October Cyber AB Town Hall Recap

On this week’s spine-tingling episode of the show, Jason and Joy sit down unwrap the October Cyber AB Town Hall like a bag of pillowcase full of candy. With less than two weeks until the November 10th launch, this marks the final town hall before the CMMC becomes a fully operational reality. Tune in as we mix up a cauldron of all the important information you need to know to assure no tricks as you pursue your CMMC bag of treats… no costumes required!

---

Transcript

Well, Joy, uh, last time that we had this, first and foremost, you know, I always have, uh, the unfortunate, uh, honor or the unfortunate duty, right, to relay the bittersweet news in the show’s history. If you check back, anything bittersweet we have to talk about. And and so we’ve been able to get together monthly after each town hall and kind of go over the town hall and let people know what’s to expect with the CMMC program. And unfortunately, this is the last time that we are going to be together doing one of these shows before the CMC program is live. Right. So, uh this is the last town hall that we are covering without the CMFC program it being live.

Thank you for following me. No, no, for no, no, no, no. So bittersweet because we’ve come up to this point, Joy, we’ve arrived at the last town hall which is associated with whatever we needed to know to expect getting ready for the CMC program to drop, right? Like every month the ecosystem comes together and they listen to the CEO and the CEO says, “Hey, these are the things to expect. This is what you should be doing. And these are the new measures that we’re putting in place.” And now after this town hall joy, we have a live CMC program. And now it would be more of CMMC program progress. I’m sure some of our staples are going to stick around. But it’s kind of bittersweet, right? Like we we’ve gotten this far and then I’m a little scared and nervous because it’s the end of an era. It’s okay, Jason. I’ve been through many in my life. We’ll be

Yes. the end of an era. like when the great Nick Saven retired and Kaylin Dbor took over uh to lead Alabama to the top 10 ranking that they’re in right now. Exactly. Right. Um so Joy, we’re going to go over the town hall like we usually do every single month. And uh when we got together the last month for this Government Shutdown Impact on CMMC town hall, we uh as a country, the government was going into a shutdown. I don’t think that either one of us expected that when we got to this show, the government would still be in a shutdown. No.

And obviously we’re sympathetic for everybody that’s impacted by it. Um but it’s our job and duty here to kind of explain what to expect in the CMMC program as the shutdown continues to linger uh with no end in sight. Right. So um couple of things that were addressed during the town hall.

first and foremost is that the the lapse in federal appropriations um there really isn’t a huge impact. Still all of the things that the ecosystem reported to be up as far as tier three suitability, Dipk assessments, the CMMCAB, all of that stuff is still fully functioning, right? Still the CMMC PMO is down, right? They they’re not coming into work and they have a pretty important duty here. And one of the important duties is putting that final stamp of approval on those tier three suitability screenings. And if you remember last month, Joy, when we were like the one thing that we can’t have impacted and dear God, I hope that it didn’t get impacted was tier tier three suitability. And now we are here and what is impacted?

Well, hopefully it’s going to be a very fast catch up for them when they’re back if they’re just putting the final stamp on it that they can get those that are pending just pushed through quickly. We’ll we’ll stay hopeful.

I I mean, I’m always like naively hopeful here, right? Like that they’re going to come in and maybe uh they’re rested and relaxed and they’re like really hard charging. We’re going to knock things out. And I hope so. And and the reason why um is because again, a lot of the impact to the to the CMMC program is not going to be felt as in November 10th. You know, the next thing we talk about is the final rule. November 10th is around the corner. It’s less than two weeks away. That’s when the CMMC phase rollout begins. The CMMC program officially kicks off. And there’s no impending impacts to necessarily the program kicking off. But when the program kicks off, Joy contracting officers are government employees. And if contracting contract officer seats are pretty empty right now. All and if there’s no contracting officers, Joy, that means there are no contracts going out with CMMC requirements, right? No contracts, no clauses, no clauses, no CMMC. So, there’s that.

Now, we did uncover last week um seven. It’s just coincidence, right? Seven solicitations where there were CMMC requirements that were attached to them. And we know that solicitations are kind of on a schedule. So when the government comes back in, maybe there is an expedited release process for solicitations and now it’s just Oprah, you get one, you get one, you get one, you get one. But we don’t know how that’s going to work and we don’t know when that’s going to happen. But the impact that you can feel now, if there are no KOs, there are no contracts. If there are no contracts, there are no clauses. If there are no clauses, there are no CMC requirements. Not saying that you’re not going to have them. I’m just saying in a government shutdown, you’re not going to see new ones appear up. So, you’re going to be like, “Oh, the phase roll out didn’t happen.” Uh, no. We’re just It’s

Yeah, the CMMC haters are going to have to settle down. It It will happen.

Yeah. Any excuse that you can get. You give them an inch and they’re going to take a mile. This is a couple inches. They might go for a couple miles, right? So, we’ve talked about how like the shutdown impacts it. One thing there is a little impact in the ecosystem growth but one thing that’s not impacted as we CMMC Ecosystem Growth Update talk about the CMMC ecosystem growth here Joy is the level two certifications being issued 65 more this month.

That’s amazing.

It’s a good roll. It’s more than one a day.

Um I would like it if it was one or um it was one per C3PO like if we were adding up 83 to 83 and we’ll get to that in a minute. Um, but we’re getting there and steady progress is there and we are I I mean I would think at this progress by this spring we might be over a thousand. That’s good. I I think that’s great.

Yeah, I think it’s selling quickly.

431 done, 65 done this month, 104 in progress. So that’s taking you up over 500. 535 to be exact. We’re not going to get into math here. We know how that ends up. And then 21 conditional statuses where there’s 21 um uh assessments that are either in that closeout period or in the PO in the POM closeout period or something else is happening where uh there’s no certification issued. There’s no full certification issue, but they’re CMC level two conditional, self assess, condition, whatever it may be. Right.

Yeah. Conditional I think does mean that they went into a POM and they were offered the conditional certification and then when they close out the PO POM, they get the full certification.

And then if I’m remembering correctly, if I have a CMC level two C3PAO conditional certification issued to me, I can um bid on and be awarded contracts for CMC level two C3PAO certification because I have it in the name there. I just have to make sure I meet that POM closeout or whatever the conditions are for me to get my certification. Right.

Yeah, that’s how I understand it.

Okay. Well, I Well, I mean, you understand the cap a lot better than I do. So, if you say it works, that’s how it goes.

Um, but
you know what I didn’t see? What I would like
um and I don’t know if we’ll ever get to see this, but it would be so informational and informative for us is if they were sharing some stats on how many organizations started with the C3PAO and didn’t make it through phase one because that then that gives us information on how well prepared are they when they think that they’re, you know, kicking it off with the C3PAO and how many failed, how many just didn’t make it even through their own assessment didn’t make it to conditional status because the poem was um not going to allow for it. I’d love to see those numbers and and I don’t know if they’ll ever share them with us. What do you think?

So, I mean we got them once, right? And everybody was so excited. They were like finally, you know, we see that there are failures. I think it was like six or something in one month that were reported. Um but the false starts is not one of those ones that we’ve ever seen, right? those ones that get into the phase one and and the C3PO is just like this documentation’s not cutting it or we just don’t think you’re ready. We don’t think you need to go through this because it’s not going to turn out the way you wanted to and then they stop. Um or the the failures, but once we got it that one month and everybody got all excited,
who’s a tease?

They’re not there. But maybe Joy, maybe I listen, hear me out.
Just just hear me out, okay? naively. Maybe, you know, if we run the ball four times on the goal line, right, we’re going to score. So maybe there are no failures.

Is that a Why are you laughing at me?

Wow. Okay. I didn’t even conceive of that. But don’t you think that would be something they would be saying?

I tend to think that they would be there’s
I I I mean, yeah, yay, no failures. I I would do that.

The process of the phases of the CAP are doing what they’re supposed to do in that preliminary phase, phase one. They’re weeding out people they know are not going to make it. So that that would be a very strong phase one. Um I just I have a hard time believing there’s no failures. And then it would kind of put a stop to that argument of everybody’s getting perfect scores. News flash, you don’t get certified unless you have a perfect score or unless you are in position to get a perfect score under certain conditions. So, right there’s that part, right? So, um I do think that it would do some public uh combating of that argument. I just don’t see her. It’s I I maybe there’s none and maybe my Santa Claus wish list
if they if they pop up there. Well, if they pop up there next month and they say for you, Joy, no failures this month,
I’m not my breath.
I’ll buy you a cheeseburger.

Yeah.

Let’s talk about some more growth in the ecosystem. Now, this one is a little troubling, but there’s there’s an excuse, right? We can explain. Um, last month there were 82 authorized C3POs. This month there’s only 83. Only one authorized C3PAO this month. Um, now this is one of those areas that’s potentially impacted by the government shutdown wherein there’s a stamp of approval that comes from the government that’s needed for that. Not in the assessment, the Dipk assessments are still firing off. Um but the stamp of approval authorized the C3PAOs because even though with the shutdown there are four or five authorized CP C3 C3PAOs or there are four to five candidate C3PAOs that are waiting authorization and that authorization is pending the government opening back up. Um and then more promising news 16 uh C3POs have passed their DIPAC assessments and are entering the fourth quarter so to say of their authorization process. And then there’s 14 more that are in the pregame warm-ups waiting to get into the assessment game. And then once they get done, that’s 30 more. That takes us over a hundred. And you would anticipate that with the government opening back up um that that’s when these numbers will start picking up and we’ll see that progress.

So I would assume um not naively that depending on the government the timeline in which that opens back up sometime maybe by February we’re over a 100 authorized C3PAOs

um with 530
let me say that again 530
candidate C3POS the applications just waiting to get reviewed.

Yeah that’s a lot
that’s five times what we have right now.

Well, everyone’s hearing about, you know, that that’s what is going to be the biggest problem is the lack of C3PAOs and CCAs.

I don’t know about that. It’s it’s interesting. You talk to different people at KO or the um you know the PMO office at the DO and there’s a lot of different perspectives on it. I think that uh we do see that C3PAOs are backed up. A lot of the ones that from the outset have been super active in the community of great marketing, advertising, um, all of that, they’re they are getting backed up, but they’re also scaling really fast.

You know, our our friend Fernando, I think he went from like 2 to 26 or 22 um, super fast on his team. So, I I think a lot of them are scaling that quickly and um, addressing the waiting line a lot faster.

All right. So, let’s think about this. Everybody that’s in the queue right now and everybody that’s been authorized become, let’s say that 50% that are in the queue become authorized and we get over 300 authorized C3POS’s.

Let’s say that each one of those is capable of performing one assessment per week. We know that that’s not true because like we just talked about with uh Fernando Machado and his team of 22. So that’s four to five, six maybe C uh C uh assessment teams.

So let’s think about this. And there’s 300 that each perform one a week. That’s 1,200 a month. That’s 10,000. That’s 12,000 a year.

That’s still not 80,000, but that’s under the premise.

If they’re losing it in over several years, then that actually makes sense.

All right. So now let’s talk about this. You have 300 authorized C3POS. You got to have the staff to create those teams. You just can’t say, “I have a C3PO. Here’s our assessment team. We’re one guy and three dogs.” That’s not how it works.

So, right now, there are 567 total CCAs. That’s TeamFC certified assessors. Now, that’s 40 more than there were last month.

Of those 567,
331 have earned the lead CCA designation. That’s 23 more this month. Why?

So, that’s right. So, is that right, Joy? the lead CCA the CCA number and the lead CCA number are one and the same, right?

Yeah. Out of the CCA pool, they um are identifying how many of those also qualify as lead CCA.

Okay.
Yeah.

And then,67
CMMC certified professionals. That’s 1167 people have passed the test.

1,600 that’s about if we divide the 1600 total CMMC ecosystem professionals 300 T3PAOs let’s say they all work at a T3PAO you’re about five there so that’s at least one team so it is logical it is practical if only half uh succeed I don’t think only half are going to succeed if we get close to 500 this is going to be great

let’s talk about something else great that they talked about um the C3PO C3PAO Advisory Council Update advisory council we gave They gave an update on that. Um, and there was just one quick update. And the reason why it’s great is because somebody I think that both of us professionally respect a lot. Um, has u assumed a position that was vacated as the vice chair. That’s corn wise, right? Uh, wise technical innovations assumes the vice pair vice chair’s position of the hold on. I’m going to know this. I’m going to know this. Uh, the accreditation committee.

I don’t know which committee it was on but I it was the vice chair of the C3PAO advisory council that was vacated I thought.

Yeah. So
so the the com the subcommittee that is responsible for all the accreditation research and everything like that uh the seat was vacated. Uh Matt mentioned that uh to be a part of the C3PO advisory council you have to be a part of a C3PO. So whoever was in that seat obviously something may have happened whatever it is. Um, so with that being said, congratulations to Korn. Um, obviously welldeserved, very hard worker, grinder, and super happy for her. It was it was a great move. Sad that um the person that had to step down because she’s no longer part of a C3PAO um is not participating because she had so much value to bring to that role. Um but she will continue to do so in her new role. So
yeah.

Yeah. And so, uh, just a little bit of false claims acts news came out this Thoughts on the Georgia Tech FCA settlement month. It it kind of dropped right before we were at CS5, um, with Georgia Tech. And and we’ve covered Georgia Tech on separate episodes of the podcast. Many people covered Georgia Tech. I’m just going to name off the one thing about this entire settlement that really is troublesome or bothersome to me. And I said it on stage at CS5.

There’s only one thing.

Well, there’s Yeah, but there’s one major thing.

Uh, as somebody who takes cyber security seriously, I didn’t know if you guys knew that or not. Uh, when there is a major cyber security fraud happening, uh, knowingly evidence of lying about your SPRS score to the government to secure more funds and you’re penalized only $800,000, which is less than the school that you work for pays the starting quarterback on their football team for a 10ame season. That’s a problem.

I hope the hammer comes down here in FDA news. That’s just that’s unfortunate, right?

It is really unfortunate. Um but we only have the information in front of us that has been made available about the whole scenario. Um, I have to say if I was the whistleblower in this situation since they get 30% of it with the starting figures that we were imagining for this and that were being put out there being reduced down to what that settlement amount was that whistleblower is like, I have to return my yacht.

Yeah. I mean, everybody that you speak to says they every lawyer that I’ve spoken to, their opinion is is that they got off pretty easy.

Yeah. Oh, yeah. for sure.

So,
yeah.

Um Joy, there was a profile before we Profile of CMMC Success and Thoughts on Ethics get out of here. Um couple things to talk about. We’re going to get to our wish list because they are going to get to our wish list. But before we get to our wish list, just a quick uh one new addition, actually two uh quick things, but one new addition to the CMMC or to the Cyber AB town hall for this month was uh the profiles and CMC success where organization that has achieved their CMC level two certification kind of gets the spotlight to tell I’ve been in the trenches. This is what worked for me. This is what it is. This is the buying. Uh it’s a lot it for somebody that’s out here and no matter how you look at it, we work at a provider and a provider provides services and those services come at cost. Uh for us to tell stories and to give you information, that’s great. Um but to have somebody that’s been in the trenches that kind of looks like you to give those stories, that’s great. I like the addition of this. I thought it was a great story of USC.

Um, the one thing that really stood out to me, uh, was that, uh, the way that Rob uh, Grun is his name, I I do believe, spoke about a buy in, organizational buyin, something that we preached about, but now it’s not just getting management to buy in to give you the check, but the people to buy into the jobs and the responsibilities that they have to do to carry out the compliance mission after everything’s implemented, right? Uh, people can say that, I’m going to do this, but if you don’t show up and do those things, the entire compliance program goes down the drain. I thought that was particularly important to hear that say that, hey, we have a job that we have to do no matter who we pay, what we pay, or what they’re supposed to be doing.

Yeah. I mean, the proactive nature, their approach was really impressive. Um, I really enjoy Robbie each time that I’ve spoken to him. He’s um he’s a friend of the program, a friend of ours, and his whole team is pretty amazing. um you know because I’m here in LA not far from their offices the ICT offices and uh like literally five minute drive from here and so we’ve had the opportunity to spend some time together and what was fascinating to me is watching an FFRDC go through this process because they have so many different just the whole way that the organization is run the way that the funding is received the contracts it’s very very different from a normal defense defense contractor and they had a lot to wrap their arms around. So absolutely thrilled for Rob and his team not just to get their certification but to be able to come on the cyber AB and talk with Matt about that journey. Um I was impressed that they gave him so much time to talk through it and and Matt asked him really great questions. So well done.

So for the people at home FFRDC federally funded research and development center protocols I think.

Okay. Yeah. Sorry.

No, that’s Listen, sometimes we get those acronyms. We want to break it down so people understand, you know, at home exactly what’s going on instead that the dummy on the other side of the camera.

Yeah.
Understands what’s going on. Um, anyways, so last thing before we do our wish list and get out of here, ethics. Normally ethics has been a my ESP is a CSP, not a CSP for the past three months. Kind of put that to bed at CS5. Um, but with that being said, now this ethics thing, very quick and simple. This this month’s ethics lesson, don’t break the law. And when you do, you’re supposed to report it to the cyber AB. And those laws are either criminal or civil, the failure to deliver on contracts. And if you don’t, the penalty if you don’t report it, the penalties may be stronger. Anything to add, Joy?

I’m calling a strike on this one.

Why? Um well because I feel like they could do so much better with the ethics segment by giving examples like number one responding to and this is going to be my wish again is let’s actually talk about what happens to the ethics complaints when they get submitted because there has been no responses um from myself or other people that I know have submitted an ethics complaint not even an acknowledgement that we received the complaint. So, it goes out in the ether

and then Matt talks about it on the town hall as in a big general this is what you need to do, but there’s no um like at least give us insight. How many ethics complaints have come in? How many have a third party been able to look at and address directly that have been resolved to some, you know, satisfaction either on the complaint side or being able to help better inform the people who are working through these ethics um complaints, but I it just felt really plain vanilla. You can go to the website and read the code of ethics and have as much information as was was shared here. So that’s my next request. That’s oh Santa please bring me some informative ethics information about what’s actually happening in the ecosystem.

I’m not going to lie that that’s a bit of a spicy topic that I would be very interested in. I I think you know me pretty well.
I don’t avoid the spicy.

Pretty pretty interested in this ethics stuff. I would be extremely interested if we could just find out just a little bit about what’s going on because I know that we see some things happening that we hope that people are talking about in rooms and I know that there’s been some submissions stuff like that. But yes, we do know how to get to the process of submitting the ethics complaint. What we don’t know is how long to expect after we submit the ethics complaint to wonder if this just died, if this behavior is still acceptable, or if they’re backed up and trying to deal with the behavior. Right?

Because I think there’s still some wild behaviors that we’ve seen out there that clearly are ethics complaints that clearly have had ethics complaints submitted about them and they’re still being broadcast to the general consensus. The longer they’re broadcast to the general consensus, the more detriment it can be to an organization that buys into it if it’s not right. So I think that

what happens when you encourage people to report things that they see and then you give absolutely zero acknowledgement that the report was received and it’s being acted on.

People stop reporting because they think nothing is happening.

Right.

Right.

So let’s not have that happen.

Yep. They need to know there’s some action. So you got your wish list. You TH Wishlist…See you next week! said some ethics updates and stuff like that. And I’m going to kind of double down on something that you wish for. Let’s make this all about joy. I I do want to see the false starts and the failure information. I think that that’s very vital as I mentioned earlier in the show. Very vital and important for the ecosystem to not only understand that there are consequences, people are actually failing, but for those people out there that still are flat earthing it um to hear that not everybody’s getting a perfect score and that some people are having a tougher time than this. I I think that that’s it. So, let’s get some ethics numbers and let’s get some numbers on failures. All we want is more numbers. Baby, let’s do it. Like and subscribe. We’ll see you next week.

All right.
[Music]