CUI Hotline: 10.16.26

---

Transcript

Opening

Jacob: Everybody, it’s Friday. It’s Hotline time, your favorite time of the week. We go live on YouTube and LinkedIn. You can find us at cuihotline.org, where you can fill out the form or call and leave a voicemail. You can send DMs or talk to us in chat, and you can check out summit7.us to find us out and about. Lots of people found us at AUSA, and we were just at EDUCAUSE in Denver. We’re always around, but we’re here every Friday answering questions.

Let’s jump into the weekend review. There hasn’t been any major CMMC-specific news, but there’s quite a bit of churn around the empty space left by not having an update. What I take away from almost 100 days since the suspension is that even with new DoD leadership, the same behavior occurs: they say things once or twice and feel they don’t need to repeat themselves if there’s no update. We had a big flurry of information, then “you still have to comply with 171 and your existing requirements,” and we haven’t heard anything in weeks. Meanwhile, at events and in our content, everybody asks how to run a self-assessment, whether they still have to do this, and what 171 is. Daniel, you wanted to talk about SPRS scoring?

SPRS Scoring Is Broken

Daniel: I’m not going to throw out a crazy revelation. I just have an immense amount of anger right now around the DIB. I’ve had a lot of empathy for small businesses that didn’t know any better and IT people left holding the bag. But if I were a defense contractor today, I would protest every award with DFARS 7021 self-assessment obligations. There’s so much rampant misscoring of the 88-out-of-110 minimum, and of the combination of points people use to reach it, that I’d put money on the table you’d win almost every protest, because the awardee couldn’t prove it was compliant with its self-assessment obligation.

Jacob: The DoD has said on stage that the average SPRS score in the system is 109. Yet the number one thing people say in the NDIA cyber surveys is that they struggle with implementation. Clearly the scores are incorrect.

Daniel: I had conversations this week. One company thought it was at about negative 50 and was being honest. I looked, and it was closer to negative 150 or negative 200: no assessment objectives in sight, just yes or no on the 110, non-FedRAMP clouds involved. That’s happening day in and day out. And people who call us genuinely intend to do the right thing, so this is no dog on anybody who picks up the phone. But from a contract award perspective, you get to eat and I don’t get to eat math. Everyone’s score has to be incorrect. I’ve seen it in companies from thousands of employees down to 20 or 30. Fernando said “88 is the new 110,” and that’s where we’re landing: people just put in an 88 because they have to. If you’re losing work and you’ve done the right thing, with a correct 88 or better, have your BD team protest every loss. I think you’d probably win.

Jacob: Self-assessment scoring is unreliable and proven to be, and it punishes companies that do things correctly, because it’s too easy to knowingly or unknowingly put in an inflated score. Jenna said, “Thank goodness none of the current solicitations contain 7021 anymore.”

Daniel: That’s not exactly true. All DoD solicitations still contain DFARS 7021, but the selection in the clause can only say CMMC Level 1 or Level 2 self-assessment. Under the suspension guidance, you won’t see Level 2 C3PAO or Level 3 as a requirement to win a contract. The requirements and the assessment still exist. The only difference from 100 days ago is that the DoD won’t make you hire a third party. You conduct the assessment yourself.

Jacob: And 88 is still the minimum passing score. Everyone in the DIB knows what’s going on with self-assessment scoring. It isn’t a reliable assurance mechanism, which is why we’re waiting to see the solution after the review.

We were just talking before the show about how, 100 days in, work for C3PAOs is drying up. Major C3PAOs are furloughing staff and shutting down. Kieri just laid off half its workforce. If you restart the old system after the review, there will be fewer assessors and less capacity, which will push assessment prices above where they were before. What do you think in chat? Will the DoD announce that it spun up 80,000 AI assessment agents to run automated assessments for free? Or will it be a mixed bag, recommending third-party certification and giving bonus points on bids? Even then, less capacity means higher prices.

Brilliant at the Basics and the Scoping Problem

Jacob: If you missed Thursday’s podcast, check it out. The only signal we’ve had in print from the DoD during this review is the Brilliant at the Basics campaign. The documents on the DoD CIO website were published July 13th with the Phase 2 suspension announcement, separate from the recent October Cybersecurity Awareness Month posts on LinkedIn. They aren’t contractual requirements, but they’re the only signal we have, so it would be irresponsible not to look at them. This is our second episode on them, and the main one goes through the 10 IT security practices. You notice quickly that there’s no scoping guidance, and the language is very broad: “every asset,” “your proprietary data,” “all department sensitive information.” Where does this apply? How do I limit it?

The campaign is described as cutting through administrative complexity, but scoping guidance is administrative complexity, and it’s also the number one way to limit your cost and risk. It’s a paradox. Combined with DoD statements over the last 100 days, they apparently don’t think requirements should be focused strictly on data flow, or strictly on IT. They think they should reach OT environments. In that view there are no CUI assets, specialized assets, or out-of-scope assets, and your entire enterprise is in scope. Daniel, one fundamental choice for people is whether to build an enclave or go all in, and the deciding factor is cost.

Daniel: Scope and cost. If everything is in scope because there are no asset classifications, you’re looking at a 10x multiple in some organizations. Your OT alone, let alone modern authentication requirements, could cost millions unless you’re bleeding-edge and have already poured money into OT and ICS cyber resiliency. “Just do it” on what? That’s the question everyone is asking.

Jacob: That was the problem with NIST SP 800-171 for its whole lifespan: its scoping guidance is a single sentence. CMMC was the only real government attempt to say what “applies to everything that stores, processes, or transmits CUI” means. It gave us CUI assets, specialized assets, and contractor risk-managed assets within your CUI environment, which gives you a variable baseline based on risk acceptance. It’s not recommended, but it’s flexible and spares you from changing boundaries and architectures. That was a massive concession, and understanding it is a burden. But if you throw it all out and go back to NIST, how do you chop up your environment? Many of our weekly questions are “How do I determine who my CUI users are?” If you extrapolate from what the DoD has said, there would be no such thing as a CUI user, because everything would apply to everybody everywhere. The suspension was done with the SBA, and the rhetoric was that it’s too expensive and complex, yet everything else says it applies everywhere. I don’t see how those match.

Daniel: FAR CUI is coming, and that’s basically Rev 3 with no scoping guidance attached, at least in the rule as we know it. Will every agency develop its own, or will it be that anything that processes, stores, or transmits CUI is the only asset type? If a spam filter touches CUI, do you slap 110 controls on it? Things start to spiral without clear scoping.

Jacob: We’ve talked about Chesterton’s fence: don’t tear down a fence until you understand why it was put there. Scoping guidance is the fence, and they’ve indicated they’d like to rip it down. If they do, the only scoping guidance left is one sentence, and it will cost people a lot, even if you never show up to assess anybody. The irony is that to reduce burden, you have to give people more detail, which increases the burden of understanding but limits their cost and scope. It’s a seesaw.

Primes Are Filling the Vacuum

Jacob: Sean says, “I don’t think they’ll praise C3PAOs for CMMC assessments. At the very top they’ll ridicule these companies for not being agile enough to rebuild the arsenal quickly.” Daniel, we get calls from people who don’t care about the suspension or Brilliant at the Basics, because their primes are saying “we need XYZ score, we need XYZ proof,” and the structures differ from customer to customer. The DoD created a vacuum, and primes are filling it. Some primes say “yolo, here’s the work.” Others are as strict as, or stricter than, a Level 2 requirement.

Daniel: I had five companies this week, from 13 users up to about 3,000, all subcontractors to different primes. One said, “We got a phone call: we have to be a perfect 110 by November 20th, five weeks, or the prime is turning off the tap on new work.” My heart goes out to the C3PAOs, because it’s hard on your line of business. But for people implementing controls, primes are still mandating it and people still don’t know what to do. They need technical and non-technical support, gap assessments, and follow-up. They thought the whole program went away.

Jacob: In lieu of third-party certification, what fills the space? Ring ring, it’s DIBCAC. Ring ring, it’s a prime. Ring ring, it’s a whistleblower’s lawyer. Everything that certification solved for is still out there stressing people out. It isn’t as easy on the ground as the DoD makes it out to be.

As for “rebuild the arsenal,” this isn’t a political show, but if you’re paying attention to current events, the people who come up with that phrasing may not be in their jobs much longer. Leadership changes could come very quickly at very high levels in the next couple of weeks, and the pendulum could swing back. Shadow Sig asked whether the DoD no longer cares that GRC done for real is expensive and politically unpopular, and whether the cost in warfighters’ lives is acceptable to the DIB and DoW leadership. Maybe. But ninety days is a long time to a C3PAO and not very long in government cycles. Committees, elections, and so on take longer than that for the pendulum to swing. So contractors should keep a bead on things and not take on undue risk and liability. That isn’t comforting for C3PAOs, but the whole system hasn’t stopped valuing people who implement requirements.

Daniel: We know that because self-assessments under 7021 weren’t suspended either. The CIO said at the Black Hat listening session that they can’t necessarily trust self-assessments, but they give a record to challenge later with DIBCAC and DOJ. If I were DOJ right now, I’d be having a party, popping bottles, blowing up balloons.

Jacob: There are a ton of cyber False Claims Act settlements in the queue, but white-collar enforcement is at a 40-year low. We predicted in January at least a dozen settlements this year, and we didn’t get one until June. The government will still pursue these, but this is a weird period, and when the pendulum snaps back it will do so with force. As a contractor, don’t get caught in that tangle.

Chat: UK Scope Changes, CIRCIA, and a Lost Bid

Jacob: Richard says UK defense contractors’ scope for controls recently went from systems with defense data to all systems essential for the business to operate. That’s very interesting, Richard. If you have a link, I’d love to see it. That’s what Brad said, and what we’ve discussed: everything is in scope for Cyber Essentials and Cyber Essentials Plus.

Daniel: Strict data governance is hard. Identifying CUI is hard, and the people in charge of identifying it aren’t the ones developing the protection requirements, writing the contracts, or checking compliance. It may just be simpler for them up on Mount Olympus to say “screw it, it’s all in scope.”

Jacob: That’s what primes do, so why wouldn’t the DoD eventually do the same? It’s what we discussed with CIRCIA. There’s no CUI scope in CIRCIA reporting, which is why I don’t believe there will be a reciprocity agreement letting DFARS 7012 reports substitute for CIRCIA reports. 7012 reports are strictly CUI-focused, and CIRCIA cares about everything because you’re a defense contractor.

Daniel: I suspect the DoD hasn’t received many cyber incident reports over the years, relative to how broad the base is. What’s the penalty if people don’t report to CISA?

Jacob: The legislation gives CISA authority to subpoena and refer to DOJ, and after that we don’t know. If it hadn’t given them any authority, nobody would care, but they’ve been handed the stick if they decide to break the glass. CISA has been hollowed out, a shell of its former self. As the pendulum swings back and it regains people and budget, they’ll use things like this. Is there an immediate risk the day the rule is published? No. But don’t ignore it because CISA isn’t much of a thing right now. The rule should come before the end of the year.

Daniel: A comment in chat from Jim: “Received this yesterday. Thank you for submitting your proposal. After careful consideration, we’ve decided not to pursue this project due to requirements established in Amendment 08, related to CMMC Level 2 self-certification.” Interesting. Jim, if you can share more via LinkedIn DM, anonymous and redacted, we’d be curious. We’re seeing more of this, where subs aren’t given a way out, so they either lie or do the right thing. I hate to say it, but the pendulum seems to be swinging closer to lying than to doing the right thing.

Jacob: It’s just business.

Q&A: Can We Keep Using Windows 10 or Unsupported OSs on Manufacturing Equipment?

Daniel: Jacob, you and I went into this in detail on a previous episode. “Up-to-date operating systems” and “latest supported version” language isn’t in Rev 2 of NIST 800-171, so you can use an unsupported OS. You need risk mitigation, some paperwork, and probably technical measures like isolating the device on the network, but you can use it for manufacturing work. I believe Rev 3 changes that.

Jacob: Rev 3 does change it to supported versions, but the scoping guidance still leaves manufacturing equipment out of scope as specialized assets. If the scoping guidance changes or goes away, or if you read the DoD statements and Brilliant at the Basics, there aren’t just 10 IT practices. There are also 10 OT security practices, and the DoD CIO constantly talks about OT security. To her credit, I don’t disagree that it’s a hole in NIST’s approach to CUI protection. It’s a purposeful gap in CMMC verification, but the gaps were there for a reason: cost. Can you get away with it now? Absolutely. In Rev 3? No, because of scoping guidance. Will it stay the same? Based on the signals, if they could press a button, you wouldn’t be able to get away with it. Will they come out and say “we highly recommend, we strongly urge, we’re begging you to consider maybe doing these one day”? Or “do the requirements or you don’t get the contract”? There’s not much middle ground.

Really, only two questions matter. Are you going to make people prove it? And if so, will you give them contracts regardless of what they tell you? You can chop up, rewrite, and scope the requirements a million ways, but that’s window dressing. You have no guarantee anybody’s doing them if you don’t make them prove it, and if there’s no consequence for not doing it, the proof doesn’t need to be accurate.

Q&A: Can Primes See Their Subs’ SPRS Scores?

Daniel: This came up as soon as CMMC certification started. Is there a dashboard where I can independently verify my subcontractor’s status? The short answer is no. There’s no centralized portal and no list on the Cyber AB website, and primes don’t have SPRS access for their supply chain, which makes sense given the security risk if that information got out. Primes build GRC and supply chain risk platforms, think Exostar, to ingest subs’ self-attested scores and artifacts from C3PAO certification. Every sub has to report into the system. Do people? Yes. But many of the supply chain forms I’ve seen lack FedRAMP requirements for CUI assets, clear questions on export control and third-party support, and assessment objectives. A lot of subs filled out the old form, now deprecated, or the red-yellow-green risk form that primes created, which didn’t align with control weights or the DoD Assessment Methodology. Subs think they did the right thing, but the questions asked weren’t the ones needed to calculate a score.

Jacob: The DoD CIO’s LinkedIn page, as part of its Cybersecurity Awareness Month campaign, told people to use CISA’s CSET self-assessment tool. CISA’s CSET by the seashore, is that what you’re dealing with? It’s clunky to get working, and while assessment objectives are in the amplifying information, you don’t have to answer them. You can click “yes” without opening that section, which makes it very easy to inflate your score. The DoD told people to use it, so if I were an attorney, I’d say, “You told me to use this tool, it says nothing about accurate scoring against assessment objectives.”

As for SPRS, the DoD said in the CMMC final rule that the database is for the contracting workforce, not for you. How primes and the supply chain see status is your problem. Maybe the program review will produce a way to see everyone’s score publicly, but the department has been very wary about sharing that. How do you change that culture? DIBCAC won’t even share the most recent top 10 unmet controls, because it thinks that would give away too much, rather than telling people what they’re struggling with, how to fix it, and what happens if they don’t. They circle the wagons. This predates current leadership. It’s literally like pulling teeth to get them to share information about a sustained crisis.

Q&A: Will 800-171 Become the Standard Outside Defense?

Jacob: Actually, yes. SP 800-171 is the universal federal baseline for CUI of all kinds on non-federal systems. If federal data ends up on a contractor’s own system, 800-171 is the minimum baseline for protecting its confidentiality. It’s derived from the authorities in FISMA down to 800-53, and then a confidentiality-focused subset of 800-53. It’s been part of the federal CUI program for a decade. The missing piece was contract language in the FAR. The DoD has worked ahead with its own supplement, DFARS 252.204-7012, but that’s not how it was supposed to work. Everyone was supposed to use the single FAR CUI clause and supplement it if they wanted. When the FAR CUI clause comes out, 800-171 and FedRAMP equivalency will apply to all federal contractors handling any kind of CUI on non-federal systems, not just defense contractors. There are hundreds of authorities saying that if you handle this unclassified information, you must protect it, and “protect” means 800-171.

Daniel: I recently worked with a company deploying NIST 800-171 that has no CUI and no federal contracts. They wanted to protect their IP to a known standard, and 800-171 was the highest anchor they found. It’s a bolt-on to a more robust cyber program.

Q&A: CUI Already in GCC High. What Applies When Backing Up to Another Cloud?

Daniel: There was a tale years ago that encrypted CUI allowed a carve-out. That came from ITAR, which allows carve-outs to friendly countries if data is encrypted appropriately and you hold the keys. But the DoD published CMMC FAQs, still on its website, saying encrypted CUI is still CUI. Non-FedRAMP clouds holding encrypted CUI don’t work. You must be at FedRAMP Moderate or higher even if the data is encrypted. ITAR data that is also CUI must follow CUI handling requirements, and it doesn’t get special treatment unless it’s standalone ITAR outside a federal contract. So if you back up to the cloud, it must be FedRAMP Moderate, encrypted or not.

Q&A: If We Become CMMC Compliant Now and Requirements Change, Do We Start Over?

Jacob: If the DoD changes the requirements, it will require rulemaking, which even in the best case takes 18 to 24 months. I’d be shocked if they got an interim final rule, and stunned if they went faster than a year. The bigger issue is FAR CUI, which points to 800-171 Rev 3 with no phased rollout that we know of. It would rely on the DoD, the FAR Council, and GSA agreeing that a CMMC status qualifies, and I wouldn’t pin my business on them coordinating. Whether you’d start over depends on whether you have only defense contracts or other federal ones, and how quickly they implement changes. If you only do defense work, a rule would be finalized by the time your CMMC is up for reassessment, and it wouldn’t revoke your status. Hopefully, since they care about contractors, they’d grandfather valid Level 2 statuses until they expire, but I wouldn’t bet the farm.

Q&A: How Do We Validate That We Fully Meet Each Control?

Daniel: Zach asks how to avoid the “you don’t know what you don’t know” problem. First, we see people implementing controls on non-FedRAMP clouds that hold CUI, and those controls immediately have to be marked unmet. Know your cloud providers and their status. Have your asset types identified: CUI, SPA, CRMA, specialized. Those are the two lenses for every control. Ask whether you have evidence or artifacts: a screenshot, an interview, a walkthrough that defends the position down to the assessment objective. Do a mock assessment of yourself, a full self-assessment, and map it against 32 CFR, where the CMMC program sits. Find the points that can and can’t go on a POA&M, then score yourself with the DoD Assessment Methodology. The CMMC Assessment Process guide on the Cyber AB website is a good step-by-step walkthrough of what an assessor does, which is what you should do in a self-assessment.

Jacob: Where is the DoD’s official self-assessment tool? They came up with the methodology and the regulation, then changed leadership, want to go fast, want to be innovative, want AI to do a bunch of work. Where’s the official web tool, not something I have to download like CSET, that says “use this and you’ll generate an accurate score”? Make me answer all 320 assessment objectives, and if I miss one, I don’t get the points. If I miss a requirement that can’t go on a POA&M, I don’t get a passing score. It’s been 100 days, two years since the regulation, and the methodology came out in 2020. Lead the way, guys.

Daniel: I don’t think the DoD assessment methodology has even been updated for conditional-status scoring for Level 2. Even update the PDF and Excel file, because we have subs and primes earnestly trying to do the right thing with documentation that doesn’t reflect how it’s supposed to work.

Jacob: If you don’t want companies hiring consultants and paying for GRC tools, which are fancy Excel front ends over the same spreadsheet logic, put the tool out. Enough with Project Spectrum, the NSA Cybersecurity Collaboration Center, and the vulnerability disclosure program. How do I score myself in an official DoD-endorsed tool I can use for free? It has nothing to do with third parties.

Q&A: Does an RMM Tool Need FedRAMP If It Can Access a Computer That Handles CUI?

Daniel: CUI is process, store, and transmit. ITAR is access. So you have a little of both worlds, which is a compliance turducken. ITAR itself has no FedRAMP requirement. Under CMMC, a cloud provider needs FedRAMP when it processes, stores, or transmits CUI. If your RMM tool does file transfers from a device through the cloud, or you take screenshots of CUI, that tool is in scope. If you rule all of those out, either through technical controls that disable the function or robust policy, or both, the RMM tool doesn’t need FedRAMP Moderate. You can use a commercial RMM, but you’ll likely have degraded service because you’ll have to turn off or limit features.

Q&A: Enclave vs. Whole-Organization Scoping, and What Happens If Scoping Disappears

Jacob: I’ve posted about this on the subreddit and LinkedIn and made podcasts about it. I know Brilliant at the Basics isn’t formal requirements, but I’ve spent seven or eight years on these regulations and their evolution across DoD leadership teams. I don’t have a good feeling about how it’s written, or about the language the department has used over the last 100 days on scope, because they don’t like administrative detail, and that’s what scoping guidance is. Daniel, what are the pros and cons of scoping the whole organization versus carving out an enclave, so we can see what’s lost if scoping guidance is shredded?

Daniel: It comes down to whether you can limit a subset of systems to processing, storing, and transmitting CUI. It’s a data flow decision: keep your data flow as it is and make all of it compliant, or modify the CUI data flow and keep it in a separate environment. An enclave is typically virtual-desktop driven, maybe with some on-prem connections. Enclaves are great for limited CUI on limited systems, and if only 10 to 15 percent of your users are involved, you’re usually in good standing. Some international organizations have made two or three physical sites the equivalent of an enclave. Full migrations take a lot longer, but if you can’t confine CUI to an enclave, your only option is to make the existing data flows compliant.

Jacob: What we’re really talking about is what’s required on a non-federal system the government doesn’t own, control, or generally have authority over. The only reason it can tell you what to do with your system is that its data is on it. That’s the connective tissue back to FISMA through the special publications, tailoring, and controls. If we’re no longer oriented around federal data on non-federal systems, you just have a non-federal system, so how does the government plan to dictate what you do on it? This is America. Every other federal agency that has tried has been sued into oblivion. The EPA has been reduced to begging water utilities, while the water is actively being shut off during a war, to please implement requirements it originally tried to impose on privately owned systems. There are a lot of shoulds, oughts, and pleases, but without the connective tissue to the data, and all the drama of identifying, controlling, and flowing it, they don’t have a basis. I really hope I hit my head and wake up in a couple of weeks to a more detailed scoping guide, because it would save people money.

Q&A: Does FedRAMP High Automatically Satisfy ITAR?

Daniel: I had this call this week. No. FedRAMP authorization is a specific set of controls assessed at low, moderate, and high impact. It doesn’t demand US-person staffing or any particular data-handling requirement. That’s why GCC High with Microsoft and Assured Workloads with Google exist: they add encryption and staff US persons to support the tenant. So FedRAMP High does not equal ITAR compliance.

Jacob: And FedRAMP Moderate doesn’t automatically equal CMMC or DFARS 7012. It’s not even necessarily a Venn diagram. The only overlap is that they derive from the same NIST documents, but their applicability and coverage differ.

Chat Comments: Rev 3 Unsupported Components, No Phased Rollout, and the Mad Libs Problem

Daniel: If you’re not paying attention, Megan is doing an excellent job putting citations from 800-171 Rev 3 on unsupported components in chat. This made me think: the FAR CUI rule has no phased rollout. Defense contractors aren’t unique in budget constraints, size, or lack of personnel and skills. Some sectors are worse. Now you drop a regulation on them that takes effect 30 to 60 days after the rule, with no phased rollout, and the requirement is no unsupported components in your environment. How is that going to work?

Jacob: The phased rollout is a DoD thing. It was a concession to industry, and through various evolutions we’ve extended it for ten years. There’s no real belly button to press for the FAR CUI rule, because it’s the FAR Council, a conglomeration with GSA. How does an agriculture or energy company figure out who to talk to? It’s not CISA, and it’s not the Department of Agriculture.

On “too bad FISMA never had what HIPAA had with OCR”: legislation will never have a lot of detail. FISMA created FIPS 199, FIPS 200, and 800-53, and everything that implements those controls through 800-37 and the RMF. One mistake, I think, was that when NARA specified 800-171 as the universal baseline, it didn’t also specify who would define the organization-defined parameters. A quick read of 800-171 Rev 2 says there are none, but a quick read of 800-171A shows plenty. If the goal is a universal baseline but you leave all the variables undefined, you don’t have a universal baseline. You have a universal set of Mad Libs. The FAR CUI rule theoretically defines the ODPs, but it referenced the DoD’s decision on the Rev 3 ODPs in the CMMC 3.0 rule that we never got. Will they come up with their own or leave them undefined? Imagine the FAR Council doesn’t define the Rev 3 ODPs because the DoD is having a moment, and you end up with Rev 2 on your defense contracts, Rev 3 on your federal contracts, and different ODPs on every federal contract for the same baseline. That’s 37 different enclaves. I don’t know how likely that is, but it’s a nonzero chance, and it would really suck. Like and subscribe, because we might find out by the end of the year whether that’s our timeline, or whether the government has been quietly harmonizing requirements and reducing your burden.

Wrap-Up

Jacob: Tell us in chat what you think. We do this every Friday at 10 a.m. Pacific on YouTube and LinkedIn, live. You can find us at cuihotline.org, call and leave a voicemail, fill out the form, DM us on LinkedIn, or find us at events. We’ll be at CS5 next week, which I’m sure will be a ton of fun. We’ll be back Friday to tell you what we heard and saw and answer your questions. See you next week.

Daniel: See y’all.