From Controls to Certified: The CMMC Fastrack | ControlCase iboss Webinar

Well, hi everybody. My name's Josh Hoffman. I am here today to help host this amazing webinar that we have. The webinar is called from controls to certified the CMMC fast track. But really what we're talking about here is something that's even a little bit more fun, which is how you get from sassy to CMMC. How are you going to go ahead and combine technology with services? What you're going to do to have a strategy that's going to help you get through the CMMC journey faster. You're going to spend less time, less money, have a little

bit less stress. And we've got two experts on the call with us today. I'm going to do a little bit of housekeeping, but just to do a quick introduction. First of all, we have Paul Martini. He's CEO of iBoss. We have Eric Levidus. He is VP of business development with ControlCase. And the two of us are going to guide us through this conversation today. Now, to get a little bit of housekeeping out of the way, there's a couple of things we're going to talk about. The first thing is this is probably going to be 30

minutes, 45 minutes. Look, the important thing is that we have the entire conversation, that we have a chance for some Q&A. As you have questions, put them into the window. Give us an opportunity to make sure that we're answering things. If there's any audio or visual issues, please let us know. Our moderators are here. They're standing by. They'll address them. And we do want to make sure and get to every question that comes up, but it's possible that we won't get to everything. And so we might have to follow up afterwards. And if so, we'll

make sure that all of the answers and questions go out to everybody. We'll also make sure that the slides and the recording of this is sent to everybody that joins this early next week. You can also visit our websites, uh controlcase.com, iboss.com. There'll be information in there about the webinar, about the regulations we're talking about, about the topics, about the people. There's a whole set of information that both of us will have about this. And the reason we're both going to have it is because this is the kind of relationship that I talk about a

lot. It's a better together relationship. It's a relationship where everybody wins. And I'm looking forward to what happens in the conversation today. And with that, what I'd like to do is hand it off to Paul and Eric and get us started. And so, let let me start with you. Paul, what are we doing here today? >> Yeah, really really great to be here with you, Josh. Um there's a lot of exciting things going on uh especially in the world of uh CMMC. And uh with all of the deadlines coming up in November, I know a

lot of a lot of companies are pretty stressed out in terms of um how they're going to meet uh compliance and, you know, stay compliant. So, you know, this um the the things we're going to talk about are are founded in uh in a base of how do you get technology um that enables you to get to uh CMMC control implement your CMMC controls in a fast and effective way that also align you well with assessors um so that when you go through your compliance and your audits, um it's a streamlined process, right? And I

think um you know, lots of companies right now um are don't even know where to start. And I think um that's probably the worst uh situation to be in. Uh but we're going to we're going to definitely get to um some practical um advice and um uh strategies in order to implement CMMC controls um and get you in a really really great spot for uh the assessors. >> Yeah, so look, Paul, I I I appreciate this relationship and I I'm really excited to make sure that we're here to to to educate the community, right? So,

the biggest things I want to make sure we address here and that we support the conversation of can we do CMMC more efficient? Yes. Can we make audits more streamlined? And can we make it easier for the OSC going through audit to potentially make a more cost effective experience? Yes, right? So, with this relationship that I bought some troll case has and we'll talk a lot about why and what FedRAMP moderate equivalent means and what just what FedRAMP means in general and just some of the pitfalls we're seeing and some of the things powered by

AI that I bought some doing. We want to educate you to make sure that you know that there's a lot of buying decisions to make out with a community, but there's one that can help streamline again. We want to make sure that when you get your CMMC journey ahead of you, you're making all the appropriate buying decisions on the front end based on your scope that's identified and we're making sure that you're doing it in the timeline that you need to. I'm seeing crazy things happening in industry and that's maybe Paul that's one thing I

wanted to start with is this whole timeline. Everyone's got this November date on the top of their head, right? In my world, November is an ancillary date, right? Some people are in are are getting hit and impacted by this November date. But man, I'm seeing April, June, I'm seeing next year, I'm seeing people have compliancy requirements now. Tell me in your world some of the clients you're engaging with and you're supporting like what are you seeing in terms of like timeline to get compliant and whatever that means to these government contractors or government entities. >>

Yeah, absolutely. You know, there's there's uh two levels of uh CMMC today at least the level one level two um CMMC uh compliances. You know, there's obviously um with level one you can do self-assessments, um but one thing I would say with it with a self-assessment so it's a lot fewer number of controls is that it doesn't mean really to like just check the boxes and some say that you're compliant it's probably the worst thing you can possibly um do. So, you still want to make sure that um the things that are um that you're

attesting to you're actually doing. I think it's really important um if you get audited um independently that you can you can put yourself in a in a very bad situation in the in those uh, circumstances, but I also I also like to look at this a lot of times from a different perspective, which is what's the whole point? I mean, why why does CMMC compliance exist? And it really is to protect the sensitive data, right? The what they call the CUI, um, and ultimately we really, um, don't want to lose it. You know, the government

does not want to lose that data. Yeah, you're you're handling very sensitive information. We don't need that ending up in the wrong hands, right? So, you everybody plays a really critical role whether you're doing the CMMC CMMC level one or level two. Um, and actually, um, as you go to level two, which is the 110 uh, compliance controls, um, now we're talking about, um, situations where you're you definitely are more engaged with the government and you're you're definitely handling more, um, more information, more sensitive information that becomes a lot a lot more critical. Um, I

I take, you know, as I take a step back and you know, pop up a level, I think access controls are are key to to this whole process. Like, if you fundamentally look at all of the um, all of the the different compliance controls, they're they see they have an underpinning of like, how are you controlling access? Who has access? Do you segregate access? How do you how do you confirm that the person touching the data is is who they say they are? Right? So, you know, as and and as I look at this from

um, uh, strategy and implementation perspective, um, this is I think where, you know, the the I boss component and of technology really plays a a strong role is you know, zero trust and SASE is all about access. And it's not not just identifying the individual, but ensuring that when data moves from one point to another, that there's a there's a control. There's there's an authorization, um, and an approval process that um, that takes place to make that happen, right? But so, I think that fundamentally as an underpinning, um, centered around access controls and coming up

with a great, uh, strategy to implement those those controls are are a great start. And then as you as you, um, align the process to assessments, right? You may need some help. Um, you need to get a third uh, a 3PAO to look at this and ensure that you're following all those compliance controls. The worst place to start is no plan, disorganized, no idea of like where your sensitive data is, who touches all of that data. So, you know, being able to come in with a strategy that I kind of like to use technology sometimes

in a way to create like an underpinning or framework to work around and then once you understand that framework, you can start placing all of the actors and characters that are involved in touching data, moving data into that. And then that actually puts you in a really nice spot to, you know, to head into, you know, control case, right? And so, I do think that that really is what streamlines the process end to end is, you know, the organization, the preparation, and then making it positioning yourself in a in a in a way that others

have also gone through this process and streamline and that streamline process, it always helps. >> You know, we're at such a unique point in this industry, right? I remember years ago when it was like CMMC is coming, you better prepare, you're behind. Well, now everybody's behind, right? CMMC is here, it's actively showing up in contracts. They're they're they're aligning point systems to it from an awards perspective. You've got timelines on contracts of all over the place and I think you brought up a really interesting point, right? So, as we talk about this timeline to completion,

right? You've got a plan for your readiness journey, you've got based on your scope, you've got a plan on tools and technologies you're going to implement, the time to implement them and and what you're implementing, right? And as you implement the appropriate tools like an eyeball, how much does that actually help streamline your efficiency of getting compliant? And then you got to get into the the hands of a C3PAO and all of us are booking way way out in advance. So, now you have to prepare enough to be ready, prepare enough to make sure that

you're in my queue and then be ready when you get to me and it's a unique time in industry because you're you're almost making like multiple buying decisions at once. You've got to make your your readiness partner buying decision, your tools and technologies buying decision, and even your C3PAO buying decision sometimes all at once to make sure that you can actually get on a calendar and not miss your dates. And I think one thing I'm really excited to talk to you about is like, you know, when when folks are using FedRamp compliant tools and and

and technology like yours to to streamline a lot of the efficiencies of this, it's like, what are they What are you actually seeing from a readiness perspective? Like, how much time or or whether it's a matter of days or hours or manpower or time to get compliant. Like, what are you seeing with your with your companies that you guys are supporting? How much quicker and why is that quicker for them to get compliant? So, when they do get to the C3PAO, I'm like, man, you guys are prepared, you did this quickly, and we're ready to

roll with you. Tell me a little bit about what you're seeing with that. >> Yeah, absolutely. You know, we we we start with a compliance mapping. So, we we've actually we have a control framework that basically maps the technology and the processes of what's covered, what's not covered, and then how to implement those types of things. But also, you know, one of the things I'm a big fan of is templated wizards, for example. So, you know, we have what we call the SASE setup wizard. And what that does is that once you run the wizard,

it basically configures the platform with all of the settings that are expected to put you in a good position to to pass your your audit, right? And you know, for those particular controls, those access controls. And so, I think you know, running running a SASE wizard cuts the time tremendously. Implementation, you know, one of the things around access controls, which cover over 50% of those of those controls within CMMC, they need to apply be applied everywhere, and that's a challenge. You have a remote workers, they're on laptops, you have them working in offices. So, I

think that's where also where SASE and zero trust come into into the equation, where it's this the the controls and the security follow the user. So once you implement that control, you don't have to worry about, you know, firewall setting that you set in the office that then you have to determine how you're going to implement that when the person works at home. It actually it actually works consistently and effectively in all scenarios. So just the reduction in time of having that type of technology that follows the user wherever they go is is dramatically cuts

down cuts down the time, you know, to get prepared. >> Yeah, let's back into this a little bit. I just want to back into like FedRAMP, right? So I just want to make sure everybody's aware of this. FedRAMP equals inheritance in the CMMC space, right? So when a cloud service provider, i.e. iBoss, goes down their own FedRAMP journey, whether that's FedRAMP moderate, moderate equivalent, FedRAMP high, whatever that may be, as long as there's a body of evidence, a SAR and a SAP that's produced from that that report and it's done through a free PAO, something

like what If Control Case does separate from our audit for CMMC, they think of like think of like FedRAMP is like up here, and then like CMMC is is down here. A lot of CMMC is inherited from the 853 controls into the 800-171 controls. So because they did their own compliance, and they got FedRAMP moderate or moderate equivalent or higher, you get to inherit So from an assessment perspective, when I start to talk to people about, "Hey, tell me about your tool stack." If they go, "Oh, I use an iBoss." And I might go let's

say I have no idea who iBoss is. My next question is going to go, "Are they FedRAMP?" Yes or no. There's no in between. There's no FedRAMP already. There's no whether going to be FedRAMP or they used to be FedRAMP. It's are they do they hold an active certificate, yes or no. And if they do, an authorization, then I can assume inheritance. And that's when Paul talks about this like 50-ish percent is fully inherited, and there's there's a piece that's shared, there's a piece that they don't touch. But what happens is when we assess you,

a lot of those controls, sure we still have to validate them, right? We don't You don't just get to kick them to the wayside, but we don't have to go into the rigor of validating those controls at the level we would have to do if they didn't have FedRAMP. So, I just want to be very clear about the value behind FedRAMP. When a cloud service provider eats their own dog food and gets FedRAMP, you as the organization gets to benefit by not only being able to not have to comply with the controls that they're complying

for for you, but when you get for the auditor, it's less the work for us. And turn, I'm able to be a little cheaper. I might be able to get your assessment done a little faster. And as we all know, it's it's a it's it's a game of time and money. So, I just wanted to back into that. And Paul, I'm I'm interested being CEO, like, what was that journey like? Or do you have any comments on like the value of like FedRAMP and how it's supported and why you went down that route? I would

actually love to hear that cuz it's huge. >> Yeah, absolutely. Yeah, and I think I mean, um you can't underestimate the value of having a FedRAMP authorized environment. And actually, when it comes to CMMC and implementing those types of controls, I don't know even know if that's optional, right? I mean, it's uh there's there's times of not just uh rigor in terms of um implementation, but also patching, maintenance, all of the things that go with that type of environment, um which which have to be maintained throughout the FedRAMP authorization. So, you know, uh a platform

doesn't become FedRAMP authorized and you're done. You're FedRAMP continuous you're continuously authorized and assessed. So, I think that this um this is really critical. Um I think that another big part of this is, you know, access to um technology that's FedRAMP authorized um can be pretty challenging. Um it could be very, very expensive. Um if you're if you're having to buy um lots of gear, lots of equipment. We all We all know infrastructure costs, memory, compute, firewalls, it become very, very expensive because of all of the AI data center builds that are going on right

now. So, you know, you look at the total cost of ownership or implementation, it's not just the speed because you can connect a users to a service that implements the firewall and implements these controls, it also means you've eliminated the need to purchase very expensive gear in many cases where you don't have the the cost to maintain, um, implement, uh, get it delivered, all of those things that go with it because, um, ultimately, you know, uh, once your CMMC, uh, once you get to your authorization, you're you're responsible for maintaining those controls throughout. So, if

you're if you're implementing and hosting your own firewalls, you're going to be responsible for ensuring that those firewall controls are continuously the firewalls are patched, they're continuously uh, being run, um, appropriately for the environment. Um, all of those things, uh, lead to, um, ongoing costs, ongoing maintenance, and ongoing time. So, it's not, um, I think I think we're, um, you know, where I would love to have double click on is this isn't a a milestone that you reach and become CMMC compliant and you're done. It's like any authorization, um, those controls are need to be

enforced throughout, you know, your your, uh, compliance. And and ultimately, if data leaks, like CUI data, they're going to check, right, to see like were the controls in place, uh, were you maintaining those controls? And if if that if that can't be, um, you know, proven, um, you can you can actually lose not only lose your contracts, but also, um, end up in a lot of other serious situations. >> You know, you hit on such an amazing point cuz as much as you have continuous compliance as it relates to your FedRAMP journey to make sure

you upkeep your FedRAMP authorization so that you can continue to support your client. You hit the nail on the head and it's an interesting topic to talk about, right? You have a lot of this community that's investing so much time and money into I need to be compliant. Well, then what? Right? Then then then then what, right? Great, amazing, you got your certification, congrats, huge accomplishment. Well, then you've got to remain compliant, right? And I think something I wanted to to to you about, Paul, is this idea of managed service providers and the community that

supports the organization seeking certification, right? You've got a lot of these providers. Whether you So, whether you're using an MSP or not, you're deploying tools to be CMMC compliant, period, right? So, once you get assessed, you can't change that, right? That's going to trigger a significant change. Well, let me You can change it, but it's going to trigger a significant change audit. So, when I think about things, uh making things easier for now and later, making things more efficient now and later. Remember, once you get audited, you have to maintain that program. And there's a

lot of efficiencies within the Eyeballs application and companies that have FedRAMP, cuz it's less you have to worry about. Because of that inheritance that you're undertaking from a FedRAMP compliant tool, you're able to focus on what you're responsible for, which instead of it being all of this, it might be only this. So, now you have less to worry about, you have less to maintain, that's less of a cost, less of the the amount of money you're paying your people to upkeep that, and there's less risk because every year in between your audit, you have to

self-assess to a 110, and then every 3 years you got to come see me, the big bad wolf. And every 3 years you got to make sure that you're CMMC compliant, and if something changes, you better tell me, cuz we might cuz we're going to have to do a significant change audit. So, one thing I wanted to talk to you about Paul was like this idea of the relationship with the with the MSP community. I know you do a lot of selling, if not the majority of your selling through channel. We do a ton of

selling through channel. They are the lifeblood of a lot of the things because most of the organizations seeking cert, these government contractors, have an IT provider, whether it's co-managed, fully managed, partially managed, they're just providing advisory, they're doing help desk. At some capacity, they My opinion, the MSPs are kind of running this GovCon world, and they either and a lot of them are playing ball, and they know they've got their own requirements they have to meet, and then they've got these clients that they've already been working with for years that they don't want to lose,

and that others are either trying to pick up. So, tell me what you're seeing with this MSP partnership in the community. I've got some thoughts on it, too, but give me a little bit about like, what's the ecosystem shaping into that you're seeing, Brian? >> Yeah, this is this is a big area. Um I think that um MSPs and MSSPs play a critical role in CMMC, implementing CMMC, uh working with customers, and actually it's one of the reasons why, you know, with iBoss we've um our MSSP platform is very, very suited and targeted to this

community. Um it's it's very difficult for a customer um on their own to implement 110 compliance controls. Um even harder to like ensure that those are maintained over time, right? So, um on the flip side, you have MSPs and MSSPs who they know how to implement those controls, but they just have limited access to FedRAMP authorized environments. Um the cost of capital for the types of firewalls you need are just very um out of reach or expensive. Um there's also shipping delays and all the other things that go with it, especially with the tariffs and

everything else going on, um and shortages. So, you know, making making the technology available to MSPs um is key, and I think um what this enables a uh a partner to do is once they've gone through this a few times, they they they go through the wizards, now they understand the process end to end, and they can use that as a templated approach on the very next customer. So, the both the partner and the customer benefits because they're they're getting a proven track record of implementing and getting past um your your audits, as well, right?

So, um you know, we make the technology FedRAMP authorized available uh to the Proof Partners. Once that's available to them, they're able to implement quickly. It's a cloud-based service, so they're not waiting around for shipment or um anything like that. Um they can implement very quickly. Um they can use the templated approach with the with the work workbooks and wizards um through that they get going right away. There's lots of There's lots of controls. Like just Just even going through the controls themselves and mapping them from scratch could be a lot of work. And then

it lines them really well for a control case audit, right? They're They're coming in with a repeatable process um that they know will work. Um it's Nothing Nothing um worse than going in uh thinking that you have solved the problem in the correct way just to find out that there's no way near meeting compliance and audit. Um it's the lost time and money. I could set you back tremendously in those types of situations. >> Yeah, I mean worst-case scenario you invest all this time, all this money, do all this work, you get to the auditor,

we don't even let you start your audit. We false start you. That is worst-case scenario. But one thing I wanted to kind of talk to the to the audience here, right? Just remember there's there's Think of external service provider as this big chart. There's actually a chart in the cap. You've got somebody like a Paul. They're cloud service provider. They have their own responsibilities. He mentioned it earlier. Sometimes you're not You have to be FedRAMP. You have no choice. You store, process, or transmit CUI and your cloud service provider, blanket statement, you need FedRAMP moderate

or moderate equivalent or no no no buts. Then you have to think about the managed security provider and the managed or the managed service provider or the managed security service provider. They're also in scope, right? So just to give a real-time example, and this is this happens between, you know, Control Case and Eyeballs and an MSP. MSP has client. Client needs help. They've been burned by another MSP. Client goes, "Help help help. I need to be compliant as quickly as possible or else I'm going to lose dollars on a contract. How do we do this?"

Right? MSP goes, "Hmm, if I orchestrate" I call them So think of the MSP plus a Control Case relationship is like the orchestra, right? So we need to orchestrate a really good team. Good team of trombone section, good team of drums, good team of flutes, right? Somebody like a Paul is a piece of that orchestra, but a really big piece, right? So, instead of having all these different tools and technologies that that play little baby parts of a of a full compliance journey, which is not the wrong way to do things, it's just sometimes a

potential expensive way to do things, harder to manage, blah blah blah. You and you implement something like a Paul, right? The iBoss solution, they take up a really big piece of the orchestra. So, now as the conductor, I'm able to work with the MSP to say, "Okay, you have these responsibilities cuz you also hold a seat in that orchestra. And you need to make sure you're compliant. And whatever your compliance is is dictated on the relationship that you have with that end client. And whatever tool set you deploy, iBoss plus whatever, could be GCC High,

could be all these other tools, whatever that may be, they need to also be compliant. So, that when you come to the auditor, whether it's me or another one of the 100-plus C3PAOs, you have everything documented down to a down to the T. Dot your I's, cross your T's, don't miss anything. All your tools are compliant, all your assets are categorized, all of your data flows are are are are diagrammed appropriately, everything is perfect. That MSP, in my opinion, needed to orchestrate that purposely and needed to make sure that they were compliant and had the

appropriate tech stack and was able to round out the situation. In my opinion, a really confident MSP that has a great partner and has great tooling around them will make uh the CMMC journey extremely successful. Those trying to cut corners, those trying to not deploy tools like FedRAMP compliant or authorized tools like iBoss and trying to cut corners, the MSP community will destroy your CMMC journey, period. I I don't know how else to say that, but one thing, you know, a lot of things that we could talk about is there's there's compliance complexity, technology gaps,

resource constraints, all that stuff. Like, at the end of the day, the value of having a good MSP that deploys solid tools and has the full relationship that can come to a C3PO and say, here's something that's repeatable, just like what Paul said, there is value in that. And there's real-time and cost savings that I'm seeing in real-time happen. Paul, did you have any final thoughts on that? I just This is probably the most important topic I talk about every day is doing this the right way the first time. >> Yeah, I mean, I I

I think you nailed it. It's the risk of going into your audit and and taking that risk where it your solution gets rejected because it wasn't FedRAMP authorized or something similar. It's the lost time alone is the is can maybe not be unrecoverable. May cost you the contract as well, right? But I think I think doing things right the first time is really the approach for anything really, especially when it comes to CMMC compliance. And you know, I I mentioned earlier, there's there's you know, there's 110 controls. It really does come down to access controls.

And having having a foundation that's a Sassy foundation or a Trust foundation that I I I think a lot of these, you know, when you when you think about all of the NIST frameworks that are out there, you know, a big component of what you know, the original NIST 800-171 was all about with access controls, they really trickle their way their way into all of these frameworks. And so, you know, one of the things that we really like is you know, having a a backend unified data plane like a backend unified service is important not

just because it's consistent security and visibility, but but also because any audit relies on consistent application of controls and consistent visibility in all scenarios. And so, when I see when I think of even solutions, there's a lot of solutions out there that are Sassy, they might even be FedRAMP, but you know, behind the scenes there's 20 or 30 products to make that possible. The The challenge you're going to run into is ensuring that the the compliance um your your implementation of the compliance control is consistent. And it's um the visibility, the logging, everything else that

that occurs has to be consistent in all of these different access scenarios, and that becomes really really challenging. So, um definitely um uh you know, the the combination of having the fundamental technology that then preps you for the audit, and so that you can get through that audit in a streamlined fashion uh to me is absolutely key. >> Tell me about some of the other frameworks that are out there, right? So, you know, a Control Case we audit and certify against everything, right? So, like I'm seeing a ton of crossover from CMMC, oops, I got

to be a 9001, whoops, I got to be 27001. Hey, well, now I got to be CMMI. I you know, I'm seeing everything, right? Especially in the CMMC space. I'm I'm seeing a lot of Well, if I want to bid on this contract, CMMC's a requirement to enter. Well, then all these other things are require are point systems. So, if I want to be the most competitive to bid on this contract, I want to hold all these certifications, and I want to maybe I have a one I'm a woman-owned small business, or I'm disabled, whatever.

At the end of the day, they want to position themselves as I'm I'm the I'm the go-to government contractor, pick me. I want to I want to Jake I want to you know, work with you, be your sub, be your prime, whatever. And what are you seeing from the Eyeballs world? You talked about a lot of the the the uniformity amongst these different controls. Like, how are you guys being leveraged to support yes, CMMC, but then support the broader compliance framework discussions that I'm seeing almost every company have? >> Yeah, absolutely. Like um and actually

as a platform, um when we look at compliance, ISO 9000, 27001, SOC 2, right? There's so many different um you know, types of compliance and controls. And but to your point, there's so much overlap between all of these frameworks. So, I think that as you meet the compliance controls um that you're seeing within CMMC, you're actually achieving a lot of the controls for a lot of other frameworks as well. So, you're actually putting yourself in a really nice position to meet a a few additional controls that then cover you for that next compliance. And I

do I do think that that's why um a lot of these when I think about a lot of these frameworks, it really does come down to controlling access to the data, controlling access to the flow of data, where it lands, um and those types of things. And I I think some of the things that actually get missed um is uh uh this uh this idea where it's just identity. So, if you can identify the person, like check their ID to make sure it's the person walking through the airport security checkpoint. But it really um you

know, authorization and access controls mean continuous, right? So, I need to know who you are, but I also need to make sure that the data as it flows is being tightly controlled by that person, right? And so, this is why, you know, when you when you think of zero trust and you think of SASE and these types of solutions, it's continuous adaptive access, continuous controls on the flow of data, continuous visibility. And that's why it also uh kind of bleeds over into so many other compliances because all of those other compliance controls are also doing

quite the same thing, checking um how tightly you're you're implementing your your controls, your access controls, access to the data, the access to the flow of data, as well. >> You know, I and I look, as we close this thing out, I I have to say to you, right? I have been extremely impressed with you as a as a leader of this technology company. I do have a little bit of background on some of your pretty cool clients you engage with. We don't have to talk about that here, but you've got pretty really cool enterprise

clients and how you were able to transition and support small business, right? And support them at the channel and and and make sure and say, "Hey, look, I've got this awesome enterprise tool. How do we make it available, cost effective, and actually support the broader government contractors that are out there?" So, I have to give you your flowers. I think it's pretty cool, and I think that's what attracted us to you guys uh as an organization is because you eat your own dog food. You have a repeatable process that from an audit certification perspective, my

technical team can trust and validate that you're doing your things right so that when it when a client comes through and they have eyeballs, ControlCase can go, "Ah, we feel a little bit more comfortable." Right? So, there's value in that. So, I just have to say like I'm really impressed with your not only your technical prowess, but the community needs help. And there's a lot of funding problems out there, but there's also a lot of money for them to make. And CMMC in my mind is a business differentiator. And I believe a lot of these

businesses that actually want to be compliant to support the protection of this nation, right? That's the goal of all of us. We're trying to protect the nation. We're trying to make sure all of our CUI that's been flowing internationally for years stops. And that that we can keep the protection of our of of our data here, you know, and and I believe tools and technologies that you that can support the journey of these government contractors that, to be honest, some of them were thrown for a loop a little bit and said, "Man, how am I

going to afford this?" Well, if they can leverage something like you guys to get to an auditor knows what they're doing and and has a great tool stack with a solid managed service provider wrapped around them, that's a really cool story to tell. Without And nobody's here to break rules. Nobody's here to cut corners. Our goal is to make sure you are in fact compliant. So, again, I just wanted to applaud you and I think it's pretty cool that you guys are investing and supporting this community and you put so much effort into the CMMC

community. So, I just didn't know if you had any final thoughts for the community out here in the in the in the broader people of like, "What's going on in your world and and and what's next?" >> Yeah, I really really appreciate that, Eric. You know, I think, you know, for us, like we love MSPs and MSSPs. And I, you know, when we looked at the space, you know, we've been servicing large to ultra-large customers, including the DoD, right? And you know, one of the challenges we saw is the access to the technology for the

such a large community of MSPs and MSSPs that can help a lot of businesses. There's There's thousands and thousands of businesses, over 300,000 that need help. And it's going to be the MSPs and MSSPs that are going to help them because they're out there their volume is and they provide the services in order to do the work. But, you know, the choices of tools that they had are very limited, either very expensive, very hard to get a hold of, lots of delays, and the high barrier to entry. So, what you know, we didn't nothing about

this has been watered down. We've made it what we wanted to do is make this accessible to this large MSP and MSSP community community so that they can get to work because there's a lot of companies that need their help. Right? So, we're we're really proud to service the community. We're actually very proud to partner with Control Case because the more the more companies that become compliant the safer the data is. I mean, I think that at the end of the day that's what's important. There's a lot of There's a lot of stake here. There's

a lot going on. You know, we know Mit is right around the corner, daybreak out of Open AI. There's going to be a lot of challenges out there in terms of access controls and ensuring ensuring that you know, you're working in a in a secure environment. And so, we're we're just really excited to be part of that, try to be partnered with Control Case to do this as well. And excited to be partnered with the MSP and MSSP community to provide them the technology they need to do their thing. You know, they know what they're

doing. They can They can make a difference and we're we're proud to be to be part of that. >> Yeah, and I echo that and I'll pass it back to our fearless leader Josh. We appreciate the opportunity here. We appreciate you know, working with the iBoss team. Look, our value is obviously from an audit and certification perspective or the professional services side getting ready, right? So, when we get to work with really cool people like iBoss to make the the conversation and the engagement smoother, quicker, faster, more efficient, that's a conversation we want to have

time and time and time again. So, I appreciate being part of this. Josh, if you have any closing thoughts or statements, I will leave it to you to close this puppy out. >> Hey, look guys, that was fantastic. Thank you so much. There's chaos going on out there. There's so many companies trying to get ready. Anytime we can help educate people to make this easier, save time, save money, save stress, the things that you guys talked about, the better. We We have a lot of questions that are waiting for you, and I'd like to make

sure that we at least get a few of those answered before we run out of time. So, the first question, this one goes to you, Paul. It says, I'm an MSP. How can this best help me get my customers ready? >> Yeah, it's pretty simple. We have a workbook and and wizards, right, that give you all of the controls, the 110 controls, and map them out to 50% of those controls. It's actually pretty a pretty substantial number of those. So, you can actually get started pretty quickly in terms of leveraging our tools, our enablement, in

order to get started. Once you get approved, you have access to the technology. You have a FedRAMP authorized environment where you can start implementing those those controls and get going pretty quickly. >> Awesome. Thank you for that, by the way. Sorry, I had to look at my screen to read the questions. So, this one I might go to either of you. I'll figure out who wants to answer. It says, can you go back to the significant changes? How does this help? >> Yeah, so I'll address that, right? So, I believe if you have the appropriate

tech stack and the appropriate scoped environment on the front end before you get assessed, your goal is over the 3 years in between your audit to keep it consistent and make sure it works for you, right? So, the biggest thing is I hear it all the time, these companies say, oh, I'm just going to stand up a quick little enclave, but that's never going to work for me. So, I'm going to get my certification, and then I'm going to change everything. And I'm like, what? Where are you Why are you doing that, right? So, if

you're able to make sure on the front end, you build an environment with the appropriate tools and technologies that actually works for your business, no need for a significant change. Get your audit state consistent, self-assess every year, leverage a great application, have a great partner that supports you, and come back every 3 years to get reassessed in an environment that works for you. That is how that that's my take on your question. Josh, what what what is your thought on that? >> Yeah, absolutely. I think um having a good foundational architecture that covers the core

of your business, you know, you're you're likely running a business already, so you want to make sure that that business can continue to operate and ensuring that you're encapsulating all of those um uh access points and controls will be I think fundamental in terms of remain remaining compliant and getting getting getting assessed and authorized um at the right with the right without having to do a significant change effect, you know, change request later, you know, which is which is uh problematic, of course. Um all right, the next question, I think, Eric, it has to be

going to you. Is that Pokémon behind you? >> Yeah, so, you know, in the CMMC space, we're here to protect Pokémon. Uh not controlled unclassified information. No, it it is It is a a passion of mine. I am a 33-year-old man that loves cybersecurity, golf, and Pokémon, and Legos. I I am who I am. >> E- even with the small picture on the window, people must have actually gotten a chance to to to recognize that. All right, Eric, uh this question uh really does, I think, go more towards you. Uh do I get to go

into the room with my client? >> So, um are you talking from an MSP perspective? >> Well, it it sounds to me like they must be an MSP and and it sounds like they're talking about, you know, it's it there's an assessment going on. Can I be a part of it? >> Th- Look, here here's what I'll say. If you are an MSP and you are actively in scope of your your client's assessment, you kind of have no choice, right? And it's it behooves you to be a part of their assessment for a couple of

reasons. One, when that question goes and that assessor goes, "Well, how are you compliant with X, Y, or Z?" Well, if the client goes, "I don't know." You're there to answer that question, right? And you need to be able to be not only documented appropriately in a shared responsibilities matrix, it needs to be included into your client system security plan, but it might need to be validated on site. However, you produce artifacts or evidence, whatever that may be, if it's if it's showing showcasing the Eyeballs platform, if it's if it's validating the inheritance from them,

right? There is a value for you to be there to have a stake at the table, right? And that's why it's really important to make sure you have educated people on staff, you have the right partners surrounding you, and you have the right tools surrounding you, because you do not want to go to that audit and go, "We do that?" That's not a good enough answer for the auditor, right? So, can you sit in? You should sit in. There's no Unless your client says I don't want you there, which again, it's the client I don't

want. You want your client to say, "I want all of us to have a seat at the table." And it behooves you to be a part of that conversation. >> That makes a lot of sense. Thanks so much, Eric. All right, that's all the time we have today for our webinar. I hope you found it useful. I I have such gratitude for Paul and Eric for being a part of this. Um we didn't get to all the questions, which is kind of cool, uh but we've got more that we have to answer, and so we're

going to address those in email. Uh the second thing is that we're going to be sending out the slides and the recording of the webinar uh to everyone that was a part of this. You can also find information about this at controlcase.com or eyeballs.com. There's information about CMMC, about SASE, about other regulations, and how to navigate some of this chaos. I want to thank all of you for spending time with us today, but most of all I want to thank Paul and Eric. Thank you for all of the wisdom and experience that you shared with

us today. I really appreciate you both. >> Cool. >> Yeah, absolutely. Yeah, great to be here, Josh. All right.