The 32 CFR Final Rule is out NOW (Let's chat)

[00:00:01] Hello Climbers and welcome back to another episode of Climbing Mount CMMC.

[00:00:12] Hello Climbers, the time has come.

[00:00:16] The time is nigh.

[00:00:17] We have all been waiting for.

[00:00:20] We have just heard that the 32 CFR Final Rule, and yes, emphasis on the final, is dropping on the 15th of October.

[00:00:30] Here we are recording this on the 11th of October, and it should be dropping on their website.

[00:00:38] You can already review it.

[00:00:39] So have we been?

[00:00:41] Yes, we are.

[00:00:42] We are skimming it and looking and analyzing as we are recording this right now.

[00:00:47] It took us a long time to even start recording because we just kept looking at things.

[00:00:51] We're like, we've got to stop.

[00:00:52] We've got to stop.

[00:00:53] We've got to stop reading it.

[00:00:54] Let's go ahead and just record.

[00:00:55] Listen, this is our first look.

[00:00:58] We have not read the entire thing yet, but we have noticed some things that we really did want to come on here and update and share with you guys.

[00:01:06] Now we're going to post a full podcast episode reviewing this next week.

[00:01:11] So you guys should see that coming next.

[00:01:14] So let's talk about this.

[00:01:16] Here we go.

[00:01:16] The focus of that podcast we're going to be doing is like what will this 32 CFR impact have to managed service providers and engaging managed service providers like us?

[00:01:25] What does that mean?

[00:01:26] What do you need to think about?

[00:01:27] Because from what we're looking at, things have sort of changed some, but not quite the same from our initial reading of it.

[00:01:34] But we're really going to dig into it this weekend and over.

[00:01:37] So we'll have a lot better.

[00:01:38] But we had some stuff that we want to present to you now.

[00:01:40] Right, Keely?

[00:01:41] Yes.

[00:01:42] So let's talk about the phases.

[00:01:45] Right.

[00:01:46] This is a four-phase process of CMMC.

[00:01:49] And they've said that.

[00:01:50] We knew that.

[00:01:51] But there is a big difference.

[00:01:53] And we're going to share this graph that we've created on the screen.

[00:01:58] Basically, phase one has made an additional six months occur.

[00:02:04] Okay.

[00:02:05] So it used to just be six months until phase two.

[00:02:10] But they have now extended that to a full year.

[00:02:13] Right.

[00:02:14] Okay.

[00:02:14] So, and they even, and I'm going to show this on the screen, emphasized the reasoning for this by saying, you know, further extensions of the implementation period or other solutions may be considered in the future to mitigate any C3PAO capacity issues.

[00:02:34] Right.

[00:02:34] Okay.

[00:02:35] So, I mean, they say it clear as day.

[00:02:38] And we've been talking about this a lot.

[00:02:40] We even recorded a two-hour thing that we now have to go back.

[00:02:46] And we record over again.

[00:02:48] Yeah.

[00:02:49] But that's okay.

[00:02:50] That's all right.

[00:02:51] So for those who don't know, we had something in queue that was going to get released.

[00:02:55] It had a lot of numbers and kind of the perspective.

[00:02:58] Yeah, graphs and everything.

[00:03:00] And stupidly, of course, we should have done it sooner because the 32 CFR literally dropped as she was getting ready to edit it, which changed some of the timelines.

[00:03:08] So then we have to re-record over again.

[00:03:10] So, hey, that's the world of NIST and CMC, guys.

[00:03:12] Yeah.

[00:03:13] I mean, I didn't even get ready for this episode because I have to hop on a plane.

[00:03:17] I mean, in like an hour.

[00:03:19] So here we are recording this and we've got it.

[00:03:21] Hot off the press.

[00:03:22] Yeah, yeah.

[00:03:23] So the real important thing to note is that one year, that extends every phase after that, right?

[00:03:30] Because the phases are not specific dates.

[00:03:33] The phases are based on the phase prior to, okay?

[00:03:36] So each phase is going to give it a year, right?

[00:03:41] And you're going to see this on the graph.

[00:03:43] You're going to see here we're estimating, right, that June 2025 phase one rollout.

[00:03:50] So from there, it's going to go June 2026 to phase two.

[00:03:54] And then phase three is June 2027.

[00:03:56] And then phase four is June 2028.

[00:03:59] Okay.

[00:03:59] So what does that mean a little bit?

[00:04:01] Let's talk about that.

[00:04:03] So we've talked about the golden age for certified companies.

[00:04:07] Bobby, did you want to mention a little bit of what you were talking to me about that?

[00:04:10] Yeah.

[00:04:10] So the golden age of CMMC for companies that are certified is because so few companies are prepared and ready and are in a position and have relationships with the necessary resources to pull this off.

[00:04:23] Those people that have those certifications will allow them to get better opportunities to close on contracts.

[00:04:33] Because now we're already seeing the emails and the letters going out.

[00:04:37] I started seeing some of our clients and people that we're talking with sending screenshots of what the primes and other people have started sending down to them saying, it is imminent.

[00:04:47] It is coming.

[00:04:48] Where are you at?

[00:04:49] They're already starting to that rattling of the sabers of how this discussion needs to go.

[00:04:53] And they want to know where you are in the ecosystem and how soon you'll be ready to get level two.

[00:04:57] So those companies that get that certification, they're the first to the bowl.

[00:05:02] They're going to have the first.

[00:05:03] And the way that they are redoing the SPRS scores in the system, there's a lot of belief that that will allow better mechanisms for the governments to appropriately look at how aligned those companies are and perhaps provide better preferential treatment for those that have been certified.

[00:05:24] Is that a fact?

[00:05:25] Do I know that?

[00:05:27] We'll just have to see.

[00:05:28] It's time to go to tell.

[00:05:29] But the primes and subprimes absolutely have as much leeway as they want to look at where someone is in the ecosystem.

[00:05:36] And it's not having to be specifically a binary type situation like it is when you're doing SAM.gov awards as a prime.

[00:05:45] With those primes and subs, they're just making their decisions on who they want to go through.

[00:05:49] And you absolutely believe wisely that they're going to be making preferential choices for those companies that have gotten level two certified.

[00:05:56] So that's why we kind of call it that golden age.

[00:05:58] Because they're going to be provided with opportunities for a short period of time that others just won't be able to get aligned.

[00:06:06] But that's that phase approach, which Kaylee is going to talk about a little bit more, that the more people that step in this space and get certified, that's going to start getting back to equilibrium.

[00:06:15] So you'll just have that kind of philosophy of if it's raining gold, run out with buckets, not thimbles.

[00:06:22] Right.

[00:06:23] So you want to that's that golden age.

[00:06:25] Right.

[00:06:26] Those are coming.

[00:06:27] You want to be able to get that opportunity and capitalize on it.

[00:06:30] And so having a level two certification, that's a pretty big bucket.

[00:06:33] Yes.

[00:06:35] And so we with the podcast recording that you guys will never see, we did discuss that there is like this seven year graph.

[00:06:44] Right.

[00:06:44] That they talk about.

[00:06:46] The DOD talks about how in year four, you're going to notice that that equaling out that goes from four to seven, where it's going to end up netting zero.

[00:06:57] Right.

[00:06:58] With the with it coming in and coming out of CMMC certifications.

[00:07:01] And so you're going to to notice that specifically because, you know, there's a three year requirement for that CMMC level two certification.

[00:07:12] So every three years you should be receiving that certification.

[00:07:16] Now, we've heard some things about ESPs and certifications with CMMC level two certifications with them, which we're going to have to talk about in another day because I could go down a rabbit hole with that one.

[00:07:31] Yeah.

[00:07:32] Let's not open up Pandora's box.

[00:07:33] But there are some changes there.

[00:07:35] I think, in my opinion, from my initial look at it, I think they're good choices.

[00:07:38] They do open up more opportunities for companies to potentially participate without having to be level two certified.

[00:07:46] But you still have the same level of risk and requirement for your involvement.

[00:07:50] How that's going to exactly play out, I think, will probably be addressed by the CAP, which we're going to go through and rewrite.

[00:07:56] And if you don't know what the CAP is, that's the CMMC assessment plan that will be coming from the Cyber AB, which is not the DOD.

[00:08:04] Not the same thing.

[00:08:05] Not the same thing.

[00:08:07] So, Kaylee, can you kind of sort of just very briefly walk through phase one, phase two, phase three, and phase four, kind of what the differences are and how that sort of works?

[00:08:15] Mm-hmm.

[00:08:16] So, you know, assessments starting in December of 2024, right?

[00:08:21] Then in June 2025, phase one begins with level one and level two self-assessments, which obviously we're here, you know, we talk about the flow down to subs.

[00:08:32] Now, we do have some information that they have given in the final rule, some updates there that I'm excited to go further and talk about in our next episode.

[00:08:43] So stay tuned for that.

[00:08:44] So, yeah.

[00:08:46] In phase two of June 2026, right, that's the new timeline with a whole year.

[00:08:52] That is when they're going to add in the CMMC level two certification assessments.

[00:08:57] Mm-hmm.

[00:08:58] Then going into phase three in June of 2027, this is when we get the optional period on a contract awarded prior to the effective date.

[00:09:08] They're still sticking by that.

[00:09:09] And I will put the, you know, information here about that.

[00:09:13] But it's basically, you know, this opportunity for them to kind of go back on some of these contracts that were given and add that CMMC requirement, level two requirement, even though it was not prior, priorly required.

[00:09:30] Okay.

[00:09:30] So it's like giving them some leeway there.

[00:09:33] It does mention it.

[00:09:35] That's where the sentence ends.

[00:09:37] I'm putting here right where the sentence ends.

[00:09:40] So we don't have any more information other than that.

[00:09:43] But it is giving them an opportunity to go back on some things.

[00:09:46] So just be aware of it.

[00:09:47] Because it looks like they could basically say, okay, you pinky promised in the SPRS score.

[00:09:52] We've kind of known how you guys have handled this in the past.

[00:09:54] So we have the right to go back and talk to some of you and say, hey, you said you're at 110.

[00:09:59] You're ready to go.

[00:10:00] Can you go ahead and do that?

[00:10:01] We'd love to see it.

[00:10:02] Proof somebody.

[00:10:03] Hey, Kaylee, I got a CMMC joke.

[00:10:05] You ready for this?

[00:10:06] Okay.

[00:10:06] I'm ready.

[00:10:07] She doesn't even know this is coming.

[00:10:08] I've been planning this for a while.

[00:10:10] All right.

[00:10:11] It's a golf joke, but I promise it relates to CMMC.

[00:10:14] Okay.

[00:10:15] You ready?

[00:10:15] What is the best golf club in your bag for golf?

[00:10:21] It is your pencil.

[00:10:27] Right?

[00:10:28] Because you can write whatever you want on your scorecard.

[00:10:31] You know what?

[00:10:31] I knew you cheated all throughout my life.

[00:10:34] And this is just confirming it.

[00:10:36] Right.

[00:10:36] Yeah.

[00:10:36] But like so many people, when they were doing their SPRS score said 110.

[00:10:41] Perfect.

[00:10:42] Hole in one.

[00:10:43] Eagle on every hole.

[00:10:44] You know?

[00:10:44] And that's not going to work anymore.

[00:10:47] Like you're going to have to show the work.

[00:10:49] The auditor is going to be walking through the whole course and they're going to see exactly

[00:10:53] where you're at.

[00:10:54] And if you got the, you know, the, the, you know, if you start turning into a shankopotamus

[00:10:59] and they're like, wait a minute, you're supposed to be a scratch golfer here.

[00:11:02] And you can't even seem to keep this thing in the fairway.

[00:11:05] How's that working?

[00:11:06] Yeah.

[00:11:06] It's not going to go out very well.

[00:11:07] So, I mean, it's, it is now the time is nigh.

[00:11:10] It is here.

[00:11:11] Don't mess around.

[00:11:12] Don't just say, well, I'm just going to dive into the, you know, dirty dancing baby, you

[00:11:17] know, Patrick Swayze arms of, I'm just going to hang out in the self-assessment world.

[00:11:23] And hopefully I won't have to still get assessed.

[00:11:25] And I, to be honest with you, I think that's only going to play out for people that are doing

[00:11:29] prime type work.

[00:11:31] The subs aren't going to play that game.

[00:11:33] You know, they're not going to be able to play that game.

[00:11:35] The primes are going to look at the subs and go, ha ha ha.

[00:11:37] No dog.

[00:11:37] Uh, you know, if I've got somebody that's got a certification, I'm going to pick them

[00:11:42] because we just can't play around with this.

[00:11:43] I can't have a contract explode in the middle because one of my subcontracts just now have

[00:11:49] proven that they're not compliant.

[00:11:52] Yeah.

[00:11:53] Well, I mean, it, I mean, it says very clearly in the, you know, in the final ruling, um,

[00:11:57] primes are responsible for their sub, um, contractors.

[00:12:01] And I'm, I'm sure many primes are going to be quite scared about, you know, who they

[00:12:05] pick because of that.

[00:12:07] And I think that same, same goes for ESPs, you know?

[00:12:10] Um, so, and we'll talk about that as well.

[00:12:13] Um, so just to, just to clear the, the last phase four is the full implementation.

[00:12:19] That's that equilibrium you were talking about.

[00:12:21] Correct.

[00:12:22] Correct.

[00:12:22] So notice how it starts in 2025, you got 2026, 2027 and 2028.

[00:12:28] There's those three years that I was talking about from the beginning.

[00:12:31] So that's what we're seeing here with this update.

[00:12:34] And I think there's a lot of wisdom about providing better timeframes for, for that equilibrium

[00:12:39] to start to happen.

[00:12:40] I think the DOD kind of said, okay, guys, we get it.

[00:12:42] We'll go ahead.

[00:12:43] You know, we, you know, we told you you had 15 minutes, but you really got an hour, but,

[00:12:47] uh, the time is still coming and you still got to show up.

[00:12:51] Uh, we just gave you a little bit more time.

[00:12:53] So, and I think that was probably a good call on the DOD part, but now what that is going

[00:12:57] to do is that's going to allow, uh, more participation to occur, to happen before those

[00:13:03] hard quoted requirements happen.

[00:13:05] But that doesn't mean that, that you can fall asleep at the wheel.

[00:13:09] Yeah.

[00:13:10] And, you know, I, I'm just really glad that, I mean, we've, we've spoken this song many of,

[00:13:15] many of times, but you know, the backlogging that could be happening or that is happening

[00:13:20] in C3 PAOs.

[00:13:21] And I'm glad that they're listening, you know, they're hearing that out and they even say

[00:13:25] here, there is a potential for the change of this, this rollout due to, you know, that,

[00:13:33] um, the, the C3 PAO, you know, backlogging that, that, that's happening and could continue

[00:13:39] to happen.

[00:13:40] Right.

[00:13:40] As we were thinking.

[00:13:41] So I'm just glad that they're looking at that.

[00:13:44] They're listening to that, um, and give, and give companies an opportunity or more of

[00:13:49] an opportunity to get that certification, um, under their belt in time.

[00:13:54] And I think what they're going to try to do is they're going to play on the next door

[00:13:59] neighbor philosophy of CMMC.

[00:14:01] And that is when the next door neighbor shows up with a new car or you go over for dinner

[00:14:08] to your neighbor's house and the kitchen just got redone and it looks really awesome.

[00:14:12] When you get back to your house, what's going to happen?

[00:14:14] You're going to want that nice kitchen.

[00:14:16] You're going to want the nice kitchen, right?

[00:14:17] You're going to want to be able to have that nice car.

[00:14:19] And you're like, well, you know, uh, the, the Joneses over there have that, you know,

[00:14:23] like what the heck work is good as the Joneses.

[00:14:25] You know, I think we're better than the Joneses.

[00:14:27] Let's go ahead and get that done.

[00:14:28] That's going to be happening.

[00:14:29] And I think the DOD is keeping their ear to the ground and they're going to be talking

[00:14:33] more specifically with the primes and trying to say, you know, trying to use the levers

[00:14:38] and dials that they built into this to allow them to control it.

[00:14:41] But they want the primes and subprimes to continually put the pressure to allow that to happen down

[00:14:47] and have them start having and pushing those discussions because then they'll start picking

[00:14:51] the people that are getting it.

[00:14:53] And what you're going to have is the, you know, the Joneses that have the done kitchen.

[00:14:57] They're going to be the ones that are going to be having the parties and the people that

[00:15:00] said, nah, I don't think this is really going to happen.

[00:15:02] And then they're going to be at home wondering why they didn't get the invite.

[00:15:06] And they're looking across the street with all the cars there and looking at their watch

[00:15:11] and calling the cops going, this is frustrating.

[00:15:14] You need to get them out of here.

[00:15:15] And you're like, and they're all having a great time because that's what's going to happen.

[00:15:19] There's still people out there that have the CMMC flat earth, but I promise you it's

[00:15:24] round and it's coming and this is just a proof that it is.

[00:15:29] And so, you know, brace for impact.

[00:15:32] We've got some pictures of the earth coming on the 15th next week.

[00:15:36] Yeah.

[00:15:37] All right.

[00:15:38] Well, here we are.

[00:15:40] This is just, again, our first video.

[00:15:42] Our first, just honestly to show you guys, hey, we're listening.

[00:15:46] We're looking at this, um, a podcast episode is coming, um, and more to come on this and

[00:15:53] we're ready to share, um, this information that we find through it.

[00:15:57] So, so yeah.

[00:15:59] Um, any other things, Bobby, that you want to add before I close it out?

[00:16:01] No, it's great.

[00:16:02] I've just, I'm loving walking through this and reading it with you, Kaylee, and us having

[00:16:05] conversations, me and Adam are having those conversations.

[00:16:08] So, uh, it's very encouraging.

[00:16:10] I think the DOD has done, uh, from my initial read, a good job of listening to, I think a

[00:16:17] lot of the comments, 250 pages of the, the rule, which Kaylee will probably have in the

[00:16:23] comments for you to be able to click on are just responses that the DOD has gone through.

[00:16:28] And a lot of those responses are just very, very helpful in providing additional guidance

[00:16:33] on their perspective of it.

[00:16:35] Security protection data.

[00:16:37] They, they provided some additional information.

[00:16:39] Would I have liked some more information?

[00:16:41] Sure.

[00:16:41] I think we will always want more information because that's how we roll.

[00:16:45] Uh, but we definitely got some more information about that.

[00:16:47] We'll also talk about that and what implications that has for me and its service providers.

[00:16:51] So keep on listening and tuning in.

[00:16:54] There's more to come.

[00:16:56] Yes, for sure.

[00:16:57] Well, thank you guys for listening in.

[00:16:58] And just like Bobby said, remember to tune in for the next episode, which is going to

[00:17:02] be a more in-depth conversation about this, but until then guys, keep on climbing.

[00:17:07] Bye.

[00:17:09] Make sure to follow us on LinkedIn and YouTube to stay up to date on the latest CMMC news.

[00:17:14] We hope you guys enjoyed today's episode and listen out for the next one, but until then

[00:17:19] keep on climbing.