October 2026 CMMC Connect

Speaker A: Topics you care about by people you trust. This is the Clear Perspective. Your Healthcare Cybersecurity, Compliance and privacy podcast. And now for the show.

Speaker B: Welcome to CMMC Connect. I'm Monica Pastor, Senior events Marketing Manager here at Redspin, and I will be your host and moderator for today. All right, so let's get started. Let's introduce today's panel. We'll start with Mr. Dr. Graham, and then we'll go around the room from there. So, Thomas, tell us who you are.

Speaker C: Who am I? That's an existential question that, you know, we. We've struggled with through throughout our lives, Monica. So I think we don't really know who we are until we end. So how about that?

Speaker D: What just

Speaker E: happened next?

Speaker D: Damien?

Speaker E: Sorry, I needed a second to. To catch up with what, uh, Dr. Graham had just said. Um, Damian Galdy. I'm a, uh, lead assessor here at Threadspin. Erica.

Speaker F: My name is Erica Primer. I am a lead assessor here at Redspin. I am also, uh, addressing this glitter bomb that has gone off here. So very excited to be here.

Speaker C: Hey, good afternoon. My name is Pat Wicker. Been with Redspin since about, uh, June, and, uh, it's probably been about that long since I've, uh, been with you on CMMC Connect. So I'm happy to be back with the team and happy to be with you, uh, today. Looking forward to it. Thanks.

Speaker D: Hey, everybody. I think you know me, Rob Teague. Um, I get coffee for everybody when they need it and drive them to where they got to go. So, uh, I'm not sure if Stephanie's with us yet.

Speaker B: Here I was having

Speaker G: malfunction getting my, um, horns to show in the video, so I just, uh, blurred my background. Um, I'm Stephanie Kincaid. I'm a lead assessor here with Redspin. Um, glad to be

Speaker B: here. Awesome. And hi, everybody. I'm Lauren Frickel, director of marketing here. Uh, today, clearly, I'm dressed as a functioning adult. Awesome. Well, thanks, team. All right, before we get started with pre submitted questions, let's go over our field updates. Rob, what can you tell us?

Speaker D: Same, uh, thing as last time. We have no idea what is going on. So there's nothing official that has come out of the CIO office. We're hoping we'll hear something, uh, next month in November. Uh, I wouldn't be surprised if the announcement, uh, comes after the midterms. So just keep an ear open, watch your emails, because once we do hear something, we'll be, uh, letting all of the Redspin clients know, and we'll be making some public announcements on LinkedIn. Thomas, um, you want to jump on the FNN articles?

Speaker H: Articles. Okay, got it. All right, so you've probably been out there surfing the web and you've probably seen where an article came out. Not one, but two parts. I know two parter. Can't get past it. Anyway, what it shared was some insight into not only what the task force was thinking, but it also named, did not name individuals. It had a lot of unnamed sources, but the information outside of, you know, all the back and forth and back and forth and blah, blah, blah, essentially. I want to come out of character, guys. So what the article said, essentially, as far as pertinent information, was it gave insight into what the task force had provided back to the department. And much of the. The revelations weren't Earth shadowing. It was things that pointed to items that had been called out before and simply hadn't been addressed. Now, will the department utilize those? Will they take them into, you know, consideration as we're moving past and well past and even more well past, you know, the 60 days and then the timeline to have the report. Unfortunately, it's anybody's guess, but the report that I'm talking to, Brian, was the CMMC task force that the CIO's office commissioned to review the CMMC program, review some of the information that's provided back by the RFIs, and really make a recommendation to the CIO's office on what, if anything, should be changed with the program.

Speaker D: Cool. So, yeah,

Speaker B: those two articles are linked in our resources that you guys can click on and open those up.

Speaker D: And then, Tom, uh, you were at CS5. Uh, I myself was at the Talladega Superspeedway. So if you can give us a quick recap on what happened at the conference.

Speaker H: Sure. Um, so the conference was still well attended, even though the pause was going on. A lot of good questions happened. There was a lot of talk of utilizing AI for certain capabilities. Uh, I myself was part of the C3PO breakout with the officers of the C3PO advisory committee. But a lot of the questions weren't necessarily centered on the pause. It was more, so what's next? You know, what are we looking at? And the consensus kind of congealed around the federal CUI rule, which once it, uh, is finalized. I know you guys have heard me mention it pretty extensively on here, it's going to require the baseline of 853. I'm sorry, 800171 rev3 across all federal agencies. Uh, once it drops that's going to be, you know, really what's going to honestly take it out of the department's hands because that's coming out at the federal level versus just the agency level outside of that. Well, I mean, the other thing that was, you know, really being talked about at the conference was what incentives, you know, may potentially be brought in. And when I say incentives, I know that Ms. Davies in the past has mentioned, you know, potentially points on contracts or other things. Hasn't really been too much out there documented about whether this is the case or not. Except in the MAPS contract, if you go and look, they do give you points for having a third party certification. Um, lastly, one thing that did not come out at the CS5 conference that come out, um, really fairly recently was NARA's annual report, which includes updates on the CUI program. Haven't had a chance to really digest that yet, but generally that does provide some insight into where the agencies stand as well as, um, addressing any of the previous items that have been pointed out.

Speaker D: There's your recap, Monica.

Speaker B: Yep. Redspin also sponsored the Women of CMMC event and we had a great time. We had 68 ladies attend and if, if you guys were there, anybody in the audience, um, it was great to see you and we had a great time at the event. All right, next, let's get into our pre submitted questions and then we'll open it up for live Q and A after that. So our first question, we're having a discussion with accounting about invoices. They want to make sure we're doing right by compliance. But they also know some of our primes have very specific sending requirements that would end up with us not being paid if they're not followed. And their question is basically, while an invoice can technically be considered fci, depending on the contract information, what would be needed to make it so they should be good as long as the information in the invoice can't be tied back to the a federal contract. Right. Rob, what's the answer on this?

Speaker D: Yeah, so that bottom question is really what you hone in on and you're absolutely correct. So if the invoice itself has detailed information about the contract, then yes, it is fci and you must protect it as if it doesn't have it. For example, uh, an invoice we get from the Cyber AB for all the certificates we issue, it just says Cyber AB and it has the amount we owe them. There's nothing that ties that to anything. So that in itself would not be considered fci. So it's just basically what do you have in the invoice? So use common sense. When you're looking at it, if it looks like, you know, it potentially could be tied to that contract, protect it just in case.

Speaker B: Thanks, Rob. Um, next question. Uh, question on 3.1.21. Identify how portable storage devices are being restricted from use on external assets. How does this line up with presentations at ah, technical conferences or even trips to customer or prime sites for project meetings? And the need to bring presentation materials. We require that they use encrypted USBs and that those USBs be set to read only mode when connecting. This now seems at odds with the interpretation of this control. Dr. Graham, what can you tell us?

Speaker H: Um, all right, so looking into my lab reports here, it's kind of two separate questions. You know, one's talking about presentations at, at conferences and the other is talking about potentially sharing with a partner, a sub or another organization. Well, as far as the conference presentations and stuff of that nature, that's covered actually under 3.1.22. Um, you have to have a process in place to review those presentations to make sure there is no CUI on them. And this, keep in mind, this is at a, at a conference or in a public forum. Now if you're talking about 21 and on those external systems. Yeah, how do you restrict that access? So you know, in the question it mentions they're encrypted, set to read only. Those are good steps. But now who can also access that information at the end of the day, does the USB drive or external hard drive have CUI

Speaker C: on it? And if it does, then that's where you have to account for it in 3.1.2.1 and 3.1.22.

Speaker D: Also this kind of ties into a, uh, user finds a USB device out in the parking lot, they bring it into the building and plug it in. So you need to have that auto read disabled. So keep that in mind. It all kind of ties together and you can see how it overlaps with quite a few of the other controls. But the bottom line is CMMC is not there to restrict you from using these types of solutions and devices. It's really in place to make you control how they're being used and who can use them.

Speaker B: Awesome. Thank you, Thomas and Rob. All right, next question. Do annual affirmations require a new assessment or just confirmation and evidence that monitoring is in place and that there have been no significant change since the Most recent Level 2 assessment reported to SPRs? Erica, what are your Thoughts on this?

Speaker F: Okay, so yes, if you look at, but as my colleague pointed out, it does matter what you mean by an assessment. Um, you are not required to have a third party conduct an assessment of your organization every year. But um, perhaps 3.12.1, you are required to conduct a security control assessment. Now the way that you, at least once a year and so the way that you choose to do that is up to your organization. And so there's, there's um, room to determine uh, what works best for your organization. But you are required to review to assess each of the security controls at least annually and then you are required to self report in spurs.

Speaker D: Um, Go ahead, Pat.

Speaker C: Yes, Eric. Um, uh, you know we just discussed actually what the um, qualification was with regard to the assessment, whether it was a CMMC level 2 self assessment or CMMC level 2 C3PAO. So in the event that you've had that C3PAO assessment, the out years, the annual affirmations are conducted by the affirming official. They do not require, to Erica's point, a uh, reassessment by ISC3PAO. Uh, but at the same time, if you're following the CMMC level 2 controls, that 312.1 requirement is going to require an annual self assessment anyway. And you could use that as evidence of your affirmation as well. So um, I don't, I don't know that I have too much further to add to that discussion.

Speaker D: Yeah. But uh, some other information for you guys is that um, if you do, you know, you do have a certification, so you get certified and you go in the next year and you fail to supply your self assessment score in SPRs, there is talk that your certificate will be suspended. We are still unsure who suspends that certificate because it's not us, it's the C3PAOs. But uh, that was the information coming out of the Cyber ab. So it is very important that you do those um, self assessments in between your cehrt years. The other thing that's kind of hanging out there with the self assessments is the Department of Justice. It appears the CIO is really leveraging them to uh, ensure compliance. I don't agree with it. I don't think many folks do, but that's the reality right now. So you want to make sure that when you're doing that self assessment you are doing it accurate so that you're reporting an accurate score.

Speaker F: And the good news is if you do your self assessment every year and you keep a record of it when you Go for your full assessment with a C3 PIO and you get to 312.1. You are golden. You have your reports, you are good. You will fly through that control.

Speaker D: Absolutely.

Speaker B: Thomas is shaking his head. All right, thanks, team. Okay, the question everyone asks. How long will the DoD's suspension of CMMC Level 2 last? Damien

Speaker E: can't see it because of the Greenskin. Uh, yeah, yeah, the Magic 8 Ball. We don't know. That is the simple answer. Um, no one knows. We have suspicions. We have rumors on when updated guidance will come out from the Department of War, but there's no firm timetable on what those recommendations will be or when the level 2C3 PAO, um, requirement pause will end. And just one point of clarification, this is. The pause is only for C3PAO assessment requirements. You are still required to do level two self assessments. You are still required to implement DFARS, uh, 7012 and implement NIST special publication 800 171. So, um, we don't know. But rest assured that when that guidance does come out, um, Redspin will be right there letting everyone know, um, what that recommendation is and what its potential impacts may be.

Speaker D: Yeah, the other problem with this question is, um, you know, we try to avoid putting out the rumors that we're hearing and all the other things. We try to keep everything fact based as much as possible. So our sources are direct, Cyber AB or the Dow themselves. Um, all kinds of rumors are floating out there depending on what social media site you go to. But the reality is nobody knows, not even the PMO office inside the CIO's office knows what's going on. So if they don't know, it's obvious the rest of us don't know. And we're not going to put out misinformation. So we're just hanging out like the rest of you guys and waiting to see what happens.

Speaker H: Um, Little bucky pulled pork sandwich. It'd be ironic if it come out on November 10, wouldn't it?

Speaker D: It would, wouldn't it? Why is November seem to be the most important month for cmmc, I think it was that was brought up in our conversations yesterday.

Speaker E: You know what November 10th really is? It's already a national holiday. It's the Marine Corps birthday. I'm just throwing that out there.

Speaker D: Um, why? Why? I'm, um, gonna have to send you crayons. Okay,

Speaker E: thank you.

Speaker B: All right, moving on to the next question. Are prescriptive. Prescriptive requirements coming potentially with the updates? Dr. Graham?

Speaker H: Uh, prescriptive Requirements meaning tell us actually what we have to do to pass. They're already partially baked into Rev 3. I mean those are the ODPs. Now if you look at that article that I mentioned way back in the beginning, before I started messing with my potions here, um, you'll see in there there was actually talk of more prescription, whether it be stig based, cis based or whatever. Bottom line is, in Rev 3 there are prescriptions or prescriptive requirements in there, but they're defined at the agency level. That's what the organization is in. NIST is the agency. DoD published theirs last year. Um, other agencies have the latitude to do their same or just adopt what the department put out there.

Speaker D: Prime example gsa. When they made their announcement, they came out locking it to revision 3 versus revision 2, which nobody knew about. There was no pre conversations between the Dow and the gsa. And next thing you know we've got a conflict here. So those are the types of things they're trying to get a handle on. But that far rule is really what's going to drive that. Thanks Jeff. You're only feeding Damien by saying ooh ra to 10th November date. But appreciate it brother. Thank you for your service, guys.

Speaker B: All right, I believe this is our last pre submitted question before we open it up live. I've heard that while the pause is in place, level 2 self assessment are being considered as acceptable. If we get into a contract with another company that self assessed, if after the pause it's decided that there is, that is no longer acceptable, what happens to existing contracts? Do we have to cut ties immediately or do you think they would bake in a grace period? Dr. Graham, what's the best way for someone to think through that risk?

Speaker H: Oh,

Speaker D: this is a great question though.

Speaker H: It is a great question. So would there be a grace period? I'd like to think so. Meaning would there be a grace period from going to self assessment to uh, to third party. But at the end of the day it's like Rob said, who knows? It's like Damian said, who knows? Um, the level two self assessments right now they are being considered acceptable. However, you also have to look at what other contracts are being published on SAM.gov to kind of get a sense and feel of what they're looking for. So for example, I mentioned the Maps contract earlier. There's also contracts in sam.gov uh that say self assessment certification. The only way I know to certify the self assessment is through cmmc. So they're saying it without using the Actual acronym. What about stuff coming out of, you know, let's say NASA or Space Force or any other joint type of program. They're not tied into what the department or the CIO's office is saying. As far as the pause. They can go their own way and you're still going to have to do it. Personally, I think if you're, you're concerned about this, now is a great time to go through either a mock assessment or a gap assessment to actually see where you sit on these things. And Stephanie, I know you live and breathe gaps and mocks in that world every single day. What are your thoughts on it?

Speaker G: Find my unmute button. So, yeah, like, we, we're still doing gaps and mocks every day. Um, our consulting engagements are actually, um, increasing, um, even, uh, despite the pause. And so, um, either way, even if CMMC goes away, you still have the requirement to, you know, meet 171. So you still need our help, guys. Um, just, you know, reach out. And consulting, uh, engagements are still there

Speaker H: and let alone with those self assessments. You're supposed to be using the methodology in 800171 Alpha as well. And that's something a lot of organizations are unfamiliar with.

Speaker D: Yep. Um, other thing for you looking historically, there's always been some kind of grace period. They call it bridges. Right. So, uh, as we were working with, uh, ISACA to develop the CCP and CCA exams for revision three, they have a bridge for all those CCAs and lead CCAs that have taken, uh, revision two CCA. Now they're going to have a delta exam course for catching up to Rev3. Same for anybody that takes the new exam. Under revision three, they will have a bridge delta exam back to revision two so that it covers that gap for all of the assessors to ensure continuity across the assessments. I would imagine they would do the same. I don't think they would come out and, and kind of levy against the company. Hey, you did a self assessment. It's now requiring C3PAOs. You got six months. I don't think that's going to be the case. Um, it would be a grace period that you can slowly get in the schedule, get that remediated and move forward. So I wouldn't focus too much on that. The bigger question is, are you going to accept the risk as an organization if your, um, supplier has done a self assessment versus a C3 PAO?

Speaker B: Any other thoughts? All right, now it's your turn. Please submit any questions in the Q and A or you can raise your Hand. Just remember, one per person, please, at a time. Uh, we do have a first question that came in from Abdullah. What is your take on this? RFI offers path forward to DoD with CMC CMMC. So, basically, the article that we were referencing earlier,

Speaker E: what

Speaker B: is

Speaker E: that?

Speaker H: Well, that's.

Speaker E: Dr. Graham, go ahead.

Speaker H: Yeah, that's the article that we were talking about back in the beginning. Abdullah, is there a particular portion of that article that you're curious in more than anything or just in general? All right, well, speaking to it from a, in general standpoint, um, this was the first time anybody's went, quote, unquote, on record with any information that's been achieved or received from the task force. Um, while their supposition by some of the talking heads on LinkedIn about who some of those sources were, still, it provided insight into what they saw as well as kind of how they went through their recommendations. And if you've read the article, you know that there's three tiers. There's, you know, I'm just going to summarize that. There's the tier where it could be implemented, you know, without much pain. There's the tier that would require a little bit of pain, and there's tier. There's another tier that kind of falls outside the hands of the CIO's office. How that was received within the CIO's office, your guess is as good as mine. But based on that article, it doesn't seem like the task force even wanted to recommend wholesale changes. Because a lot of the comments and the concerns and even the actual RFI itself really was concerned more about the implementation versus the actual assessment. And the implementation has been around for almost a decade. So it's going to be interesting to see how. How that shakes out. Because if. If, and I'm just going to say it, and this is my opinion, guys, if today I was still a contractor and I was still basically stating I hadn't implemented requirements that have been around for almost a decade, my legal department would probably come smack me. Um, that's just my take from being a contractor. But ultimately, how the CIO's office deals with it is anybody's guess. Will there be changes? Yeah, probably some. Is it going to be wholesale changes? Uh, I kind of don't think so. Because they would have to go back through rulemaking to change the implementation. They would have to go back through rulemaking for that. There's also the National Defense Authorization act that comes into play here that hasn't been repealed. So there's a lot of Items that are lining up now, will they still try? Maybe. I don't know. We're going to have to wait and see just like everybody else.

Speaker D: Yeah. You know, my, my take from reading that article and highly encourage you guys to go out and read it. The main thing I took away is it looked like the RFI responses that the CIO office received from the industry was not matching with what she was believing is the issue with cmmc. So there's a conflict there from the task force to the cio. How they're going to resolve what that looks like is the big question. Right. So that, uh, as Thomas mentioned, everything pointed back to the implementation costs, um, versus, you know, the C3PAO costs. Uh, there's a lot of arguments, pros and cons, back and forth on C3PAOs coming in to assess organizations. Um, and those were all submitted as well. We ourselves at redspin focused more on the items that are broke within the program that we knew when the program started, we were going to find little holes that are kind of causing hiccups or bumps in the road with the program itself. An example, many of the organizations that get certified are, are getting all these different contracts and they're purchasing new acquisitions to help them fill those contracts. So those new acquisitions come with a new CAGE code and they want to put those organizations inside the current existing approved environment that was already certified. Then they want to get them added to the certificate. Well, the problem is you can't add a new CAGE code to the certificate unless you do a recertification. So those are the kinds of things we pointed out because now you're costing an organization more money every year just to add a CAGE code. And does that make business sense? First of all? No. Does it make any sense at all? No. So those are the kinds of things we would like to see improved across the organization that can help, or I mean, the program that can help subset some of these costs for the organizations, but also for you. Fresh beef on the slab. We got another question, Monica.

Speaker B: Yes, we have a couple questions. So next question I, uh, want to cover is Lee says if a contractor has not yet met level 2 Rev 2, would you recommend we go to Rev 3? And are all the objectives of Rev 2 covered in Rev 3?

Speaker D: I

Speaker E: got.

Speaker D: Uh,

Speaker E: so I would recommend you do what your contract states you are required to do. If your contract right now states, if you have DFAR 7012, it requires you to go to Rev 2. That is the requirement. Right. As for Rev 3, um, I would start looking at it, start planning for that. Be compliant to Rev 2, plan to um, move to Rev 3. Um, there are differences between Rev 2 and Rev 3. Um, Rev 3 generally speaking, and very generally speaking goes has additional requirements, things that were tailored out of Rev 2. So uh, policy, supply chain, risk management, um, and a couple other ones. So definitely keep your eye on Rev 3, plan for it, but do what your contract states.

Speaker D: Yeah, the other thing, uh, the last part of that question. Yes. Almost all of the objectives from Revision two have been, are still in revision three. Uh, they've just been moved around and consolidated in some of the other requirements. Um, then it brought in the new domains such as third party risk management. That adds new requirements and objectives. That's why you see the requirements kind of subtracted compared to Revision two. But the objectives are the ones that increased. And if you've been through an assessment, you know, it's the objectives that the assessors look at, not the requirements.

Speaker E: I'd also say

Speaker H: I'm

Speaker E: not a lawyer,

Speaker H: I'm just a crazy professor, but if it was me, I would do kind of a hybrid.

Speaker D: To

Speaker H: Damian's point, if your contract currently says Rev2, you gotta do it. But uh, remember those ODPs I mentioned? Some of those ODPs provide baselines that you can apply to your Rev2. So when Rev3 happens, now that the transition is more minimal, you're not doing a whole other experiment, you're just adding ingredients. Make sense?

Speaker D: Yeah, I think uh, Stephanie kind of pointed it out when we talked this a few weeks ago. But what really is going to suck about the transition to Rev3 is that they renumbered every one of the requirements and objectives. Which, you know, if you're building your documentation and updating it to Rev3, that's very tedious to go back through and renumber everything.

Speaker B: As a follow up, Lisa also said we have a GSA contract as well, but no CUI yet.

Speaker D: Yeah, no, that is a great point Lisa, and I'm glad you brought that up because I did see you type that coming in. Um, remember the CMMC assessments and your environments are not predicated whether you have CUI present or not. It's can you protect it if you do receive it? So that's part of it. Right? The other piece is do you have it and are you protecting it? So those kind of two combined. We have assessed plenty of clients that, that did not have any CUI at all. In fact, many of them wanted their, their assessments completed to know that their environment was ready for that cui. So it was almost like a confidence builder as they went in. Um, and then of course, you know, there are contracts out there that don't have any CUI to it, but yet the contract states it may have it. That was the other thing. Ah. A lot of the C3 PAOs and others pointed out during the RFI for the, the CIO office was that, you know, you're putting all these requirements in the contract and they don't have to be there. Those, when you put that in the contract, it's driving that price up for the organizations, those OSCs and the contractors to put these, uh, environments in place, which is the implementation costs that we see. And why, you know, this contract itself doesn't have any CUI with it. So, uh, it's that, that's really the crux of the issue in my opinion. With everything going on with this, we need to get tighter on what we're labeling as cui. And when I say we, I'm talking the dow. What is cui? What contracts, no kidding, require it, what contracts may see it. And if for those individuals it may be a self assessment, I mean, there's all kinds of options that they can do to help bring this down, but, um, they just got to make that decision.

Speaker H: Speaking of contracts, my Bucky broke,

Speaker D: Matt

Speaker H: Klein has a question that I think he really wants answer because he put it in the chat and qa.

Speaker D: Oh, boy. To go, Matt.

Speaker B: Right. We're

Speaker D: gonna answer

Speaker B: Matt's question now. So I have a client who has told me we are seeing contract proposals being created at level two and nobody bids on them. They are then resubmitted as level one. Someone will bid on it, get the contract, and upon receiving the contract, they are immediately provided with an addendum that requires them to protect cui. The government will then send them the cui. The contractor will then reply, this is cui. We are not level two. You need to downgrade this from cui. And the response is no, it is cy and you must handle it correctly. What are your thoughts?

Speaker D: Oh, well, first of all, drink heavily. Good night.

Speaker C: My initial thoughts is that some, uh, shady KO activities going on. Um, but to the point, I would say, um, that that is a perfect example of a constructive change, uh, that has been imparted on the contractor by the government. And, um, the contractor should recognize it as such and come, uh, back with a request for equitable adjustment, um, aside from the fact that they then need to, um, work to build in the costs to the contract for getting CMMC Level 2 certified.

Speaker D: Now, one thing I don't know, Pat and Tom, is that if, if I am that contractor, right? And I am being told, hey, this was a level one contract we bid on. You're now sending us cui, which makes it level two, which we are not. And you told me, no, you're not going to downgrade that information to fci. What, uh, is their recourse? Is there somebody they can reach out to at the KO office, the CIO office? I mean, what does this contractor do?

Speaker H: Well, I mean, first and foremost, under the current rules, whether it's in the original contract or an addendum, if it's cui, the KO has to ensure they have the, the proper stuff in SPRs before they even award them the contract. But now if they put the addendum on after the fact, then, you know, to Pat's point, there has to be, there has to be a middle ground at that point, because you're awarding a contract with CUI to an organization that isn't prepared to have it. And so, uh, at that point in time, I'm a doctor, I'm not a lawyer. Talk to your legal counsel, you know, see. See

Speaker C: what can be done. And Matt's raising his hand.

Speaker D: Yeah, come on, man.

Speaker H: Yeah. So, uh, it's definitely a unique case. Uh, I have communicated with them to involve their legal team and keep contact with their POC and the government, continue to, uh, communicate with them. They are working on their Level 2 cert, but they're not there yet. They haven't lied on anything. They haven't fabricated a SPUR score. Everything is on the up and up. But they're being provided with a

Speaker C: cui and they're being expected to protect it appropriately. Ah, so it's kind of a, it's kind of a weird place. They have GCC high, so they're putting it in there. Um, but their local network where they're monitoring all of this stuff. And one of the big problems is one of the, uh, tools that they utilize to, uh, to, uh, perform their work is in the cloud. And this tool is not fedramp authorized. And they don't. They have no roadmap for it. And there is no like, tool that exists. So we've kind of circled the block on doing some kind of an enduring exception kind, uh, of trying to call it a specialized asset, but it doesn't actually meet the definition of a specialized asset. It's definitely falls under csp. So you really need the government to kind of classify this as specialized asset or give you the, or approve the Enduring exception. You don't want to do it yourself and then come into a C3 PAO assessment. The assessor's like, what the heck is this? But right now in the meantime, they're in a really sticky spot and I don't have good advice for

Speaker D: it. Yeah, um, no, man, I think everything you've given them is probably the best advice you can do. Um, it's good to hear that they are moving towards level two. I would imagine there was some kind of grace period that they would have to have that completed by. But again, when they originally bid on the contract, that requirement wasn't there. So this is definitely a legal issue that's gotta be brought up. But, you know, going back to the FedRamp pieces, uh, the different solutions organizations are using that are not FedRamp authorized. Uh, I'm not sure if everybody out there is familiar with the healthcare side of things. Uh, but there are hospitals that service military families, uh, and service members. All of that information is considered cui and some of the tools that they use to track all that information, manage all that information are not Fedramp authorized. And they're in the same boat. And there's no other, as you mentioned, Matt, no other solutions out there that are willing to go to that finrap, uh, route so that they can be utilized, uh, without any, you know, reduced risk. Uh, it's just a big mess. Uh, I pointed that out to the CIO office, you know, way back early in this year. Um, actually it was towards the end of last year when I pointed that out because we got a client in that's using these and it's like, hey, those solutions are not willing to go to FedRamp, so what are these hospitals supposed to do now? So it's a, it's a catch.

Speaker C: Yeah. The other problem two is, you know, one of the things that you could do to solve that is if there was a way that you could operate it locally and then you could protect whatever local system that it operates on.

Speaker D: Right.

Speaker C: But this particular tool doesn't offer that. It is cloud hosted in their environment, period.

Speaker D: Yep.

Speaker C: So.

Speaker D: Yep. And that's the, that's the crux of it. It's not so much where using the solution, it's where is that data being stored? And while it's being stored in a GCC high or a certified environment, you can't say the same for the solution owners that you're working with, because they're storing that data somewhere as well.

Speaker C: Okay, cool. So we're all on the same Page.

Speaker D: Yes sir. I

Speaker B: think Erica might have wanted to add something.

Speaker F: Uh, no, I think that they said everything I was just mentioning, you know, that is a don't take, uh, ownership of CUI if you are not able to protect it adequately.

Speaker D: That's just going to open the doors for more legal action against you. Absolutely.

Speaker F: Yeah.

Speaker B: And then Katie has a question. How does that change if the final CUI rule gets published and all agencies are going to need to go all 801-71Rev3 or am I misreading the situation?

Speaker D: Well, first of all, Katie out of South Dakota, I hope it's warm up there. Um, I'm pretty sure it's not. Um, yeah, well, you know, the final CUI rule gets published, um, you know that's going to drive revision 3. I know that prior to the pause, the DOW was working towards revision 3 and getting ready to submit it for the rulemaking process, but that got paused as well. So really not sure where uh, we're going to stand. We do know that that FAR rule overrides, it's the higher level rule, if you will, that's going to drive those lower, um, supplemental rules. So there's no doubt that if the FAR rule comes out and says we're tying to Rev 3, that's going to make it very sticky for the CIO office to come off of that because there's so many different regulations, as Dr. Graham pointed out, that are tied to this program. If I understand the

Speaker H: question correct, Katie, Um, uh, the Fedramp moderate, uh, or equivalent authorization requirement, um, stays, uh, either with

Speaker C: uh, CMMC, ah, level, um, excuse me, CMMC level two with 800171 Rev two or Rev three. Either one.

Speaker F: And

Speaker D: hm. We do know that, you know, when they do go to Rev 3, there is going to be a grace period for all those that are at rev2 to get moved over to that new one. We believe, uh, they haven't given us details but we do believe if you've certified under Rev 2, um, and Rev 3 comes out in your in between certification years, you will pick up Rev3 on your next recertification. Uh,

Speaker C: now correct me if I'm wrong, but I believe Fedramp moderate authorization was one of the issues that was raised as part of the rfi.

Speaker D: Yes sir, it was absolutely and basically what Matt was stating. You know, there's tools out there that are only built for specific things and those organizations do not want to go that Fedramp route. So what is the contractor supposed to do? So that's why Those were brought up during the RFI as well.

Speaker B: Katie wanted to clarify. She was trying to talk, but it's not working. This was back to Dr. Graham's previous point of all agencies going on Rev 3, not just DoD.

Speaker H: Well, I mean, the federal rule is the federal rule and that means all federal agencies. So there is going to be given latitude to each of the, uh, individual agencies on how to, you know, specifically implement it in their organizations. But they're all going to have to use Rev3. Um, it's kind of that one rule that's going to rule them all. And that's part of the reasons why all the agencies are still all over their place. Now the federal rule has been being worked on, you know, for a number of years. But the other part that you know is is is going to be good coming out of it. If you've listened to us before, if it stays in there. There's a standard form requirement that identifies not only the types of cui, but what is to be considered CUI under the contract. That's more so than the move to Rev 3 is why that rule needs to come out sooner rather than later because it's going to give every single organization the clarity they need on what they absolutely need to protect and need to scope in those boundaries. For Rev 3 as well as Rev 2 currently. M does that make sense?

Speaker D: Yep. And for those in the audience, you know, just for edification, we here at Redspan, we're not just the C3PAO, so this pause is really affecting that portion of our organization. But we're also a cloud service provider, we're an external service provider, and we're an authorized training provider. So those three arms of the federal support are going to continue no matter what the decision is out of the cio. And we've got a lot of clients that are relying on us to give them and answer these questions, you know, in the best way possible. As Matt was saying, how do you give advice to a client when you yourself don't know? It's just a very tricky situation that we're in. Um, but just know this pause, we're hoping that, um, you know, whatever comes out at the end of it is going to be a positive thing that is going to fix this program so that all will come to a middle ground and continue to move forward. I will tell you personally, you know, I spent 31 years in the US army, retired as a command sergeant major, been doing this since I retired. So I've been 40 plus years working with and around contractors And I'll tell you, this is the biggest shift in compliance that we've seen over that timeframe to get everybody aligned to the DFAR 7012 requirements. So for them to pause it, it just really shook our heads as to, you know, you're seeing a program that's really working, then all of a sudden you stop it. And, you know, the reasons behind it just didn't make sense. So it, it's left a lot of us confused, um, and wondering what, obviously politics are involved in it. There's no way, uh, else to say that. I know it is. Um, so we'll wait till the midterms to see what happens. Wouldn't, um, be surprised if November 10th, as mentioned earlier, is that announcement date. So go URA. Uh, Marines.

Speaker B: All right, I think we have one more question. Uh, if I'm scheduled for a C3PAO assessment in November, would you suggest I move forward or postpone it at this time?

Speaker H: Do it?

Speaker D: My gosh, that's a great question. And do it. Here's what I

Speaker H: would absolutely go forward and do it. And I'm not just saying that as a C3 PAO,

Speaker D: right.

Speaker H: If I put my CISO hat on. If you go through and you get verified by a third party on your ability to protect sensitive information, not only, you know, would it pay you dividends in this arena, but your CISO and your, your folks, they could potentially negotiate lower insurance rates. We've seen that happen. We've seen, uh, you know, the organizations that have went through it, they've been reached out to, to help, you know, be part of the contract team on other contracts. So it's also generating more business form that they didn't otherwise have. To be honest with you, as a ciso. Yeah, come in, grade me, tell me where I'm at. If I'm doing good, sign off on it. And that way, you know, um, knock on whatever woods around you. If something happens, then you have a lake to stand on. That's saying at this point in time, we had everything configured correctly and we were doing what we were supposed to do. So generally, if that is the case, if something happens, well, all the investigators and everybody else, usually, not always, but usually will look at you in a little bit more favorable light.

Speaker D: So two things for you guys, uh, one, it's still a competitive advantage for you to have a CMMC certification, reasoning the K.O. um, bases the contract awards on points. So if you're a small veteran owned business, you get so many points. If you're a female owned business, you get so many points. If you're CMMC certified, you get so many points, and that lifts you above the competition. That also paves the way for you to really lock in and guaranteeing you that contract in most cases. The other thing that I want to leave with you is something for you to think about. And this was a conversation with one of the prime CISOs that I had, and it was Rob. I would rather pay a C3PAO to come in and take a look at my network and my subs networks than pay fines to the Department of Justice that are triple what the C3PAO would charge. So it's a confidence thing, right? Um, it's a protection thing to keep the DOJ out of their hair. So all of those play a role there. But the bottom line, it's a business decision by you and your organization. If you should continue, we say yes because we see the competitive advantages. You may not see those advantages, and so you're really relying on our word that they are there. But I guarantee you those advantages are there. So make sure your leadership knows those advantages when you're making these decisions.

Speaker B: Awesome. Um, I think that wraps up all of our outstanding questions. Thank you.

Speaker D: That's great, Monica, because I am sweating my butt off over here in the same costume.

Speaker B: Thank you to the panel for answering all of them and to you all for, for asking your questions. Um, giving us your time today. Before we wrap up, though, we just wanted to let you know that you can catch Redskin at these upcoming events. Uh, in October. Sorry, November, we're going to be at the same Federal Small Business Conference in Charlotte, North Carolina. It's about two hours from where I am. And then Microsoft Ignite in San Francisco, the 17th to the 20th, and then we'll be at it sec in Orlando, Florida, Rob's way. Uh, the 30th to December 4th, and then into December, we will be at the Eastern Defense Summit. We'll have a booth, so come out and say hi to us in Charleston, South Carolina. And then finally at the Naval Nuclear, Submarine and Aircraft Carrier Suppliers Conference in Philly. So please come and say hello if you're going to be at any of those shows. And Darium, we look forward to seeing you at Tech as well. Um,

Speaker D: always Darian.

Speaker B: Orlando, Rob. So she'll have to come. Thank you. Um, but thank you again for all of you, uh, and your thoughtful questions. Our mission at Redsin is to move federal contractors to a more secure, compliant and resilient state to help protect the defense industrial base. If you have any more questions or you need help, please reach out to us@ahredspin.com. you can check out our CMMC resources. And don't forget, please take a minute to complete our feedback survey when you leave. It really helps helps us shape future sessions. So thanks again everybody. We will see you next month at AH CMMC Connect. Have fun. Have a fun and safe Halloween. Take care everybody.

Speaker D: Stay safe but dangerous. Happy, uh,

Speaker B: Halloween.

Speaker F: Uh, thank you.