Name: CMMC Confessions: What Contractors Should Know Before Implementation
Uploaded: 2026-04-29T17:31:03.039Z
Duration: 38 min 16 s
Description: CMMC Confessions: What Contractors Should Know Before Implementation

Transcript for "CMMC Confessions: What Contractors Should Know Before Implementation": Hello, everyone. Good morning and good afternoon. I am Mike Bailey, VP of solution engineering here at CyberSheath, and thank you for joining us for our webinar today, CMMC confessions, what contractors should know before implementation. Our hope today is to be able to really give you a a look behind the curtain at some of the real world items we're seeing every day in some of our client environments and what we're hearing, in the marketplace and in in the vertical, and be able to give you some insight into how to better protect yourselves, how to better prepare, for your CMMC, or, you know, on your CMMC compliance journey and how to best prepare for your CMMC level two certification with a c three PAO. So, again, thank you, very much for joining us today. In our agenda, we're really gonna cover the, the final rule and, what that really means now. And and what it means now isn't exactly necessarily what we're seeing, from, clients that are coming to us and and current clients with us. We're gonna give you some of the insight into what's actually happening down in the trenches. We wanna talk about some of the top four confessions we really are, seeing out there. We wanna prepare you for your, assessment and c three PAO audit, and then we're gonna bring it all together at the end and give you some recommendations on, next steps. So, if you're not, familiar with CyberSheath, Hava Awareness. We are, in my eyes, one of the most comprehensive providers in the space. You know, we we solve the whole problem. Managed IT, security, compliance, all under one roof, full accountability. Everyone here at CyberSheath, is an employee. And, and with that, we're, you know, really cohesive in providing solutions to our clients. And we are DFARS and CMMC experts. You know, we were working in this space before CMMC, that term was even coined, established in, 2012 by Eric Noonan. We've been focused in, you know, assisting the defense industrial base since then. We are 100% US citizen staffed in US, US based, for defense contractors who do have US sovereignty requirements. We are also AOSG, license, capable, so we're we're able to, resell GCC high licenses really easing, the transition into, FedRAMP authorized collaboration spaces in Office March, really making that easy for clients, who need that. And we are CMMC level two certified certified in March, last year. And, we're we're we're close to, at this point, I believe, 40 c three PAO, audits under our belts for our clients, all of those at a perfect one ten to date. So have confidence that, all of our, people processes configurations that we're putting in place for our clients have been auditor validated, not only with the current c three PAO audits, but in the past with, previous DCMA audits that we're continuing to go through today, and also some of those, prime contractor audits that we're seeing, hit, some some of our clients. Okay. So when it comes to the 48 CFR, I think most folks are aware of the phased rollout and what that meant when it was, when when it went into effect of in November. That being said, you know, that phased rollout really was, pushing organizations for for, the requirement of self attestation, this current calendar year until 11/10/2026 where there was gonna be a requirement for c three PAO certification, for level two compliance prior to bid award or, renewal award, you know, starting in November. That being said, you know, what we're actually seeing in the space, number one, it is from the subcontractor point of view, it really is hair on fire. The rubber has hit the road. You know, subcontractors are coming to us with pressures from their primes, you know, identifying that they're looking to have, you know, certification on the books before November 10, or, actually be certified before that date. We're also seeing, prime such as, l three Harris. Many of you probably have seen, the the letter that l three Harris sent to its subcontractors stating that if they're handling CY, they need to be level two certified by July 30 this year. So kinda making their own rules there. We are also seeing, organizations who, they don't have any, planned bid awards of the this year, you know, or or any renewal awards this year, and and they're looking at, hey. That's not gonna happen towards the end of next year. And thoughtfully, they're planning, they're budgeting in kind of risk, in scheduling those audits for next year. So it is varying in the space. We're seeing all sorts of different things. But, you know, the number one thing I would say is, you know, while the 48 CFR has defined the landscape of kind of the letter of the law, there are many different, scenarios that defense contractors are encountering. And with that, really, you know, understand from your contracts team what your requirements are gonna be and, plan ahead, to ensure that you're not gonna, you know, risk or or jeopardize, the revenue of your organization based on a misstep there. Okay. So, starting off with those top four confessions. Number one, you know, organizations, what are they getting wrong at the start? You know, in a previous webinar, I really talked about it taking a village. So first and foremost, assuming a single person can do this in your organization, you know, as an existing, you know, existing person, taking on that additional burden of compliance or even, assigning that to a team who their day to day is IT and security, and they probably likely have a full plate as it is, and likely doing a good job in their day jobs. It it often takes more than the the resources that you already have on your staff and and or assuming you could bring in a single person to do this. I give the guidance to many organizations often that while I know, you know, all the levers to pull, all the things that need to get done in order to get an organization compliant based on my experience, it's not realistic, you know, that myself as a single person or a single person in the organization likely can take this on entirely. Many organizations come to us looking for gap assessments. They're looking for gap assessments, you know, in preparing for an audit, and many of them think that that is the first step that they need to be taking. You know, transparently, you'll you'll see our process. We we kinda coined the term aim, assess, implement, manage, and that does start off with an assessment. But many organizations are taking missteps, where they can, with a little education, they can take, you know, gain greater, compliance, you know, steps forward by either moving into a FedRAMP approved collaboration space and implementing some of the known deficiencies right up front as opposed to just performing a gap assessment and getting answers to the questions that they likely already know. So don't assume a gap assessment is necessarily, gaining you steps forward. You know, move forward past the the low hanging fruit, the known deficiencies first, and utilize that gap assessment. More so as a, you know, it's it's a requirement and then a state hundred one seventy one for sure, but use that as a readiness exercise. Use that as the checklist to develop your POAM to identify what's remaining so that you can move forward with a project plan in a known, kinda finish line, to, to that perfect one ten score. When it comes to the difference between CMMC level two and the NIST eight hundred one seventy one, oftentimes explain it to organizations as, the NIST eight hundred one seventy one is the compliance framework. These are the this is the framework for the requirements that, the DFARS two fifty two two zero four seventy twelve clause has been, sent out to, you know, who I believe it's in over a million contracts to date, sent to organizations. That that DFARS clause mandates the requirement for the controls of the NIST eight hundred one seventy one to be in place in an organization's, you know, CY scoped boundary. With that, CMMC level two is the validation and those verification that the controls are in place by a third party that's done by that third party assessment organization, the c three p a o. So that's the audit mechanism is really the c b n c is the audit mechanism validating that the controls are in place. Those controls that likely should have been in place for many years prior. And then, you know, understand this is this is really a culture change in an organization, a a business process transformation as opposed to a point in time project to to, implement controls. You know, it is very important for organizations to understand that, you know, they're implementing compliant processes and workflows and it's going to change the way that they work and in, you know, many cases. Some cases, it will not. But if it does change the way that they work, that they are looking to adopt those processes as they should become transparent to organizations. This doesn't have to be hard. We we always tell organizations coming to us that we're looking to ensure that they're able to to do their day jobs. You know, they're the widget makers of the world in the DIB and, you know, we're not looking to impact or really change the way that they're working just to, adopt compliant workflows to assure that, they're staying secure, and and meeting CMMC and NIST eight hundred one seventy one. Lastly, with documentation requirements, I'm gonna touch on this a little bit more with documentation fatigue, but do not underestimate all of the different pieces of the puzzle when it comes to documentation. It's not just policy. It's gonna be policies, procedures, incident response plan, you know, your system security plan. Each of those really needs to be looked at as a separate project and item to get completed. It's not you know, often organizations will come in. They'll they'll work on some policies. They'll get kinda tired and look the other way, and and many of the other items aren't completed there. So confession number two, some of the the roadblocks that, I don't think, many many folks are really kinda screaming from the mountain tops and wanna make sure that you are aware of, and definitely hearing it from us. These are things that we're seeing from organizations who are coming to us and we're assisting, and other, you know, organizations that, we're meeting just out in the marketplace. First and foremost is asset inventory in c y scoping. You know, it is, very common. And I just read a a c three p o, had a blog post, something around this the other day about, you know, specialized assets and and assets that you're you're, in your environment that are actually processing c y, but might not fit into your your typical asset category, and and, defining those as specialized assets, but still making sure that you need to apply some mitigating controls to them. You can't just look the other way. But keeping that inventory, documenting everything in your environment, knowing the configurations that should be applied to each from a readiness perspective. But scope is key. We are oftentimes encounter organizations who come to us and and they say, oh, I I want a I want an AVD enclave. I wanna be able to keep all my data in a box, you know, and keep everything up in the cloud. You know, sometimes that is the perfect solution. But oftentimes, it it also isn't. So we we help organizations find, that balance, but know that it all doesn't just have to be, you know, lifted and shifted up into the cloud. When it comes to, policy creation and operationalize wow. We'll try it again. Operationalizing policies, you know, it it's really part of that transforming the culture of the organization. And rather than just drafting policies that get put off to the side and shown to an auditor, it's the organization adopting change to ensure that they're they're operating in a secure and compliant manner. With documentation fatigue, you know, I mentioned that, you really need to to realize that there are different documentation requirements, you know, aside from the regular, cadenced, compliance tasks and administrative functions you're gonna have to perform. You know, that's policies. That's processes. It's your incident response plan. It's drafting that system security plan, outlining and defining how you're meeting the intent of all 320 assessment objectives, tying those back to the relevant policies and processes, so that a c three PAO order can, you know, see a very clear defined picture of how you're you're implementing the controls in your environment. You know, we we find that organizations, when especially when doing it themselves, are struggling to tie all those pieces of the puzzle together. And, you know, documentation is, not necessarily always their day job and oftentimes something that's, you know, being expected to do, on top of their typical day job. So, that's a big one, and there is a ton of documentation that is required in kind of a a mature and compliant organization. And then vendor and supply chain dependencies. We're seeing a lot more of this, I think, on the hardware side right now, you know, with, RAM prices are exorbitant to say the least. And, we're seeing a lot of clients and organizations who are struggling to get the necessary hardware that they need to implement compliant configurations in their environment. That's that's firewalls, that's access points that are validated, that server hardware and and even workstations to replace systems that are past end of life. So just understand that, you know, there are other impacts other than just performing the projects to get them done. Know that there are some, you know, timeline dependencies based on vendors, whether it be hardware, software, etcetera there. So when it comes to internal teams, and organizations really relying on internal teams, where they're struggling most, again, it is organizations turning to IT and and and looking at them and and thinking that compliance is an IT problem and not an organizational, you know, change or adaptation. You know, expecting, likely, oftentimes, overburdened or or fully burdened, IT team to take on the the, the additional requirements from a day to day perspective and and even, you know, things that might be out of their purview with limited previous experience in that, to me, is is unrealistic. So it's it's very common. We see it, you know, probably 50% of the time in the clients that are, you know, coming to us for on the sales side of the house. So just know that it does take a village, and there's a lot more than just IT controls that, need to be implemented. When we do look at the NIST eight hundred one seventy one and the 110 controls, I think it's around 67 or 68 that we see to fall into, like, you know, manage IT services that we would provide. But, that being said, there's, still quite a few that, fall into, other responsibility budgets. And, again, leadership needs to be bought in on this as an organizational change for those defense contractors who wanna be pursuing this work. You know, don't underestimate the amount of resources that it is going to take in order to impart change in the organization to get you to that perfect one ten, but this is not a point in time, certification. This is a three year certification cycle where you need to stay continuously compliant during that time. So those resource, demands are are required throughout that entirety of the certification cycle. You know, when it comes to resisting operational change, I think, those of you who have worked in organizations who who have that resistance, understand what that looks like. We, you know, as as a managed service provider, we see all sorts of different type of organizations. Oftentimes, people ask us about our our timelines for implementation, and we, you know, we give averages. And, really, those averages are based on some organizations that resist operational change. And in those organizations where, you know, oftentimes, it is from a a leadership top down approach where if the leadership is on board, the culture of the organization is full steam ahead as opposed to paddling against against the current. So, you know, if you're the the biggest, you know, barrier that you possibly can have is not having buy in from the folks that you're trying to work with to, implement those changes. So, that's always been a pain point that we've seen for organizations where, you know, the internal folks are resisting that change of adopting the requirements that are necessary in order to get them to compliance. When it comes to, burnout during long implementation cycles, I think the, the the the greatest, guidance I can provide here and or advice is understanding where the finish line is and what it takes to get there. Having an accurate poem to outline the deficiencies within your environment, grouping those deficiencies into, you know, projects which would satisfy those controls, and then putting those, those projects on a timeline. That's the process that we use here at CyberSheath, and it gives us the ability to provide to clients what's coming, the timing of those projects, and where the finish line is. You know, not having that, that clear plan, especially to provide to leadership, you know, really muddies the waters of knowing when the next project is. And and, so having that clear plan really defines, you know, what it looks like. And and when people know when the end is, that there tends to be, kinda a light at the end of the tunnel. So what actually works? You know, I I'd say, the things that lead to the the smoothest certification, again, it's scope, scope, scope. And it's it's having a real like, being real with yourself early, of looking at everything in the environment, you know, not turning a a blind eye, not saying, well, those Mac and Linux systems, we kinda just don't wanna deal with those. Or, you know, what about those other legacy applications, you know, or or legacy systems? You know, if those are gonna be more difficult to to, to get compliant, you know, look at those items first. Work work on the difficult items and and go into this eyes wide open. The last thing you wanna do is, get ready for an audit and have everything prepared, have it left something out of scope when truly it is storing, processing, or transmitting CUI. You know, anything that's storing, processing, transmitting CUI, you know, needs to have the controls applied to it. You know, there is no need also again, to to put it in a box, in those terms. It's, I'd say probably 50% of the organizations that we work with, we are we are, you know, migrating them into a, a FedRAMP approved and compliant collaboration space with either GCC or GCC high. We are elevating the entirety of the organization to meet the NIST eight hundred one seventy one hundred and ten controls. And and to many of those organizations, it is really transparent day to day. Know, when they log into their computer in the morning, they'll they'll see a log on banner that they acknowledge. They'll be prompted for multifactor authentication. But outside of that, you know, compliance and and security do not have to be difficult or debilitating or, you know, get in the way. So, just know that, this this while CMMC is not easy, I will certainly say that it is it is achievable with the right plan in place, and, and also making sure that that you have a solution and not just you're not just apply you know, throwing tools tools at the problem. When it comes to readiness assessments, and I I wanna almost break these up into two different items here. There, you know, there's gap assessments in my mind, and there's readiness assessments. You know, gap assessments are a requirement in the state hundred one seventy one. They're validating your controls. They're producing essentially a a poem of gaps that you're gonna close out and work war towards closing to that one ten. When I think of a readiness assessment, that's really a validation of your controls in your environment that you're making sure are in place. Is really doing the checks and the balances against against, your your last assessment, your POAAM. So use that assessment, you know, readiness assessments effectively, making sure that you're you're ready for your audit that that is really gonna streamline that that audit with your c three PAO. You know, but don't, also don't think that, you know, a gap assessment, you know, for for when you actually have known deficient controls in your environment is really gaining anything for you. Make sure you're getting those controls closed out where you could. And then, again, be real with with yourself and your organization about what it is going to take to implement the necessary controls, develop that POA, develop a project plan, be realistic with the resources that are gonna be required from an implementation perspective, but also a continuous, you know, management perspective. You know, put that together and work towards it. And, again, that certainly helps towards, from what we've seen, towards organizations who have implementation fatigue. I always say prioritize high impact controls first. It's the the highest impact and the highest risk items, to go after. Those are gonna be the, the highest impact or are likely gonna take a little bit longer to achieve, and overcome in kinda waiting to the end. As what we've seen in our experience has not been the most successful for organizations. So, you know, don't turn a blind eye to the systems that are gonna be difficult, to apply controls to. Don't act like they don't exist. I'd say, you know, go after them first and foremost. Come up with a plan. And then, you know, once you've gotten past that, the rest seems seems a bit easier. Alright. So when it comes to preparing for your c three PAO audit, some advice that, that we can give you based on some missteps that we've we've heard organizations making, number one, first and foremost, get your cage codes in order. Understand the nesting of those cage codes and and how the hierarchy within your organization works if there is one. Now if you have a if you're an organization who is either umbrella company with subordinate organizations, you perform acquisitions, you know, regularly and have multiple companies and cage codes work with your c three PAO to understand how that will affect your audit in your certification. My understanding is when when the c three PAO submits your certification, in EMAS and, the CAGE codes associated with it, they they get there's a thirty day window. After that window, it is closed, and they don't have the ability to edit those. If one of those cage codes is not included, the understanding on my part is that, you know, that that does not qualify for certification and therefore you need an audit to include it. So don't get yourself caught up in that. That could potentially be very costly. Go into that again with that full awareness. You know, perform a readiness assessment before a c three PIO audit. You know, we find organizations who there there's companies who will will offer these as a service. There's companies who will ask us for these. You know, that is part of our services by default. It's not something that we we offer really ad hoc as professional services, but, you know, look either internally from a verification perspective that you have the proper, artifact evidence going in into your into your audit. So certainly something you can perform internally, going, you know, control by control, assessment objective by assessment objective, verifying that the items that you are expecting to provide as evidence to an auditor you have on hand prior to that audit is really, you know, helping you helping, accelerate your success there really is is, you know, being prepared and not making assumptions, that you have controls implemented. You know, real world, example of this that I've heard in the past, from from a a different organization was, they went into audit. They they had evidence, that the that there were policies in Azure applied, but those policies were they were there, but they were in audit mode, so they hadn't actually been implemented. That could be very common for technology teams to apply these policies or put them into place based on their intended configurations. But transparently, without those being enforced, there's no impact to the organization. That's the hard part is, you know, enforcing those policies without making sure that anything breaks or impacting people's, you know, day to day activities. But, having those in place and not applied isn't giving you the credit that you need. So, you know, don't take or don't make any assumptions that your controls are implemented. Validate they validate that they are through readiness. Okay? And then, you know, with with, with scoping, again, don't let that be a late in in the game or late in the process, misstep. That could be absolutely detrimental for you, to understand, you know, at a later time that, you know, you've improperly either scoped your environment for what your CUI handling is, or that you've left assets out. We do find organizations who will try to, again, fit in the box of a Cloud hosted solution only to find that, they have CUI throughout their entire on premise, you know, commercial, infrastructure. And with that large scale change after certification kinda to their operating scope and environment, you know, we've seen that, potentially trigger reaudits for material changes in their environment. So, again, costly mistakes that you don't wanna make before you step into that c three PAO audit. So, really, the biggest things that, you know, is a is a takeaway from this, preparation and readiness are key. It's it's making sure that you understand, your scope. Be be, you know, be real with your yourself about, where that CUI lives, what is you know, what systems in your environment are storing, processing, transmitting CUI, or what you might anticipate in the future to be storing and, you know, processing, transmitting CUI, you know, preparing and and understanding what controls need to be put in place. You know, have a methodical approach, as I mentioned before. You know, perform that gap assessment. Look at your POA. Group any of those findings and those deficiencies by by, you know, projects that are are going to work to to achieve, you know, closing out any of those controls. Put those projects on a project plan, get buy in from stakeholders in your organization and those who are going to be impacted, and then put that project plan forth in order to, get those closed out. You know, having that finish line insight in in a realistic timeline with known, you know, kinda known projects that are gonna be coming up and known impact the organization or even having the ability the bill the ability to share that with leadership to get the the required resources you may need to achieve these projects is gonna be key to your success. Once you implement all those controls, validation from a readiness perspective is key. Do not make any assumptions, for controls being in place. Really make sure you're you're you know, I tell, our our clients that from a readiness perspective, before we step in front of any auditor, we're, you know, making sure our, i's are dotted, our t's are crossed, and that so then when we're going in front of an auditor, we have the ability to really provide the answers to the questions before they're asked. We know what they're asking for. We know what we've done on our side to meet the intent of that control, and there we therefore, we could provide it really, seamlessly. You know, leadership alignment is key. You know, again, having that that top down buy in from leadership, to it really helps in getting everyone, you know, again, rowing in the right direction. You know, compliance and and and security do not have to be difficult. As I mentioned before, many of the things we're doing for our clients, and the controls we're putting into place are transparent to them from a day to day perspective. While it's not easy, there might be some struggles to get there in operating in a compliant CMMC compliant, space, does not have to be difficult day to day. Getting your leadership to help you get to that point and and help, you know, guide others in the organization to support you in this journey is is really key, though. And then operational discipline. So, you know, this is this is really, a business process transformation. That that's really the key to success here. You know, and with that, changing the business processes and adhering to compliant workflows and and CY handling, can become transparent to the organization. And when that does happen, that's really where the success happens, across the board, where we're truly protecting the warfighter and then through protecting the CUI data, and and not impacting, you know, the the DIB organization so they they can perform their jobs. So, you know, the biggest takeaway from this, though, is understanding that there are challenges in this. This is not, this is not easy per se, at all. It's difficult. It is certainly achievable. There's, you know, many organizations have gone through this certification, many organizations who have done it themselves, many organizations who have used, external service providers, but certainly achievable. But look at the big picture, know some of the challenges that you're going to be coming up against. Put down put those on a board, so you can kinda look at those every day. Come up with the solutions. Address the the the the most difficult items first, as I mentioned, because the rest is really going to become easier past that. And then, I think, you know, if you're honest about the challenges, you understand them and address them, you you're really on your path to get certified. So the steps we see, to get ready and get certified, it's really simple. It's, you know, assess the organization. It's find those gaps. It's put together that project plan to understand where, where the where the end goal is, the light at the end of the tunnel, and just start getting to work. You know, getting to work means we're remediating those actions, being realistic about the the, the resources that it's going to take to get those, items put into place and then managed moving forward. And when I say manage, manage from an auditable perspective. Once you're, got those remediations in place or when you're on your path to that, you should be engaging with a c three PAO. Get a date on the books. There are certainly some lead times there with the rush of defense contractors, going in that direction. So, you know, engage with the c three PAO. You know, get a date on the books for your audit. And, if you do have that effective project plan, you can give them, you know, a look you know, guidance at when you think you'll be ready. So that that always helps them too. And then once you're certified, it's really staying compliant. It's ensuring you continue to have the resources that are required to maintain the environment and and monitor the environment from an auditable perspective day to day. It's continuing with all of the cadence compliance activities that are required, keeping up on your policies and practices, performing that incident response tabletop exercise annually, performing annual gap assessments, etcetera. So there's a bit of work to keep it going, but, you know, with a with a good plan in place, it's certainly achievable for sure. Alright. Thank you, everyone. Didn't see any questions that popped up, yet. If you have anything, you know, please do not hesitate, to reach out to us. This recording certainly will be sent out, at the conclusion here. I really appreciate everyone's time today. You know, if there's, anything we could assist you with or your organization or you have any questions at all about what we do, how we do it, CMMC, or anything else, very, you know, we're more than happy to to answer those. Any of the those of you who have interfaced with me either at a conference or, you know, a day to day conversation, know that I'm very transparent. So please don't hesitate to reach out to to us for anything that we might be able to to provide to you, as it relates to either our services or Siemens CMMC in general. So alright. Thank you. Thank you very much, everyone. Have a great day.