31] have any questions to Bobby or Adam

[00:30:35] or, you know, or our business as a whole

[00:30:38] or maybe other people in the community

[00:30:39] please feel free to comment

[00:30:41] on either our YouTube videos

[00:30:43] or our LinkedIn.

[00:30:44] You can see Adam and Bobby on LinkedIn

[00:30:46] and we'd love to connect with you again.

[00:30:49] Like we do believe this is a partnership

[00:30:50] and, you know, we want to connect with you guys

[00:30:52] so we don't want this to just be one-sided.

[00:30:55] So if you guys have anything to share,

[00:30:56] questions you have, please feel free to share it with us.

[00:30:59] And make sure to like our podcast

[00:31:01] or follow so that you can be connected

[00:31:03] with us anytime we post new content

[00:31:05] or share a new episode out

[00:31:07] with you guys every Thursday morning.

[00:31:10] Thank you guys for tuning in

[00:31:11] and just remember to keep on climbing.

[00:31:13] Bye guys.

[00:31:16] Make sure to follow us on LinkedIn

[00:31:17] and YouTube to stay up-to-date

[00:31:19] on the latest CMMC news.

[00:31:21] We hope you guys enjoyed today's episode

[00:31:23] and listen out for the next one.

[00:31:25] But until then, keep on climbing.