Name: CMMC Is Finally Here – Now What?
Uploaded: 2025-04-03T18:30:05.058Z
Duration: 1 h 30 min
Description: CMMC Is Finally Here – Now What?

Transcript for "CMMC Is Finally Here – Now What?": Alright. Let's get started. Hello, everyone, and welcome to this Apptega webinar. I'm your host, Robert Hilson, and I'm joined today by Carter Schoenberg, the chief cyber security officer at Soundway Consulting. His role at Soundway includes building and overseeing its CMMC program, which has led to the firm certification as one of, about five dozen, c three POs in the entire world. He's also deeply involved in the CMMC assessments themselves, working closely with clients to ensure they're prepared for CMMC certification and that they can form with the duty of care requirements that that entails. Carter, I I think we've done, like, four or five of these at this point. It's, it's always great to have you here. Well, thank you for having me back. Awesome. So, as I assume most of you on the call know, since you're here with us today, the final CMMC rule went into effect in mid December and its requirements are starting to appear in, DOD contracts. And government contractors are officially if they they weren't before, which they were, they are officially on the clock. As I mentioned, Carter is, walking many of his clients through the certification process and has all kinds of insights, where organizations need to tighten up, where they're, hitting snags, how they should think about, timelines associated with certifications, and just things generally that, you know, you should be prepared for. So, we asked him to share some of that guidance with us today. Before I turn it over to Carter, I want to encourage everyone to ask questions. We do have a lot of people on this call, but, we'll try to get to them all. So, you see the chat there on the right of your screen. Just pop in the questions when you can, and we'll get to, as many over the course of the next thirty minutes as we can. Alright. Carter, with that, I'll, I'll turn it over to you. Alright. Great. Thank you very much, Robert. Good afternoon, everybody. So, again, my name is Carter. I'm with Soundway Consulting, and have two roles. One is responsible for our own internal corporate practice as well as our forward facing professional managed services. Soundway was the twenty fourth authorized c three PAO as of September 2022. We were recently reauthorized as required for the FAR, on or before January second of this year. So for the title today, you know, CMMC is here. Now what what does that really mean for for everybody? So as Robert made reference to, the far 32 CFR part one seventy, was ratified. It is still pending congressional approval. But even with pending congressional approval, it is formally active, as an administrative legal requirement. And that went into effect, in in December. It had a open period for comments, as following with any of the proposed rules that had taken place. And we have seen a significant uptick in activity since that notification. And for today's session, what we're gonna do is talk about a variety of different things. We're also be we're gonna start off with the political landscape. What does that mean if anything? The issues that we are seeing with supply and demand, how, government contractors are thinking that they may be ready. But from what we're seeing as a C3PAO and helping clients get ready, what are we seeing as well as the information that we have access to from other C3PAOs? And, hopefully, by the end of this session, you will be in a much stronger position to have a better understanding of what you need to do next, the rationale behind that, and then we'll keep the floor open for any type of comments, questions, or concerns that you may have for myself or for Robert. So getting started. So very recently, there were, a flurry of different news articles that came out that seemed to have some very misleading connotations to it. I see Dan Robinson's comment. Yes. So we did in truth in lending, we did start off as an r two d two, and then we became a C3PAO. So coming back to, you know, Trump, the the theory is that Trump is in, CMMC might be out. Well, not really. So with some context behind that. So Michael Duffy, who is the the nominee, as the undersecretary of defense for acquisition and sustainment, had made some comments before congressional committee as it applies to he is gonna take it upon himself to do a review of the CMMC program. The connotation there was not I'm gonna do a review to kill it, but to do a review to see is there a way of providing any additional operational effectiveness and efficiencies that can be derived that will ultimately result in potentially lower cost to the defense industrial base. Now what does that mean? Well, frankly, it's such a high level statement. It can mean a variety of different things. One thing that the C3PAO ecosystem does not concur with is that that is gonna telegraph that this program is going away. And point in fact, information would probably suggest the complete opposite. Many of you may remember back in this original origins of CMMC, the person that was spearheading that was miss Katie Arrington. And then a couple years into it, with some much heated fanfare, she departed. Miss Stacy Bostjanek took over. And then very recently, within less than a month of today's date, miss Harrington was brought back in to spearhead the program and is even acting as the interim chief information officer for the Department of Defense's office of the chief information office. So post January 2. So what's so important about January 2? So January 2 was the date that the cyber accreditation body and the cyber accreditation body is the only authorized organization that has the no cost contract with the Department of Defense to provide the the oversight and operations and management of the CMMC program. Now as of March 28, there were a total of 64 authorized C3PAOs that had to go through a reauthorization process. I looked today, and for some reason, that number seemed to drop to 63. Last week, there were 338 certified assessors. That number is now showing 340 as of today. And then you have those that are defined as a lead CMMC certified assessor such as myself. There's a total of 231. Now what's important for people to understand is that a very large percentage of this candidate pool that they are operating as ten ninety nine contractors. And the reason why that is important to understand, it not that that that's a bad thing, but as it comes to the ability to have c three POs successfully execute, there might be some challenges there. And we're gonna be covering that in in the coming slides. So as it stands right now, we are still waiting for 48 CFR. It's not formally ratified. And a lot of people were really kind of digging in with the past comes that was making with regards to trumping in. Maybe CMMC is gonna be out. When Trump came in, he put a sixty day moratorium on any conditional rules that were being, put up for formal ratification. Those sixty days have now come and gone. 48 CFR, I believe, as of today's date, is with OIRA about to go back to OMB, but I might be wrong about that. We are at some way, we are estimating that 48 CFR is gonna be going live on or about late May, June ish time frame. And then at that point, there would be a year runway before, technically, according to how the FAR was written, that solicitations and or contracts that would have CMC obligations, so we would be put into that. So that would give you on or about June of next year. And as a result of that, what we saw, Robert, was this kinda, like, spike from December 16 through, like, January of organizations going, woah. Woah. Woah. Yeah. We we we need this. We need this. We need this. And then all of a sudden, it it kind of dipped a little bit. I'm not gonna say it flatlined, but it there was a little bit of a dip, and that's largely associated with this, oh, well, I had time. Well, you know, we're already in 2025, and the closer we get to 2026, the reality is is that time is not really on the side of a government contractor or otherwise known as an organization seeking certification. Because as it stands right now, at the time when I put this presentation together, there were roughly 100 companies that were already in the queue or actively being assessed. And the reason why I'm able to know that is because as the c three p o, we have access to the EMAS system, which is the centralized repository for all of the formal certifications that will be taking place under the accreditation body and the the far and the U.S. Department of Defense. And at that point so we have about roughly a hundred, and there's let's say a little over 60 c three PAOs at that point. At the current rate of adoption for c three PAOs to come into the marketplace as an authorized c three PAO, Even if we sit there and we track that at about 100 in 2026. The fact of the matter is there's probably gonna be close to a few thousand organizations that are either actively or have already become certified at that point. So when you're doing the math, this these red dashes are highlighting that delta in supply versus demand. Now having said that, what can be done about it? If you're an organization considering that you want to be put through the the the rigor of being independently assessed by a c three p a o, like Soundway Consulting or or another c three p a o, But you're not gonna be prepared to do that until, let's say, February 2026. The time to get that contract in place to hold yourself in a c three p a s queue is not October. It's now because Soundway Consulting in for context, the accreditation body's marketplace is done alphabetically. So it's very much like a telephone book. And even Soundway Consulting, starting with the letter s, our queue is already filling up. So timing is critical for the success of any organization that feels that they want to be prepared to continue doing business and go after new business with the U.S. Department of Defense. And it's also important to understand that as a result of another FAR role that's in play, there could potentially be additional implications on the federal civilian side of the fence, meaning DHS, office of, you know, CDC, health and human services, and other federal civilian agencies. So, again, timing is important. Understanding how long is it gonna take you to even do the assessment in the first place. Are you even able to identify the appropriate c three p a o that you want to do business with? And are you able to get on their schedule? And this is gonna come back to the topic that I made reference to earlier, Robert, on the use of ten ninety nines. And, again, the use of ten ninety nines in and of itself is not inherently a bad thing. It's a in fact, it's a necessary thing because of the supply and demand issues at this point. So However Yes. A a cup couple follow-up questions, and then please please continue. But, just to kinda emphasize the point you're making here, what is your capacity to actually take on these assessments and do them simultaneously? Because you said get in line. Is it is it will there literally be a line a few months from now? Yeah. So, short answer is yes. I took a lot of heat, a few years ago when I had a video that I had posted showing a a line of about a hundred people at Reagan Airport because of flight cancellations waiting to get onto a different flight. And I was socializing at that point. If you don't take actions now, once we get to this point, this is pretty much what you can expect. And even though it took a lot of heat at that point a few years ago, what we're starting to see now is that hypothesis is really starting to manifest itself. So at Soundway Consulting, we have three w twos that are fully cleared, assessors to be able to do that, and we also leverage ten ninety nines. But from our perspective, our goal is to increase our bench with w twos so that way we're never in a position where if we give a client an estimated timeline, that we are not potentially gonna have a conflict because of scheduling by relying exclusively on ten ninety nines. Got it. That that's helpful. And then second question is, do you have a a sense of, like, what percentage of DOD contracts right now actually include these requirements? Or maybe contracts might not be the right term. Maybe it's the RFPs that they're sending out. And then what maybe the kind of the the phased approach might look like over the next couple years? Yeah. So it's a great question. So, again, this is gonna be a a rather, argument and the point that I'm about to say. But to your question, how many of these contracts have them? I don't know. 90 plus percent. Okay. Now what do you mean by that? So a lot of people conflate CMMC with what CMMC actually is versus, let's say, defense for acquisition regulation supplements. All that CMMC is is a third party way of policing that you are not in violation of the contractual terms. These requirements have been in contractual obligations since 2017. So this has been in play now for eight years. But, unfortunately, when these regulations came out, industry looked at it as, you know what? It's another government regulation, and they're never gonna police it. And guess what? They never police it. So now as a result of what we have seen as the the growth and development of CMMC, the growth and development of the accreditation body, and the reestablishment of having miss Arrington at the at the helm. You you are now seeing organizations going, oh, jeez. Yeah. We've we've gotta get on this, and we've gotta get on this right now. And even absent of a large percentage of solicitations having, let's say, CMMC language specifically in them Mhmm. What we are seeing as the primary driver are the large system integrators. The large system integrators are coming right down to their supply chain, and they don't care if you're a 500 person company or a five person company. Show us what your game plan is or you're off our team. Full stop. So that has been and continues to be one of the primary drivers for why we are seeing organizations really starting to ramp up and and get in the queue of of C3PAO. Now with regards to the phased approach, level one is gonna be phase one. Originally, when this was being socialized, they were looking at, a shorter duration, but now the phases look like they're gonna be one calendar year. So one calendar year from the date of 48 CFR going live is when they expect to see solicitations with level two obligations in it. Having said that, the fine print on this is that one, you're gonna have this burn in period for self attestations for level two and then rolling into level two. The problem with that is is if you looked at the fine print on that rollout, it clearly states that the contracting official or contracting officer has the absolute right and authority to say, no. We want an independent assessment. We're not gonna just rely on a a self attestation version of level two. Mhmm. And and in point of fact, a solicitation already had hit the street, which from what I understand just very recently has been paused for whatever the reason, whether it's based on CNBC, current geopolitical issues, whatever the case may be. But this was, for the ark United States Army. It was called MAPS. This was actually a professional services contract, which to me I find surprising having been in this arena for well over a decade that it wasn't like a CETA, like a science and technology type of contract. It was a professional services contract. And what the stipulations were in the RFI were once the RFP came out, when you submit for that RFP, you also have to be able to provide demonstrative proof that you are already engaged contractually with the C3PAO at a later date to have your formal assessment executed. So I think that the this theory of, well, it's gonna happen at that date and then zero day moving forward. That might be the case, but I think it would be improper to not also account for some outliers where a sprinkling of these kinds of situations come into play where the government is saying, we know that this is not going to materialize until 2026, but don't even bother bidding on it if you can't show us that you already have an agreement in place with a C3PAO because they too are also aware of those supply demand challenges as well. So that's the first issue. The next thing is also what we are historically seeing as applies to the mindsets of government contractors thinking that they're ready. And these are usually the the top four hit list for what we have seen as C3PAO. And, also, this these are collective observations from surveys that I pulled from other lead certified assessors or C3PAO, technical points of contacts. One, that their scope is not properly defined. Two, their shared responsibility matrix is not clearly understood if it's applicable, and we'll be delving into what the shared responsibility matrix means and entails in the coming slides, poorly written system security plans, and last but not least, just when you thought it was dead, it came back again, lowest price, technically acceptable. So on the first one, with regards to scoping issues. So in this particular graphic on the left, you're gonna see, what represents, let's say, a cloud network, and that stands for the OSC's core enterprise network, otherwise known as CEM. What we have seen continuously and, again, seen from, others in this industry, a lack of understanding of if you were using an external service provider, like an MSP or an MSSP or potentially even a just a one off security consultant that you're heavily relying upon, maybe for virtual Cisco services. The inability to accurately capture that and to convey it in a way that demonstrates that the objectives for the controls in question are being met. The second issue applies to operational technologies or IoT. So if you're thinking about, SCADA systems or things that are very consistent in manufacturing environments or next gen three-dimensional cutting edge technologies on on manufacturing. These are things that we are also seeing not being included in the scope properly or how they are defining it in their, let's say, their inventory of assets is not properly being described. And for those of you that will be attending CMMC day next month up in Maryland, this topic on inventory of assets and specialized assets is something that I'll be focusing on, I I believe on on the first day. And then last but not least, security protection asset products. And there is this inherent belief of, well, you know, I I'm in a FedRAMP enclave, so I'm good to go, you know, full stop. Well, one of the challenges that has existed, and this is by industry as well as even our own internal ecosystem, was and this kind of also comes back to external service providers. Well, they're not gonna really ever see CUI. So what difference does it make? Well, if the administrative access on your network, how in the world would you think that it's not gonna be in play? And, ultimately, as a result of the CMMC, assessment process, also known as the the cap and what's being described in the far, these things are now fully right at the forefront for organizations to have to take a much deeper consideration with regards to what is their system security plan look like, do their policies and procedures align with the SSP, and is it also accounting for the use of external resources? All of these things are gonna be interdependent and also gonna be subject to inspection during your formal C3PAO assessment. Now now we're gonna talk about shared responsibility matrixes and sometimes the lack of understanding. It's very important for everybody here to understand that if you are using an external service provider, an MSP or an MSSP, it is critical for you to understand that service level agreements are written to benefit the service provider, not the organization or the entity or the individual receiving the services. And in many cases, those that are procuring these services, they don't know what they don't know. So as a result, it is a challenge for them to understand what is being conveyed in marketing material, what is in my service level agreement that I can legally hold this organization accountable for, and how does that align for a shared responsibility matrix that's going to address all 320 objectives that I now have to be able to demonstrate conformance where a large percentage of that, whether that's 20% or 80%, might in fact be outsourced and is now the responsibility of a third party. And then as it comes to security protection assets, it's also important to understand some of those limitations that exist when you're using these kinds of products. So with regards to Microsoft, I'm sure everybody here is familiar with Microsoft GCC or the GCC high environment. They did a very good job of creating a an interactive tool that they call the placemat. I'm not a fan of the naming convention, but it's it's their tool. And, basically, within that placemat, you select one of the services that you procure from Microsoft. And then color coding, it lets you know which, controls are being either fully addressed, partially addressed, or not addressed at all, and that there is an element of the obligation on behalf of the client, it clearly describes what those obligations are. Very, very few organizations that we have seen where we are doing readiness reviews have accounted for that. There's just this blind assumption of, well, no. It's it's inherited. No. It's only kind of inherited. You still have an implicit responsibility for a subset of these objectives as it applies to this control. Same thing will happen with, CrowdStrike or Keeper. We had a circumstance recently, and CrowdStrike is a great example. Great tool. I think it's a it's definitely it's an industry leader. But as an example, if you are not using single sign on with your own intra ID, some of these controls, you're not inherently gonna be able to meet. Because when you're talking about a control, it applies to, let's say, password complexity or password management. Well, you're not able to do it because you're having to defer to what they have. And if you're not accounting for it in your own system security plan, it applies to the Acme company is defined, we're gonna default to you, enter IDs, best practices, which is an uppercase, lowercase, you know, number, however many characters, and so on. But if you're not accounting for what is that password requirement for CrowdStrike or other security protection assets that may be third party services, you're gonna get dinged on that, and that potentially could be a fail. In fact, more like than that, it would be defined as not met and be subject to, a determination on is that gonna be something that will be allowable to be resolved during the assessment period of performance and or up to the ten days afterwards as the far allows, or is that going to be a means of having to disqualify any further activity because it's a control that cannot be met for a variety of different reasons? Hey, Carter. If you're working with an MSP and you know you're gonna have to go through this process and there are, you know, boxes that they're gonna have to check, are are there things that you can kind of telegraph to them in advance to say, hey. We we need to be prepared here and, like, here are kind of the categories where we're kind of unsure or we wanna get on your radar because we know it's gonna be a little bit more intensive? So what we what we have seen at least in that capacity, and it's our clients are no longer limited to just overseas. We are now actively being engaged by external service providers as well. But what we are now finding is the request to not only look at their organization, but also the services as they are being provided to their clients from a consultancy standpoint. And then also allowing us to better understand, okay. Well, if this is what your assumption is as applies to your shared responsibility matrix, are there potentially any gaps as is being described in your service level agreement in helping to work with that? So well, like, one of the comments that just came through is, yes, everybody's trying to work in their best efforts to support their clients. But without having that level of expertise of getting kicked in the teeth a few times from some of these formal engagements, it's it's an effort of improbability that you're gonna nail it 100% the the first go around. So every op every organization, in my opinion, has an opportunity for process improvement in including Soundway Consulting to that capacity. Now I wanna talk about system security plans. And this is, again, one of the biggest cruxes that we've seen, more more times than I than I care to to make reference to. One, they're not we've seen a lot that are not written at the objective level. So, again, at a high level for people that may not be familiar with the the nuances and the intimacies of CMMC and eight hundred one seventy one. Eight hundred one 70 one, regardless of its revision one through revision three, has a control narrative. However, that control narrative has a direct interdependency on what they call the alpha sequence. So you would have one seventy at this point, one seventy one r three, alpha. And that basically is showing you all the associated objectives with that particular control. So the very first control, three one one, is an access control requirement. So you have a brief narrative. It's actually one sentence saying, how are how are you, being able to identify the authorized, nature of of your system? But there's actually six objectives that had to be met to check the box for that control. So if you get five out of the six, it's not horseshoes. It's not it was close enough. You had to nail all six to be able to check the box on that one particular security control. So that's how we get to a total of 320 objectives. We have seen, also in the initial discussions with organizations, just in the preliminary discussions with them, well, why do you keep making reference to 320? There's there's a 10 controls. That's usually what the FBI calls a clue that they may not necessarily understand what the level of specificity is going to be for what their SSPs need to look like. The second one is that there's usually, like, a lack of definition. Generally speaking, in layman's terms, it's it's too high level to be actionable. And if it's not actionable, at the end of the day, it's not repeatable, and it's certainly not legally defensible. And then last, what I call unintended misdirection. This is nothing nefarious. It's not that the OSC is trying to pull a fast one. It's just the way that it's written makes it very challenging for the assessor to be able to independently evaluate the effectiveness of the system security plan, such as you have a statement that's too high level in the base of the system security plan, but it's redirecting you to two or three other processes or procedures that easily could have been captured in the system security plan. But now the assessor is having to spend more cycle time delving into these other artifacts to not only show the accuracy, but what's the fidelity of the information being provided? Is it actually being operationalized as the OSC believes that it's gonna be? One of the most important lessons that I have learned with my days with Homeland Security when we were doing the authorizations to operate, the harder you make it for the assessor to find what he or she is looking for, the more he or she is going to dig in. So that's I believe it's gonna be the nature of any type of formal assessment regimen. You wanna try to keep it as simple, stupid as possible, but when available, you certainly want to provide enough meat on the bone, if you will. So then that way the person that is reading each individual control has a high level of confidence that the person or the organization that had constructed the system security plan fully and completely understands what the control is asking for and how the organization is responding to that ask of the control itself. And then lastly, you know, one of my favorite ones, lowest price technically acceptable. We're seeing it time and time. You know, just get it done. Just make it happen. Well, things to ask. If you are an organization seeking certification and you are in the process of vetting C3PAO, again, I don't care if it's Soundway Consulting or somebody else. These are four questions that you absolutely should be asking your them. One, how many ten nine ten ninety nines is the c three p o dependent upon? Or otherwise stated, how many of the assessors that are gonna be working on my engagement are actually full time employees? Because this is gonna come back to that supply and demand challenge as we see more organizations trying to get certified versus the the shortage of actual warm bodies that are authorized to perform these assessments. Another question, How long have they been in business? If an organization's only been around for a year, does that necessarily mean that there are negative implications? No. Not whatsoever. However, if you're an organization that's been around for one year versus a company that's been around for ten years, there's probably a level of business maturation for the company that's been around for more than ten years that will allow you to have a a more professional and a more polished type of experience with that organization. Also ask them how many formal assessments have they done. It's important because to just sit there and say, well, we have people. You know, they're certified. They're ready to go. While true, there are nuances and specificities to how an engagement is gonna be done and be done effectively. And especially as it applies to the use of the materials that are provided from EMAS, having that level of dedicated understanding of trial and error of what is gonna be acceptable in EMAS, and then making sure that those cycle times aren't necessarily you as the client, are are being the guinea pig, if you will, for the C3PAO. That they have already learned their lessons, so, therefore, they're not potentially spending unnecessary cycle time in the support of your your assessment. Now having said that, yeah, I would be remiss in saying that we are in April. This went live in January. Almost every C3PAO out there with the exception of a few that have been doing this time and time and time again back in the days of the joint surveillance assessment program are going to be going through a learning curve. They are gonna be skinning their knees a little bit. The question ultimately becomes, do you wanna work with a company where they're gonna be skinning their knee or working with a company where they're gonna be tripping and breaking their teeth? That's ultimately what we're trying to get to. And, also, how are they going to ensure executions of the timelines that were agreed upon? So if you have an agreement with the C3PAO Soundway Consulting that says that you're gonna start July eleventh of this year, what is structured in the service level agreement where if for whatever the reason they're not able to perform at that time, what are the resources available to you as the client to to regain satisfaction as a result of the fact that they told you it was gonna be on a date? Something happened from a staffing perspective, and they're no longer able to execute. So case in point, something happened with one of our engagements, and we got ahead of it. And we said, you know what? We appreciate you being flexible by a week, and we gave them a a discount on the previously, agreed upon amount for the the level two assessment. So these are all things that we feel are very, very important for individuals that are attending today's session to have some deeper level of knowledge and understanding on what they can do to drive better operational effectiveness and efficiency, thereby potentially lowering your total cost of ownership for not only your internal program and how you're managing it, but also for that actual certification process as you look outward for the appropriate service provider for your formal level two assessment. Carter, this is great stuff. Just to kinda set expectations around timing, if you were to start on July 1 start the audit on July 1, like, what is what is kind of the the time window look like? Yeah. So a fantastic question. So couple things for for context. If you're saying that, you know, that's where, like, it's officially gonna start Mhmm. All c three POs are bound by the cap. So there are a total of four phases. So phase one, if that's when you're gonna say, okay. Your kickoff call, phase one commences. That is probably gonna depend on a variety of different factors. But, statistically, I would say that that's probably a three week window. After the conclusion of phase one, the C3PAO makes the determination, is the actual government contractor ready to proceed to phase two, which is what we would normally consider to be the actual formal audit. You're going through interviews. You're going through tests. You're going through evaluations. You're doing an on-site inspection. And at least from the model that we do at Soundway and I've seen with other C3PAOs, depending on the size and the scope of the company, that's usually a five day window starting on a Monday, concluding on a Friday, and then going through the QA process several days thereafter and then getting your certificate of status. So I would probably say, it would be safe to budget, let's say, a a forty five day a forty five calendar day window from the kickoff call to when you're done and you're getting your certificate of status if that is the disposition of the C3PAO. Okay. And then, going back to some of the things you were discussing about, you know, where where some of these things can go sideways. Can is it your sense that, like, some of the remediation actions can be done in flight as they as the assessment is happening, or do things, like, pretty much pause? For instance, if you're, you know, if you haven't scoped vendors or, you know, if your if your SSP is problematic, like, what what kinda happens then? Yeah. So that would be that should at least be identified and captured in phase one. You should not at that point be able to go to phase two. Now I can't speak for all C3PAO Soundway Consulting. I can only speak for Soundway Consulting. If we have made a determination that the client is not prepared to go to phase two, we are not gonna sit there and say, thank you for playing. We appreciate the money you've given us and go back to formula. All that's gonna happen at that point is there's gonna be a suspension on the timeline Mhmm. At that point. Now if for whatever the reason we have identified something in phase one that maybe it's a control objective that you're not allowed to have a POAIM on, that would be a different story. But phase one is really to just make the determination on during the data call. You're gonna be asked for, do you have these kinds of artifacts? Yes, no. And if the answer is yes, what's the naming convention of them? Secondarily, can you actually show us that you have these artifacts? And that we're gonna be looking at the maturity of the artifacts. We're not gonna be looking at the is this control being met or not met because that's really reserved for the phase two portion of it. The FAR does allow some flexibility for the C3PAO is to collaborate with their, with their clients on what's gonna be defined as either a minor deficiency or as a control that is allowable to be rectified within that ten day window that's defined by the FAR. Now having said that, something to keep in mind is the C3PAO of community actively meets on on Fridays with the accreditation body. The general consensus is that if it's something of a documentation in nature, that's that was the that was the spirit of what the ten day window was designed for. Not to, oh, your technology isn't working as intended or, you know, you're saying you have McAfee, but you actually have Symantec in there. It's not designed to be a rip and replace on on a tech technical implementation. And if for whatever the reason, your resolution for a particular control also has a cascading impact on another control that was previously also marked as not met. Or maybe that one was met, but your change here is now gonna have an impact on that one. That in and of itself would also be, grounds for a disqualifying event at that stage as well. Got it. And by the way, everyone, you see Carter's information here on the screen. If you have any other questions, please feel free to reach out to him, directly and, you know, especially if you need to go through this process and you're looking for, C3PAO, I I I think Soundway Consulting's, available to do this work. Carter, last thing for you. I I think last time we chatted, you said a hundred of these assessments have now occurred at this point. Any any sense of, like, how of those hundred, how many have actually kind of achieved the certification? So, unfortunately, I do not have visibility into that. I'm not familiar with any of the c three p u's that have visibility into that. I believe that the accreditation body itself and the EMAS team have direct visibility into that. So I can't even begin to speculate on how that hundred did all 100 pass or did three not? Did 16 not? I just don't have enough visibility into that to provide you an educated response. Alright. Fair enough. So I I think we're gonna leave it there. Carter, we really appreciate you doing this. And, for can you continuing to come back and, and speak to the Apptega audience, thanks a lot for being here. Thank you very much. And, thank you all for your time today. We'll, we will send a recording of this, probably by the end of end of today. You'll see it in your email. And, again, if you have any other questions, or need to go through this process, please, reach out directly to Carter. I know he'd love to hear from you. Alright, everyone. We'll see you next time. Thank you. Thank you.