Name: DIBCAC Assessment: No Tricks, No Treats, Just the Facts
Uploaded: 2026-10-28T17:31:29.863Z
Duration: 1 h 2 min 16 s
Description: DIBCAC Assessment: No Tricks, No Treats, Just the Facts

Transcript for "DIBCAC Assessment: No Tricks, No Treats, Just the Facts": Hello, everyone. How's everyone doing today? Thank you for joining us. We have, we have an interesting topic today around DIPCAC assessments, which I know you're all interested in. Thank you for for coming out. Just a reminder that the recording and the slides will be available, post this... The event, and, we're happy to share them with you, so please reach out. We also will have some q and a at the end of this. So please, if you have any questions about the content, please, let us know, and we can definitely, answer those questions and, make sure that you guys get, the most bang for your buck showing up here today. Alrighty. So we're gonna cover some some things here today. Not gonna go through every single thing here, but, really, just getting into, DeepCAC assessments, what those, are like, what they're looking for, understanding the DeepCAC assessments, the experience, how to prepare for it, that SPSS score. That's the most scary thing here. So if we're we're keeping with the Halloween theme here, that SPSS score is, scary, but it doesn't need to be. Right? So why does DIPCAC matter? DIPCAC is government based assessors. So, DIPCAC is a team of assessors that will come to your facility, come to your office. They'll even come to at home offices if that's the way that your environment is set up, to do a transparency audit. Now they have, three types of assessments that they do, technically four, but, the fourth one is more for c three POs to get them authorized. But they have a medium and high assessments under the DFAR seventy twenty, which will give a confidence level that goes against your self assessment score in SPRS. They are part of DCMA. So DIPCAC is part of the the defense industrial based cybersecurity assessment center, and they will, be a subset of, individuals, that come and they were... Well, leading up to the assessment, they will start asking for evidence, your SSP documentation, things of that nature. And then they'll come into, your environment and and kind of walk through your documentation with you and kinda go through, an entire audit. And then from there, they compare that number to your self reported score. And then when contractors, contracting officers are, looking at your bids for proposal, they'll see what you've posted in SPSS as your self assessment score, but as well the score, that DIPCAC posts on your behalf. There are there are some legal ramifications, in there. Right? So, we will talk about about log zone, settlement that begin with a DIPCAC assessment. It wasn't a whistleblower or false claims act that started that. It was DIPCAC coming in and, noticing the score was not, in line with, what was, posted originally. Again, these take precedence. Right? So DIPCAC, it's the government auditing you. So you may have a CMMC status in SBIRS, but if if, they come out in which to say the boundary changed or they find discrepancies, their assessment takes precedence over your c three p o certified assessment. However, what we've seen in the, in the landscape is if you are CMMC certified, for level two, DIPCAC generally does not come out to assess you. They are the same standard that you follow in this state hundred one seventy one, just same as a c three PO would. Now a lot of people are asking questions around the the landscape and the assessment environment of what has happened of late with the CMMC pause, and, we were going through those phases. Right? So phase... The phase, coming... What's supposed to be coming to a close here of making sure you're CMMC certified, you know, by November 10 of this month, or or of November. So a few more days left in October, but, it's coming down. But that was, that was suspended. Alright? So the DOW CIO suspended phase two, pending a a task force review. It was supposed to be sixty days. We're over a hundred days now in that review. What we've seen in lieu of c three p o assessments is an uptick in DIPCAC assessment. So getting more more of, our clients are getting notifications of DIPCAC assessments. So they are starting to get prepared for those, those assessments. But we've also seen if you have a reservation letter or you have a c three p o assessment, in the, in the time between the DIPCAC audits that is scheduled from the DIPCAC, PMO office and, and your c three p o assessment date, DIPCAC will will, forego coming on-site if you can prove that you are actually c three p o certified. Again, DIPTAC does the c three p o certification, so there is confidence in that, in that assessment, because they have... They've authorized those c three p o's. Doesn't mean that they won't come out. They are definitely within their rights to come out if they choose to. So just... That's something to be aware of and something to understand. Yeah. So let's understand the DeepCAC assessment. So a DeepCAC assessment is really a transparency audit. What what that means is there's either a medium, which, is a little lower of of a threshold of of confidence in the high. Right? So, we will get into what those two are in the next slide here, so I don't wanna get too far into that. But they are gonna go through in both types of assessments, over your SSP, all 320 assessment objectives, that are listed in, NIST eight hundred one seventy one alpha. Now don't get this confused with the CMMC assessment guide. CMMC assessment guide is something that is useful. It is written off of NIST eight hundred one seventy one alpha, but the the stance that they're... They they take, comes from one seventy one alpha. They're not CMMC assessors, so the assessment guide is not something that DIPTECH has to follow. They also are going to assess you, against the flow down controls, within the defars clause. So they're gonna make sure that you are flowing down the clause. You have a medium assurance certificate. Those things are going to come up. You also don't have, an option. If they they pick you to come out and and and audit, you have to provide access to the government to audit these systems. You're you're responsible for the data that is in this, in that environment. And that day... Data is government data. Controlled unclassified data is government data. So it is their data. They're looking to make sure that you're meeting the requirements, and they ultimately are here to protect the federal government and the, you know, the the, warfighter, and United States government's interests. As well, just something to to understand here. You have about fourteen business days to review any findings that you have or add evidence before the score posts. So if you go through an assessments and let you say, hey. You didn't have an evidence or couldn't find a piece of documentation. You have fourteen days... Business days to provide that to the to the Deepak team before your score is final. Once it's final, it's posted in SPRS along with your POAM. So you'll have a set POAM date that they're going to verify that you are going to be, compliant with the controls that they find, and, normally, that's a hundred and eighty days, threshold, from when they have their initial assessment. So medium versus high, that's one of the biggest things to to kinda understand here. Medium is is a basic... Or a review of your self assessment. So it's it's a transparency. It's a thorough documentation review. They're discussing, items with you to clarify, maybe add it add it, asking for, you know, shared responsibility matrix. They're... They are posting the score based on what evidence you provide them with medium confidence. And so a con, contracting official is going to see that. They'll see your basic, which is self, which is low confidence. It's it's the, contracting firm or the the contract... Contracting firm or your company. It's the company's posted score. Right? You did that basic self assessment. You posted that score. You did the did the best effort. Right? You went through all of the NIST eight hundred one seventy one, and you scored yourself. That's that's the lowest confidence. Medium is when they do the document review, and then you get over to the high, which is more of a, verification exam... Examination and demonstration of the SSP. They're gonna go through. They're gonna ask you for your documentation, make sure that that is accurate. Then they're gonna ask you questions interview session. Right? Hey. You say this in your documentation. Is that accurate? Yes? No? Okay. And then lastly, they're gonna ask you to show it. Right? So then then at that point, you are... You're going to test. Let's say you're... You, have a fifteen minute lockout. You have to show that that does lockout in fifteen minutes. Those type of things, happen, and I've been a part of both of these types of assessments. Before... So as you... What you... What to expect in in a notification, you're going to get something from the the DIPCAC office, notification asking questions from the team lead, and the the DCMA, PMO, DIPCAC PMO, asking for, you know, documentation, SSP, evidence. They have an Excel sheet, and then they have items for you to upload to DOD safe and provide them with that. Then during that, they're gonna have an open brief. They're gonna go control by control walk through, and they're gonna be, you know, request answered that... In that time frame. So you're... You were... This is live sharing. This is live uploads. This is happening, in real time. And then at the end of the day, it's it's a daily readout. You'll know what you're missing, and you'll know what you you need to, either provide as homework if you didn't have that evidence, able to provide that day. So they they have their readout, and then generally what happens is maybe you couldn't get a redacted personnel screening. So then you provide that later that afternoon or that evening, to the team. That way they can review it, before the next day, and then update what we like to call as the Christmas tree, which is the daily readout of green or red status or yellow or something that is pending. So that way you can track what controls are left open or, trending other than satisfied or trending satisfied. Then after that, you've gone through that full sessions. You're gonna have, an out brief. They're gonna go through the controls, their findings. They're gonna tell you why each control wasn't passing. That way, you can document it on the POAM, and then you can create a plan of actions and milestones with a date to close out within a hundred and eighty days. And then that score is going to be in SPRS, and then that they could potentially come back out to see how well you closed up, your POAM. So I did talk about this at a high level in the last slide, but I really wanna go through what they're looking for because I really wanna beat down on this. This happens quite a bit as I'm... The panic comes in of, like, what are they looking for? How can I prepare? The biggest thing... You know, if you're gonna prepare, you gotta know what they're looking for. Right? Generally, I start with scoping first, and it's very important, but I really wanna go through, you know, the understanding of the implementation. All 110 requirements are assessed by by assessment objectives. So there's 320 assessment objectives. A lot of people think, oh, I just gotta look at the control requirement. I'm meeting this. But there's sub controls under that, and those are the assessment objectives that you have to meet. You miss one of those assessment objectives, you fail the entire control. And there's only limited controls that you can met... Get that as partial. And then on top of that, they're gonna make sure you have an honest SSP. A lot of times, people write SSPs based on what cell... What sounds right or, what they think it should be like or what's the planned state of your of your system. They're looking for it to be accurate to what's in the system today. You get five document changes. Those document changes, are at the discretion of of the team lead. So you only get five, so you really wanna make sure your SSP is accurate. So in the in the time when you get notified of a DIPCAC audit to the time that you are in that, really hone in on your SSP. If you're honing in on your SSP, I'm gonna skip over evidence consistency. I will come back to those. But, that's really going to be focusing on your scope. Right? So what ends up happening is scope, is anywhere that that CUI could actually live, process, transmit, or be stored. Right? And what ends up happening is people may have an enclave, but, their sales team, originally was only gonna get federal contract information, not gonna live in your your CUI boundary, but now they're receiving CUI's parts of their bids and proposals in their email. And that email's in commercial, not GCC or GCC high. In that situation, right, they're not in a in a FedRAMP moderate or high cloud provider. Now you have an expand of scope and your SSP is wrong. And so when we start going through these and we start providing evidence and we start proving that each control is working and then we find something that is out, you know, outside the boundary that we document the SSP, now we have scope creep. And now we're assessing your commercial environment, which is not suitable, does not meet the DFARS seventy twelve clause, and you're really impacting your SPSS score. As well, they're gonna be looking for consistency, between your policy, procedures, and what the admin shows on the on the screen. Right? So if your SSP says you're doing something, but your policy says you're doing something different and the technical evidence does... Says you're doing something entirely different as well, now you have inconsistent application. Right? And so we need to make sure your SSP and your documentation and your evidence and what you're telling the auditor all aligns. Right? Anything that the assessor reads in the SSP and then they ask the the IT administrator to show them, the difference, that is the finding. Right? The gap between those two things, that's the finding. That's what we wanna reduce as much as humanly possible. Now there's sometimes where, things might just need to be updated for clarity, and and that's at the discretion if they're gonna count that as a doc change. Right? Maybe, you had a tool that changed names. Right? So, a lot of times vendors will will start with something and an application changes a name and you didn't update that in your SSP. They may be okay with that not being a doc change. They may not. Again, that's back up to the team lead. So, make sure that you're honest about what's going on and and honest about the stuff that's in your environment, and be straightforward with them. Right? They're they're... They are just coming into your environment for the first time, and they're looking to help you. They're not here to to find, anything. They're not here to... They're here to find discrepancies, but they're not here to to really get after you or or to attack your company. They just want the data to be protected accurately. So... And they're and they're and they're also trying to help you with your SSP and your scope, making sure you understand the controls, making sure that you understand where your where your CUI lives so that you can correct it. However, if you have a score that's reported that's not accurate and, you're not even close, you may have some other ramifications, and we'll get into that as we go down the slide deck here in one or two slides. So the SPRS score, this is this is the most scary thing, that I have, I come across. And and most of the time, what we see here is your... Companies are under the gun. They're under the gun to report an SPRS score to win a contract or to keep their prime or their subcontract, or work with a vendor. So what they do is they quickly go through missed eight hundred one seventy one, and they put in a score that they think is accurate without any verification, and they're unable to defend it. Right? So to understand SPS scoring, it's a weighted scale. Right? So you have one, three, and five points scores, controls per requirement, and they're weighted by risk. Right? So, you know, if it's something that is... That the government feels, is highly important for the security of your system, it's gonna be a five point item. And then if there's something that's more of a layered defense there, that will be a one point item. This... If you if you do the math for all the controls, you can go all the way down to a negative two zero three, which means you have nothing against, the the NIST eight hundred one seventy one standard, or you can have a perfect one ten, which is the best score. Maximum age for for your SPRS score, and a lot of people let this expire, is every three years. A lot of people will have mergers acquisitions. They'll have scope drift, and they won't update the SPRS score. You can update that SPRS score as many times as you want. So, something here to to be mindful, if you get a new tenants, a new acquisition, you have admin turnover, new tools, make sure as part of your your change management that you go into SPRS and you update that score because, you know, nothing's worse than getting an m and a. You're doing a merger and acquisition. Then getting a notification because of that that event that you're getting, an audit, you were at one point, which is, say, a 110, and then, that merger acquisition brings down your score. You connected them to your tenant, your environment. You're now sharing CUI in that that in that new that new environment that you acquired, and now you have a lower score because you're gonna inherit the lowest, score. So that means you need to go back through, in SPRS and update, that. So it's a lot easier and a lot better to have the conversation with an honest 85, and with a credible POAAM than a 110 that we cannot defend. That's when we start getting into some, false claims act where the government can can... The government, Dipkak, can recommend to the DOJ to investigate if you've been lying, an SPRS. And we don't wanna lie to the federal government. There's a lot of ramifications that happen with that. So we don't we don't ever wanna do that. Right? So if your environment changes or you have any concerns about this, go revisit the NIST eight hundred one seventy one alpha. Go against all the controls and assess yourself. Do your own self assessment and and reupdate that. So what happens, if the score does not match the environment? Logzone, here in in Huntsville, Alabama... So I'm I'm I'm Alabama based. So those who don't know me, that's that's where I I hail from. They had an, settlement earlier this year in June. So they had a score, and now this is one of the lower ends of the false claim acts. You know, the the fines that you get, here, it's it's... This one's 500,000, but it could be a lot more. It's normally, some type of percentage of the actual, awarded contract. So 500,000 to LogZone, here for what they had, in SPRS. They reported an inaccurate score, and so what happened was DCMA assessed LogZone. They saw that, it was egregious. They reported it over to the DOJ. This was no breach. This wasn't done through a whistleblower. So a lot of times what happens is someone, is either in a contract dispute or have a disgruntled employee or someone raises their hand and say, hey. The company that I work for is not accurately, just picking themselves in in SPSS, so they're not accurately, showcasing their score. And then the the the government comes in and and investigates that. This situation was opposite. Right? The the government came in and did an audit. They saw saw that there was a massive gap, between what they found, and the 110 that was reported, and that was... That's a huge gap, 280 gap. At that point, it went over to DOJ. DOJ did their investigation, and then they found Logzone, as a false claims act. And, eventually, there was a fine of, the $500,000 that you see here on your screen. So we want to avoid that. Right? Be honest. That's the best way. Honestly is the best policy. It may hurt short term when it comes to contract awards, but, having this against you or this mark against you will hurt even longer, when it comes to your reputation. So protect your reputation, and make sure that you put... Report an accurate score. It's something that you can defend against. So go in here. So how do you prepare for a DIPCAC audit? The very first thing you need to do is sit down with everybody in your company. Just go through maybe pro... Project leads, engineering, contracting officials. What I tend to do is I try to establish cope. So when I have a new client come in onboard with me, the very first thing that we do here is we start talking to the sales reps, the contracting officials. Hey. How do you receive FCICUI? The BITS proposal, is it sam.gov? Is it GSA, DOD safe, email from your prime, customer portals? Okay. Once you get that, what's next? Okay. You get that via email and you download it, and it goes to your SharePoint or it's on prem file share. Okay. From there, who access it? Okay. It goes into these applications. Okay. Are those applications FedRAMP? Are they suitable to handle CUI? Who's manipulating the data? Is it printed? Is it on USB sticks? Do you have any external service providers? Maybe you have an ERP system and people that manage that. Do you have any MSPs? Do you have any security providers? You need to go through and and scope the entire, environment. Make sure that you can see what is what what is accessing, handling, or processing that CUI. Not just the systems that are storing it, there's also things that come into play like your firewalls, your your networking equipment, your wireless access points, your cell phones, all of your endpoints. Some of your machine equipment, you need to identify those as well. Operational technology is an item. Now you may not be able to, hit all of the controls on every single piece, but you gotta be able to call each thing out and do your best effort for every single, item that's gonna handle CUI. You also gotta think, if I'm gonna have CUI outside of digital means, right, I need to not only protect technical controls, but I gotta protect my facility. I gotta make sure my hiring practice, my visitor management. I gotta protect those things as well. So it's all about making sure that your scope is solid. You can't, you know, build a boundary around, around something if you don't know where it is. Right? You can't draw a circle on a map if you don't know, you know, what all you need to include in that circle. Once you have that, that's when you're really gonna be able to validate or create an SSP. You're gonna be able to go control by control and think, okay. These systems are in scope. These users are in scope. These applications are in scope. These external service providers are in scope. And then you could define your scope, and you can fix that SSP or fix the environment or fix the policy doc, to make sure it's accurate and meets the intent of each control. And then from there, what I recommend doing, and I and I recommend doing this on a once per calendar year basis, is update your evidence. Have that so it's not stale. That way you can look back and have evidence of, okay. This is when I when I did this. I looked through my authorized users. I pulled them out of active directory. These are... Users are accurate. I reviewed them. That's my evidence for three one one alpha, and I have that here. That way you have that in the event that the government comes knocking. They come knocking tomorrow and you've gone through, an assessment this year and you've posted that score. You have evidence of that that you can provide them in real time. They're gonna feel a lot more confident if they ask you a question that you can provide it. Be be okay with awkward silence. A lot of times, people, wanna provide something fast, then they provide the wrong thing, and then you have to walk back from that. It's okay to raise your hand and say, hey. Can you can you help me understand this control? Give me a second. We'll have to get back to you on that. It's okay to say those things, but the best thing to do is be prepared. Right? This is what we use or what we interpret the control. This is how we thought it was, and that's being honest. That's showing that you're prepared, and that's your best, protection, against any false claims is is having that evidence ready, and then evidence of that internal assessment. That way you know against that that... The NIST eight hundred one seventy one alpha objectives that you have, you've you've accurately done the best that you can. You've done your due diligence to be able to, showcase that. Once you're done with that, so that review, and you should do this frequently, anytime there's any changes to your environment, any updates, this should be part of your configuration management, is to go back in and update SPRS. As soon as that internal assessment changes to the number, you should post it. You never know when this audit is going to happen. They're... It's at their discretion. Right? So the best way to prepare is to make sure that you're consistently looking this over, as part of your configuration management or your change management. And, also, if there's any big changes. Right? So let's just say you get a new SOC or you get, a new security platform, new antivirus. Those configurations might have changed. Maybe you've added another site or facility. Go through and say, okay. The PE controls are being updated, or maybe you've changed vendors for your badging system. All of those things change your score. Right? So make sure you update that. And the reason... The implementation might be the same, but the documentation will change. Right? And, again, going back to that. Right? It's not just, oh, yeah. No. We got a new firewall. It's just a one for one like replacement. But you might have a different time out on a VPN that that is going through that firewall that you did originally. You might have something that's hard coded that you can't change that you used to maybe set to eight hours, and now it's twelve hours. But now your documentation says eight hours, but you never went back and did that. You might have... Might be needing the control on a technical aspect, but administratively, you're not. So make sure that that's all updated. That's all part of not just your SSB, but your policy docs, and that's all part of the process. What happens a lot is, companies, they do the hard work, they do the technical configuration, they do all of the items, but they don't update documentation. The dip cap shows up and their documentation has a gap, and now you have controls that are, outside of the five doc changes that are not passing from an administrative standpoint. Again, the best way to call this out, if you see define or identify, in in the control or the assessment objective, that's generally looking for a document. The other other wording in that... In the assessment objectives are normally for that, technical piece or the demonstration that you're actively doing it. So what's, where where most contracting firms, or or companies fall short? This came out in 2022, and, honestly, I have not seen a lot of changes from this, from my own experience, the team here as well. We have not seen a lot of this changes, when we first get a new client. FITZ validated cryptography, this is even being a more of a hot item with the sunset of, FITZ one forty dash two and moving on to one forty dash three. We're starting to see this more and more, with firewalls that aren't validated. Remember, it's validated. You might have a FIPS compliance cryptography, but it's not validated. Validated is what they're looking for. Now this is one of those controls you can get partial points for, but it still show up on the POAM. So I would definitely make sure that, whatever firewalls, whatever you have are using for that cryptography for the things that are transmitting, processing, or storing CUI, whether it's your wireless access points, your firewall, your VPN, whatever that may be, make sure that it's it's... FIPS validated. So the c... CMBP sites, and this has a site that you can go through. You could type in your PanOS or Meraki iOS, or you can type in your model number and see that if it's been validated. Sometimes it might be pending. So just keep an eye on that if it's pending. I would put that on the POAM and say, hey. Look. We're just monitoring this for the vendor. And some might be end of life and not supported. And that should be on the POAM as well of saying, hey. You know what? I need to go through, and I need to update and fix, my network. Maybe you need to do a, network refresh, throughout your entire environment, and that can be costly. The other item is, multifactor authentication. A lot of times, people have MFA to log into, like, the OWA or the web apps or to some of the apps, but they don't have, MFA for, like, local logins or MFA to protect the endpoint itself. So MFA is one of those ones that I see a lot of gaps in. The other one, flaw and remediation. A lot of times people don't have, one, a schedule... Patch schedule or they have a patch schedule, but it's not defined, or they're not documenting, what... When they did it, if they did it in the time frame that they specified. Right? So let's say you have a fall... Flaw that gets released or a CV that comes out, you patch, you do what you're supposed to, but you never document it. You never went through change management. It's hard to prove something that you did if you don't have a report proving that it happened. The other one that I see a lot of is three eleven one. This is a risk assessment. Risk assessment to you, anything that could be your reputation, to your environments. A lot of people do risk, assessments, to things like, fire or flooding or, a pandemic, or things like that, financial risk assessments, but they never assess their environment to what handles the UI impact to them. So having some type of evidence and showing that that is also recurring. A lot of people do this one time and then they don't revisit it, because they don't see the need or they they don't think the risk has changed. There's risks. They're always changing. AI is a new type of risk to your environment. Right? Someone could deep fake your CEO, and now you are sending off, CUI to your external boundary off your... And, you didn't document AI as a risk, as part of your risk assessment. Right? Vulnerability scanning. A lot of people don't, have vulnerability scanning. They have antivirus or they have, other scanning in place, but they don't do vulnerability scanning, or they, get the get the vulnerability scan. Maybe it's a NASA scan, tenable scan, rapid seven scan, and they don't act on it. They just have those sitting and and waiting, or they get patched, and then they still don't go back and check for offline systems. So that... I see that a lot of making sure that vulnerability scanning is happening. And then from 68, on this list, that's all part of the audit review. So what we see there is not having anyone alerted in the event of audit failing. So, like, firewall goes offline at a site that's remote that maybe people don't normally go to, but no one's catching that, that that log that it... That it's no longer, it's no longer sending alerts to your scene. So make sure that you have a review, that you you are getting alerted and you are reviewing your audits and in your log your log sources. A lot of people get new systems and things like that, but they don't review their log sources. So they don't know that they're getting, or they're not getting the logs from from new systems that they... They've onboarded. Other things that I've seen as well, is not testing your incident response plan. So a lot of people have an incident response plan, but they never tested it to make sure it's accurate. And then also, configuration management is not accurate or followed. So a lot of times people, will get tapped on the shoulder. IT IT administrator gets tapped on the shoulder. We... Hey. We have this person, and we need you to install this right now. It never goes through a review process, and that breaks your three four one, control or configuration managements, the first control configuration management. Alright. So what's the difference between DIVCAC and c three p a m? DIVCAC, I I know I've talked about this a lot, is the government assessors where a c three PIO is a private company accredited by the cyber AB and assessed by DIVCAC. So, c three POs, someone you hire. Right? There's someone that's going to assess, against those one seventy point, 17 requirements. See if they're gonna use the CMMC assessment guide, the cap. They're going to go through that. So you're gonna know if it's a conditional and you have some items to clean up. So, when you have a c three p o, you can have a POAM and still have a conditional passing, CMMC status. This depends on the controls. Right? We talked about three, five three and one point of controls. You can't have any five point controls, three point controls, and select one point controls open, and you can have an 88 out of a 110 and still get a conditional status and then need to close the other items up. You could select your c three p a o. So let's say you work in AWS or you work in a different cloud environment. You might be able to use a c three p a o that has more experience with your cloud environment. So you're able to select a CPU PAO that might make the audit a little bit smoother for you because they have people with the the knowledge or technical knowledge, behind behind that. They're only assessing for level two certification. They are using the NIST eight hundred one seventy one, which is the CMC assessment guide as well when they... They're going through that standard, and they're gonna report the score, to, to SPS and EMAS, and it's going to be there as well under the c three p o... Or the level two c three p o assessment tab. This was going to be a conditional contract award, but it's been suspended since July. I I I still encourage users or companies to get this. The reason being is it's a good insurance policy against, DipCAC audits that you've done your due diligence. A lot of people do not have the, the knowledge or the industry knowledge of this eight hundred one seventy one. So having someone come in doing an assessment, getting the certification is still a differentiator, but it's also protection to show that you've done everything you can to validate your your boundary, your score. You've gone through an audit. That way, if the government does does decide to come, and do a medium or high confidence score, you can be... Have confidence that your SBIR score is accurate. Not only did you do your self assessment, but you also had another company come out that have... That has DIPCAC's, blessing to do so. Again, when it comes to DIPCAC audit, there's no cost to you. It is a transparency audit. They're making sure that you're doing things accurate, and they're gonna assign a high or medium score depending on if, depending on what scope or what type of assessments that they are doing. They are gonna follow this eight hundred one seventy one, and they're gonna follow every assessment objective, and they're gonna they're going to mark, you know, bets or or if you have something with the DOW CIO's office, they'll mark it as NA, but you do need to have that. Again, just to be mindful, DCMA results or DIPTAC audit results take precedence over any other assessment result. So what can the DIPCAC... What only could DIPCAC do? They can override your CMMC status. So if it wasn't maintained or wasn't accurately achieved, they can take precedence over CMMC status, and then the standard, you know, that marks you out of compliance. And then from there, you are going to, handle, you know, the POAM and and correcting anything that they find. A lot of times what happens here is, CMMC status was was obtained, and then what we see is a merger acquisition that then validates your CMMC status. Dibcak comes out to assess you, and then, your scope has changed. And even though you had a cage code with a CMC status, it's not really, accurate, to the change of scope. They're also going to assess you through the full, seventy twelve clause. So they're gonna make sure that you have at least federal moderate equivalency, that you have the incident response reporting, that you're flowing down, your requirements to any sub, subcontractors or down your supply chain. You also need to validate your supply chain. Right? They're gonna ask you, how are you making sure your supply chain is, able to handle CUI? They're going to investigate, after the fact. Right? So they are going to investigate, our call question and reports from the cyber a b, c three p a o, anything that is, any any question to your CMMC status, right, or SPS score. So if you have a whistleblower, they're going to investigate, and see if your your status is, that's being called the question is accurate. They also are going to handle only level... Or handle level three assessments. So when it comes to, the level three standard, which is a, there's gonna be ODPs, there's, this 800, one seventy one or one seventy two rather. They're gonna see that you're meeting those requirements, and they're gonna also make sure that they're assessing the CPPOs, and they're still gonna do that if we have a new CPPO. Now you do have a chance to rebuttal here. So, again, if something does come up and you don't agree with it, you can rebuttal. You can also ask, to, escalate to the team chief. So they have a team lead, and they have a team chief as well, and you can go back and forth. At the end of the day, once the score is final and submitted after that that fourteen day window, it is going to be what is posted in SPSS, and that is what contracting officials are going to look at. So a lot of people ask me, if I got DIPCAC assessed at DIPCAC high, do I get my CMMC, assessment? That ended. That is, old news that ended back in December 2024. So it does not convert anymore. There's no converting of this unless you were one of the few that had a DIPCAC high assessment before December 2024, or you went through a joint a joint surveillance assessments before 12/16/2024. At that point, you you could have gotten a CMMC status. A medium assessment doesn't... Never never converted. So a lot of people... Hey. I did a medium assessment before this date. Did that actually convert? No. It did not. So at this point, one assessment does not, review, remove the requirements to the other. So if the pause does change and CMMC require... CMMC assessments are required, there is nothing in the space today that if you did a dip tag high today, that it would would eventually convert to a CMC status. That is not something that's, that is, truthful today or something that I've seen, being talked about. Now don't plan on one assessment replacing the other. Plan on the standard. Right? So they both fall in the state hundred one seventy one. Go and and and implement. That way, you're you're ready for the assessment regardless whether your company decides to to go for a CPPO audit or DIPCAC comes out. And make sure you have your evidence set ready. Right? So just go through, have your own evidence. That way, even if you bring in a third party to do a gap assessment, they have something to look at and and let you know if your interpretations of the controls are accurate. So what I've seen, and these are the patterns that I've seen, several times. So the SSP was written for proposal, not the assessor. So they just go through. They pull the, NIST template off of this 971, and they just mark everything implemented. And nothing says how, why, where, who's responsible, nothing. There's no control implementation status. And at that point, how do I verify documentation if it's not actually documented there? The scope was defined by what's convenient. So maybe they did an enclave, but they didn't account for everything that should be in the enclave. So things were missing. And so when the government comes out, we find out in that, assessment that there is CUI maybe in the physical space and and not in that virtual enclave. And now you're you're you're mixing cloud environments, potentially not meeting that FedRAMP standard. There's a lot of issues that come by that if your scope isn't accurately defined. Evidence, people will say, yeah. I can show that. I can show that. But until they actually show it, it may it may not be implemented. There's been several times that I've seen or the team here have seen where, yeah, we're definitely doing that, and then we go and we see that the policy is not enforced. It's in report only. You need to make sure that the evidence is actually happening, that there is an exclusion groups, that everything is documented. As well, what I I tend to see a lot is SBIR scores being set for that for that bid or that proposal and never being revisited. Maybe the environment moved three times, maybe the company sold, and that SPS score was never revisited. The other thing that I see a lot is they get a note... Companies get a notification of, the default... Of, DeepCAT coming out, and they never read the clause for the defars clause. So they never they never knew exactly what they were responsible for. They're under the gun. And then at that point, it's rush. It's rush to get accurate. It's rush to get things implemented. It's rush to update your SPRS. And, you know, whenever you're you're under the gun at that situation, there's there's only expensive options at that point. You know, you're you're you're rushing delivery. And whenever you're rushing delivery, you're missing things that when the government comes out to audit, it's gonna be obvious to them. So things that I've seen, I've I've gone through several DIPAC audits, so the team here has gone through several DIPAC audits. We've seen seen companies post perfect scores, in in default def, in SPRS. But then whenever we go in and we first get them, onboarded with us, we start going through. We start seeing that, hey. There's actually an honest score of a 38. And then, the very first thing to do is up... Update what you posted in SPRS. That way, if the government does come, you know, we're able to handle that. But as well, we are able to show a POAAM. Right? So having that honest score, it relates to an honest POAAM, which leads to honest work efforts, which lead to the ability to close things out. The other thing I see is, is acquisitions. Right? So a lot of times due diligence is covering contracts, revenue, but not your social security plan, not your IT systems, and not your compliance. So then what we find is the, company that acquired the firm or the the newer company, they've never reviewed anything. They let come... People go, and they have no historical knowledge of what happened, and then it's collapsed into the, the gaining company's environment. The SBIR score now is inherited at the lower score, and a full environment is reviewed. The government comes out and audits you here and your SBIR is, there's a discrepancy there. You could be in a world of hurt. So this is where you should do your due diligence to not just include, the revenue, but also to include, you know, items, like your SSP, the compliance, the technical things there. And then there's also the ones that prepared. Right? They've gone through mock assessments. They have an honest score. They have a POEM. The SSP and POEM are are living documents. Right? So you might be going through efforts and, closing out items. What happens in this particular case is we were working with this client. We posted an honest score, but we were continuing to close out the POEM. When DibKat came out, again, they're looking for transparency. We actually had a score increase because the POEM items were closed out, the SSP reflected it. We just didn't go back yet and update SPS. So in this situation, the the company, were... Was able to actually take a higher score than the score they they they reported, and that's a that's a great feeling to have when your score goes up and not down. Again, it goes back to accurate SP, accurate documentation, and accurate POA, projects. So if you were going to start on this, right, what what do you do? Right? So what can you start, you know, starting Monday? Like, if you're gonna take this back to your team and have a conversation with them and start this, assume the standard. Before you start a gap assessment, before you start anything else, start having an honest assessment just like Deep Tech would. Go through and start doing that. Right? Then go and update SPRS. Do that even before you do do a full evidence based assessment. You know? Even if it's lower than you anticipate and you... Your gap assessment brings it higher, you can update SPRS as many times as you would like. So I would go through and just do a a, you know, quick and quick and dirty, go through the this eight hundred one seventy one objectives and say, okay. I I don't think I'm meeting this. I definitely don't have this documented. I'm gonna mark me down on this. I definitely don't have an SSP. I definitely don't have this documented correctly. I'm gonna mark this down. Okay. When I do the score here, it means my SBRS score is much lower than I anticipated. Then I'm gonna go through and do a a real gap assessment. I'm gonna go through... Oh, look. This IT administrator actually did put in a password policy. Let me update documentation. Let me update this in SPRS as well. And then you can continue to update, SPRS as you close poem item out. I went as well as when I'm doing this. Again, create evidence... Dated evidence. Collect it. Keep it in in in SharePoint. Keep it on a shared drive. Protect that. That way, you can always demonstrate your logic behind your assertations. Name every control. So if something is missing, name it. Name an owner. You know? Name name who's responsible for it. Because a lot a lot of times we see poems, oh, yeah. We know we did... We're not doing MFA. Okay. Who's responsible? What's the what's the long pull in the tent? Are we waiting for, you know, something to be purchased? What is happening? And we don't wanna just assume that's... It's going to get closed. As well, something you could do to really help yourself out is really going through and seeing what you actually need. A lot of times, people want things that are just a nice to have. You might be able to go to an enclave. You might be able to reduce the scope. So if you can shrink the the boundary, those are less things that you have to implement the best eight hundred one seventy one controls on. Right? So you... A lot of times, companies will, get an enclave, and they'll have a commercial environment, and they'll have a government cloud environment, whether that's GCC, GCC high, and they'll move all the CUI, migrate all the data there, and that'll be their boundary. That way they don't have to inflict these controls or compliance across the entire company, and they could do things to reduce scope, reduce their physical environment, reduce and inherit some of the controls from, a cloud service provider or an external service provider like CyberSheet, or an MSP to to manage those items. And then, again, it's always going back to building that evidence. So being able to show that, in real time, like, hey. I have this evidence workbook from last year. This is how we got to that. That way, if you go through any acquisitions, you are able to, showcase what you did and why. Alright. So from compliant... From a compliance event to a a cybersecurity program. So, again, having that plan, plan of actions and milestones, a list of control numbers is not a plan. Maintain your control review. Do it every year. Update your SSP and SPRS. Anytime there's a change, whether it's a new tenant, new site, new tool, flow down your controls and then a review that they are getting it. Right? Make sure that they understand their requirements to to handle CUI. So you have an SBRS score? Start asking your subcontractors for their score. You don't wanna start sharing CUI with someone that is not taking this seriously because you could also... There has been events with false claims where people did not validate their subcontractors and both the sub and the prime were both found liable, by the federal government. Schedule your assessment. Schedule a c three p assessment even though it's not required. That way you have something. Or prepare on your own. That way you have something additional. It's not required today. Right? It's paused, but it does help. It is an insurance policy to anything that, could come up. It is showing that you did your due diligence. It's showing that you did your best effort. You might be accurate with your own self assessment, but getting a c three assessment just gives you that level of confidence that you're doing the right thing. And as you can see, the lowest fine that I've seen is is 500,000 from LogZone. So, you know, the audit is probably worth the cost there, when it comes to, you know, a a nice to have when it comes to, you know, doing that due diligence. So, that covers the the lessons from the field, things that I've seen in DeepCAC. I'm gonna go look for some questions here, and see how I can help. Alright. I see a couple here, when it comes to, the slides. Yes. We are going to be sending these slides post events. So, yes, you will be getting a copy of these. Please reach out. We have a... We have people looking for this, but, yes, there will be a copy of this recording and the slides that we can send out, post this event. I did see a question here. How can we request a DIPCAC assessment? You don't. The government gets to decide. So you can't request them to come and do an assessment. You can request and you can contract a c three PAO, but, you cannot you cannot ask DIPCAC to come out, for an assessment. They will eventually get to you. They they will... When they see an SBRS going sale, they will see, they will see, okay, you got a merger acquisitions. They will see a change in events, and that may lead to them picking your company to do that assessment. I did see something come in about firewalls being FIPS. FIPS compliant, is one aspect. So there are things that are out there, and I don't know if this would hold up in a dip cap audit because FIPS validation, is something that is required, for FIPS. So that needs to be on, and FIPS mode needs to be be on, and it needs to be from a FIPS validated cryptography. So going to that this c v... CVMP site and looking at that iOS or that that hardware to make sure that it meets meets that. Now what happens is those... There's, and, Fortinet is is is, big on this is, they'll have a CVE, and you'll upgrade the the firmware, and the firmware, it was not validated. What you can do is show that you were in FIPS mode and then to, be more secure, you can go through and, showcase that you did have FIPS mode historically. But then then going from there, you're able to, update, your score or update the screenshot to show that, hey. I had a FIPS in place today. So what's happening is Fortinet is changing. The CVN is changing. CVMP is for a particular version. That version isn't validated. You get a new version, because there's there's a firmware issue or a CVE or vulnerability in that that version, And so you go to the next one. Once you go to the next one, it may not be validated. You wanna showcase that you had a validated model, but you also wanna be working with the vendor to know when they're going to be validated. And you wanna have evidence of that if DIPTAC comes out. You may get points deducted. That's at the digression of DIPTAC. But, again, it's it's probably better to do the more secure function than operate with an open vulnerability on your firewall. When it comes to level two of certification assessments and your score, no. It's best to post a score before your c three p o assessments. Ideally, you always have that score. It won your contractually required, in DPAR seventy twelve to post a score, so posting a score is a requirement. Make sure that you do that. So, I would make sure that you have that, and then, and then as well have that CPPO posted there. Maybe you had it... Had an 87 in SPSS. You closed it out. CPPO audit goes well. After that audit, then you could go through go through and update your SPS score to reflect the the 110 that you got from your c three p o audit. There are different tabs in SPS, so they they don't get them confused. There there are several tabs to post your score in SPRS, so make sure that you post them all. Ideally, you're being transparent. Right? So, I don't know if you would look bad, but it definitely is something to to do and consider. FCI controls. I did see here for level one. They're looking for a level two. Level one controls are are, are are part of level two. Right? But level one could be a different environment. That's gonna be where you handle FCI. Microsoft has documentation on where you can have FCI, which could be technically in commercial. And, generally, that's just a self attestation. But But in your environment, if you are going for level two, a lot of times company will handle FCI and CUI in the same environment, which you're responsible to meet all the controls. But if you're meeting all of level two controls, level two controls, at that point, if you're meeting all the level two controls, you're meeting all the level one controls in your level two environment. But you can have separate environments for level two, which you... Where you're where you're planning to handle CUI, and you can have a different environment for level one. I don't recommend it. I recommend if you're doing anything with the federal government to just have it all in your level two environment. That way, if you are are handling FCI and then all of a sudden it gets classified to a higher level, you're able to handle that. Going through here and just reading some more questions. DIPCAC assessment will not, will... Could invalidate a level two certification. So if you have a DIPCAC assessment after your c three PAO and your DIPCAC assessment has findings, it could invalidate your level two certification. But if they are together and they both agree that you're one ten, there'll be no impact to your c three p o assessment. Best way to, address caveats listed in the CBMP site, for FIPS implementation, the best way to handle that is to showcase the difference is there. Right? So maybe you had a pan, Pan OS for Palo Alto that was validated. The, Palo Alto released a new version that wasn't, but that new that new version is, being, validated, I would showcase both. I would showcase that you have screenshot of the version that you originally had, a screenshot of the CVMP website, a screenshot of the new version that it's under under validation, and showcase that you had it originally, upper operating... The firewall operating in that, and then, showing that you had to update that for, for the vulnerability standpoint. Right? Because vulnerability comes out up as one of the controls. Right? So if you have a critical vulnerability on your firewall and you're not closing that up, maybe maybe you you you accept the risk, but you should have defense in... Defensive depth there to kinda close that. But, ideally, you're closing that vulnerability. And on a firewall, I'm probably... I would recommend, doing this. What metrics should be reported to the steering committee? Not sure what what you mean by steering committee, but if I was... If I had an internal, board or an internal team, talking about SPS score, I'd report my POAAMP. I report the SPS score, and I will report any blockers in the closing that POAAMP project because leadership needs to be, aware of anything that's going on. They need to also be aware of, any, any changes to the environment. They need to know any risks to the company. So anything that's coming up, and maybe you're having an issue, implementing MFA, they need to understand that. That way they can support you. A leadership and a, affirming official, they're gonna be someone that has to attest to the score in SPRS, so they should be aware of your current status. Is there an official score that is considered passing? In SPRS from a DIVTAC audit, there is not an official score considered passing. A 110 is the highest score. Negative two zero three is the lowest score. They are going... You need... From a government standpoint, you should be at a 110. Right? So anything that's not a 110, that is considered, you know, a a poem item or a gap in your compliance, so you need to close that gap. When it comes to, a CPPAO audit, of a minimum passing score is an 88 out of a 110. That'll give you a conditional status. You will still have POEM stat... POEM items to close out, and you can't have any five, three, and select one point items. So, for CPPAO, you can get a minimum score of an 88 depending on what controls are failing and still get CMMC status. DIPCAC is transparent, so they're going to, just be reporting an accurate score in SPS. If you go through, SPS, you'll see different areas. Right? So you'll see a NIST eight hundred one seventy one score tab. You'll also see your c three p o tabs, and that's where we are, that's where we are going to, that's where they're gonna be reporting the score in NIST eight hundred one seventy one tab. And then for those CMMC level two tabs, there's level one, there's level two self. Those are you reporting the score, and then the CPPO tab is where the the CPPO is reporting the score. If you do get selected for a level three assessment, DIPCAC will be, entering the score in the level three tab. They're in SPS. I'm looking through here, seeing if there's other questions. Not seeing any new questions in here. Alright. Lot of lot of questions on FIPS. Yeah. FIPS is one of those ones that are complicated because it does break things when you turn it on. So when you are working on FIPS and turning those things on, it's ideally you hit that with a, a test group first, and then, you know, slowly expand that, if you can. Because generally, FIPS does break break this, or break some items. A lot of times we see FIPS breaking things like QuickBooks, for instance. Alright. I'm not seeing any new questions. Yeah. I I I have questions on my end so that when you chat them in, they come up on my side, and then I... I'm responding to those. Not gonna call call any names out, but, yes, these questions are on on my end over here. So I do see them, populating. So, we do have a few minutes left. If you guys have any more questions, there's no... There are no silly questions. Happy to to answer them. I'll I'll... I love questions. I do this every day. I'm passionate about this. I definitely wanna make sure you you are doing the best for your business. Right? I... You know, as someone who was a, was in the military myself, I was listening to United States Air Force. I've also worked for the federal government. This is important to me. Oh, there is a question on how to how to get a DIPCAC assessment. A DIPCAC assessment, they select you. So if, if there's a change to your environment or if there's a change, in SPS or maybe there's a whistleblower, maybe you are in a contract dispute, DIPCAC will schedule the assessment. So they will reach out to you. Make sure that that the POC is aware. So a lot of times that I see is they get... There's a notification of assessment that goes to a, sales rep. A sales rep does nothing with it, and it just sits there. And then, eventually, they follow-up or they follow-up with another point of contact. And, eventually, people start draw... You know, getting into it, and then they start, you know, providing information to the government. Please, if you get a notification, please respond to it. Please acknowledge it. And then from there, you can work with DIPCAC, especially if a c three p o is scheduled. Maybe they maybe they push the assessments after your c three p o. They are a limited team, so the... They they ideally are are trying to go to to, other companies that aren't aren't taking this seriously. I work for a sub, not a prime. If a... If I... If we never share CUI with our suppliers, do we avoid to, flow down requirements to them? If you anticipate never flowing CUI to them and they're never going to receive it, you could do that. We have this sometimes with a sole source or maybe, cleaning crews or or things like that. If they're never going to touch CUI or they're not in scope, no. You do not need to share them. Maybe they're a COTS provider. Maybe they are something, that you're buying that's commercial off the shelf item from them in forms of the contract. They don't need any of the CUI to provide that to you. No. You do not need to flow it down to them. But in the event that you believe that you will, then you should flow that to them. If they get that, then they are just like you getting the, getting the clause, they are responsible for implementing CMMC. Now there are ways for for you to, give them pieces of your environment, and ways that you can, add them into your environment to access the CUI, granted that it does not happen on any of their systems. If they're not capable or able to handle that, reach out to us, and we have a a way to implement that if if needed. I'm looking through here for any more questions. I don't see anything here. Back to the Fortinet firewall issue. If you have a FIPS mode enabled on the latest firmware version, but it's not about a firmware version for the self assessment, you should... This is one of those controls that you could do a partial for, depending on what's going on there. I would be looking for a validated version, and trying to look to see when, when Fortinet is going to update that. Sometimes they say that they're under review, in in the CVMP site, and I would evidence that. Right? So maybe you had a Fortinet that had it. You updated the firmware version. I would have evidence of that, and then I'll also have evidence that they are undergoing validation. Or I would prepare to maybe switch out firewall to another vendor that is, validated. But, when it comes to that, to answer your question directly, I would not mark full credit for that particular control, or I'd mark that one as, not passing because FIPS validated is the requirement, not FIPS compliant. Fines are only if you lied in your reporting. Correct? Fines are at the discretion of the DOJ. So, that would be something that happens if you get into that type of situation where the DOJ is investigating Paul's claims act. And then from there, depending on that investigation and that, you know, court case, that will do be... Determine what fine you may or may not receive. We are a little bit over here, so gonna start wrapping it up. I'm gonna give, one more minute for questions, and then, I'm gonna let you guys go. Hopefully, this was helpful. Again, there are going to be a copy of the webinar slides and recording post this event so that you can have this. So just wrapping up here. I'll give one more minute for questions. I'm not seeing anything else come through. Alrighty. Well, with that, thank you everyone for attending today, and we will have a copy again of the webinar slides and the recording. I sound like a broken record, but I wanna make sure you guys get a copy of this because this hopefully is helpful, getting tractions internally to make sure your CMMC project runs smoothly or, you're prepared for a dipcac audit. Alrighty, everyone. Well, have a wonderful rest of your day, and I hopefully you got something from this.