← Sum IT Up: CMMC News Roundup
Loading summary
Transcript46 lines
- [00:00]
A
All right, folks, it is May of 2026, and it is milestone season. We are officially six months into CMMC Phase 1. Summit 7 now has 100 CMMC Level 2 certified clients. Summit 7 was also recently awarded a contract with the Army's ENCODE program, providing a solution to the price problem that NIST, SP 800, 171 and CMMC poses for hyper small companies. And for the first time ever, believe it or not, on the Summit up podcast, the great And Powerful Summit 7 CEO Scott Edwards is here to join us. That's what we're going to talk about today. Scott, I was checking the notes. We've had you on the hotline, we've had you on webinars, we've had you on stage, we've had you at conferences, we've had you@Summit7live. I actually didn't realize that we had never had you on this show before.
- [01:04]
B
You know, what does it take to get an invite to the podcast?
- [01:07]
C
I mean, it's about time you've done something important enough for you for us to invite you on and talk to you.
- [01:12]
A
It's a very exclusive invite.
- [01:14]
C
Congratulations on the accomplishments, Scott.
- [01:17]
B
You know, we were talking, we were talking pre show, you know, it's taken me, what, 150 episodes to get on here, and then like Holly Flanner gets on here. Like,
- [01:27]
A
to be fair, Holly, Holly does run the show behind the scenes, so it's understandable that she might have jumped to the line in front of most people. But hey, better late than never. And, and, and like I said, it is the, it is the season of milestones because, boy, do we have a list of things that Summit 7 has accomplished to talk about. But since this is your first time on the show, you know, you've been around for a long time, you're on the road all the time. But a lot of people in our audience may not be familiar with your origin story or Summit 7's origin story. I get this all the time. People don't realize, I mean, I've been with Summit 7 now almost five years, but they don't realize that Summit 7 has been around for a lot longer than that.
- [02:08]
B
Yeah, we've been around a lot longer than that. So Summit 7 started back in 2008. So we're coming up on, on year 18 here in about literally a month. So June 7, 2008 was kind of our founding date, if you will. So, yeah, coming up on 18 years. The first eight years of the business, I would say, were really focused around data management and Information management consulting, specifically around the SharePoint platform. And then in 2016, we started pivoting specifically into this market that we've been doing for the last decade around NIST 800, 171, DFAR 7012, and then ultimately CMMC. So we've been at that game now for. For about almost a decade, which is wild.
- [02:54]
A
Yeah, yeah. And. And obviously, I think, you know, there's. It started out as a small shop kind of for a long time, and you guys sustained the business for a long time as a. As a very small business. And then recently we've experienced significant growth, extreme growth. I think we're over. We're over 300 people now. I mean, was that what you. Was that what you imagined when you guys were in the. In the garage band phase?
- [03:22]
B
No, not at all. I mean, you know, we're approaching 350 employees now, and I would, you know, for the first 10 years, really, we. We hovered, you know, I would say from year two to year almost 9, 10, we were in the 25 employee range, and we pretty much hovered there for many years. And then 2018, 2019, we really started growing significantly. You know, I never really thought the business would. Would be to the level that it is. You know, it's really a credit to the fantastic team that we've been able to build. You know, people like Jason and Jacob and Joy and, you know, Caleb and all the different people, you know, behind the scenes that are making things happen for our customers. So. So, yeah, credit to you guys. Without that, you know, there's no way we would be where we are. So it's been a. It's been a wild.
- [04:11]
A
Yeah. He's a humble man, folks. He's a humble man. So let's.
- [04:15]
C
I mean, when that wild ride was going on, I, I knew. I know that at no point you expected that you would have to get some sort of certification to kind of prove what security were there. I knew that that was a standard which you upheld personally. And then I knew from. Or. And I know from the initial conversations, the strategy has always been lead by example and get the certification. Do you mind talking about, like, some of the experience that we had as an organization getting our own level 2
- [04:41]
A
search, both of them.
- [04:43]
B
Oh, wow. Yeah, it was. It was a very interesting ride. We started working, you know, all the way back to, I would say, 2017, as we were starting to launch and build our own managed services offering that we launched in May of 2018. You know, we started sitting down in. I guess it was October of 2017, Daniel Akridge and I sat down and started kind of mapping out what we wanted our managed services offering to look like to meet these NIST 800171 requirements that were out there. And that was really, I would say, the beginning of our journey to CMMC certification. As we started building out the tech stack that we would need to meet the requirements set, how we needed to modify our internal processes, our internal tech stack to meet the requirements. And that was really the first iteration of us getting there. And man, we had no idea what we were doing. We were just figuring it out. Right.
- [05:44]
C
So was everybody.
- [05:45]
B
Yeah, I mean, we were just trying to figure it out because we had a government contract at the time. And so we knew that we had to meet these requirements because we had the D4 7012 calls in our contract. And so we knew we had to meet them. And we were a Microsoft partner. Right? We had free licensing from Microsoft, which is what we were running the business on. And I was like, I've got to figure out a way to meet this requirement with the licensing we have because we're broke. That's what we did is we tried to figure out how we can meet. Initially it was how do we leverage the Microsoft licensing that we had available to its fullest extent so that we don't have to spend a lot of money. And that was honestly kind of our first, first iteration of what we were doing was, was, was driven by that and we had other customers that were asking for the same thing. And so, you know, that was the first iteration. I would say that our documentation set probably went through at least half dozen full iterations, maybe more than that between 2017, 2018 and, and when we got, when we got our certification completed. Completed. So, you know, we went through almost yearly full rewrites of our documentation. And then as we built out the tech stack over, over many years, it got better and better and better every iteration. So it was definitely a long, long, you know, run Runway pathway for us to, to get to where we are today.
- [07:17]
C
So was that those rewrites, was that based on like the growth of your knowledge internally as an organ or our knowledge internally as an organization or based off of like, changes and ripples in the actual certification that you were trying to achieve or both.
- [07:31]
B
It was really based on our, our knowledge of, you know, what was required. You know, I'll, I'll be completely honest, Jacob. You know, you always say this. The first time that we wrote it, we did not know about 171 Alpha we did.
- [07:46]
A
I mean it's. Yeah, I mean and so we wrote
- [07:49]
B
our first set of documentation back in 2017, 2018. It was written to 800171 without any of the assessment, objective, level, detail. And so then we figured out, oh wait, there's this other thing, we've got to go right to that. And so, you know, hit, you know, my target from a tech stack standpoint had always been, you know, fedramp everything. You know, I personally always high watermark everything from a security, from a compliance standpoint. And that is what really, I think really allowed us to build the environment necessary to support clients was high watermarking everything. If we had tried to minimal minimize the impact to our tech stack, to our processes just to get across the bar, I don't think we ever would have gotten to where we are. But the fact that we high watermarked everything that we did around hiring with U.S. persons, U.S. citizens, around, you know, you know, Fedramp, moderate Fedramp high for all of our tech stack, it didn't matter what piece it was. We didn't have the, there was no definition between SPD and CUI assets at the time. Right. It was, you know, we treated everything essentially as a CUI asset. It didn't matter what it did if it connected to the environment, you know, it had to meet the standard. And that is something I think that really set us up well for, for long term growth.
- [09:10]
A
Well, I guess talking about that, that philosophy. So just to Clarify, we have two Level 2 certs. We have one as the arm of Summit 7 that does government contracting, which I think some people don't know that that is true. And then we have the Level 2 cert as a managed service provider to other contractors on service delivery. And that is not actually required by the regulation. And we still went after it anyways. Do you want to maybe explain why you did that?
- [09:39]
B
Well, we believe that, you know, I've always believed that if we're going to support, you know, if we're going to support customers in this, that we need to walk the walk as well. And so, you know, we treat Summit 7 essentially as a customer of our managed services offering. So our managed services offering, Guardian Vigilance Commander is kind of the core. And then Summit 7 corporate essentially leverages services just like our customers do out of Guardian Vigilance Commander. And that would be our, you know, our corporate certification, if we will. So we have a managed services certification and a corporate certification. And the corporate certification is what we use when we're doing government Contracts, for example, you know, we. You mentioned in the opening a little bit about us being awarded the ENCODE contract. Well, the encode contract, we use the corporate certification as. As the certification for that encode contract. Now the managed services, that's, you know, that's where we're delivering it out of. But, you know, from a company standpoint, it points to our corporate certification. So it just kind of depends on, you know, what we're doing, on which one is relevant. So we do have a couple government contracts. We've been working at Missile Defense Agency here in Huntsville for over. For, I guess over a decade now, actually, through a couple different contract, you know, contract iterations.
- [10:59]
C
I gotta go.
- [11:00]
A
I gotta go talk to Dustin after the show. And we need a. We need. We need a shirt with your face on. It says CMMC is so nice. We did it twice around Summit 7,
- [11:08]
B
so maybe that's for joy.
- [11:14]
A
Well, so we got this. We got the Level 2 cert for service delivery, even though it's not required by the regulation with the intention, like you said, of servicing clients. You want to talk about that process of achieving the First Client Level 2 certification. That was a big milestone. And we're already at 100. So what was the first one like?
- [11:34]
B
Yeah, I mean, you know, we had been doing DIBCAC highs. You know, before there were CMMC certifications, we had dibcat, DIBCAC high certifications going on as we had customers going through those. So we had been through assessments previously, not with C3PAOs, but with DIBCAC. And so we had built a little bit of expertise there, you know, just by going through those various DIBCAC highs. I think we probably did, I don't know, half a dozen to 10 DIBCAC highs prior to any CMMC certifications kicking off. And so that did give us a level of comfort with the process, because the process is, you know, there are some differences, but the process is very similar from, you know, between a DIBCAC and a C3PAO. There's a lot of similarities in what they're looking for. So that gave us some capability to really be better prepared than someone just walking into their first CMMC C3PAO assessment. So that was very good. You know what I would say the biggest impact or shock, and shock may be a little bit too strong of a word, but when we started doing multiple assessments in a week, that got really, that really stressed the team. I think we had one week, I want to say it was last July. Last July we had a week where we did. I think it was four or five assessments in one week. And that was really challenging. We were not. And we found this out, you know, after we got through it. We were not really appropriately staffed to stat to support five concurrent assessments and support our managed services clients at the same time. Because the engineers that were working, you know, customer tickets and, you know, customer things that were happening within their environments, the same engineers that were needed to actually, you know, sit in the room and go through the assessment with those clients. Right. And so that really caused some problem, you know, from an operational standpoint within the business of us being able to maintain both, you know, service levels with our customers as well as get through assessments successfully. And so that, you know, that dictated a change that we have implemented over the last six months or so, where now we literally have a staff of engineers who all they do is assessment work. So not only do we have like the assessor type people that are supporting customer assessments, we now have engineers who previously were sitting on our managed services team who understand the implementation, all the technical aspects of everything. We've had to build an entire staff of what we call assessment engineers that sit over in our commander team now to literally do nothing but get customers through assessments from a technical standpoint so that we can maintain service levels on the managed services side. And that was a big change simply. That was simply driven by volume. And, and that's proven very successful. And we'll continue to scale that out over.
- [14:57]
A
I mean, just. Just to put this in perspective, you said last July. Right. So no, November of 2025, CMMC, you know, the rollout starts by July. We were doing multiple concurrent assessment support activities for clients per week. Yeah. So it's not really any surprise that now in May of 2026, like, halfway through the phased rollout, we're at 100 Level 2 certified clients. So we have the capability to support multiple assessments per week. And it's only sort of expanding from there. How do you feel about this century mark here with 100 certified clients and growing? I mean, there's assessments going on all the time.
- [15:44]
B
Yeah, I think it's a great. It's great for the ecosystem as a whole because every single time we get a customer through that assessment, that is another link in the supply chain that can allow our, our primes and our subs to work together to deliver for the Department of War. Right. And every single time one of those customers gets assessed, they are now unlocking the ability to deliver their goods and services, to do and, you know, continue to support the Warfighter. And so, you know, I, I think that we're over 1200 now. I think that was the, the last number that was put out in the
- [16:19]
A
last 1240 as of end of April.
- [16:21]
B
So 1240 by the end of April, 1240, you know, companies that can deliver for, you know, Department of War is significant. And it's going up, you know, 100. I think it's going up close to 100amonth now. It's over.
- [16:35]
A
It's over, on average is 133amonth since January. Yeah.
- [16:38]
B
And so that's fantastic. Right? So you're looking at, you know, what is that, 40 a week? Roughly 30 to 40 a week that we're getting now. And so, so now, you know, at 1240, we're over 1% of the identified DIB from the final rule, at 118,000, I think, was the number in the final rule. So we're over 1%. We're doing, you know, 30 to 40 a week. That's going to continue to grow, you know, for the ecosystem as a whole. And all that's doing is building the capability of our, you know, of our defense industrial base to deliver in a secure and compliant manner for, you know, for the Primes and for the Department of War, which is what we're all here for. I mean, that's what we're here for. I mean, we see what's going on in Iran, we see what's going on around the world. The demand for the services that these contractors, these Primes and subs are delivering is not going down. We need to get more of them in the ecosystem as fast as possible so that they can continue to deliver what they're delivering for the Department of War, so that we can continue to prosecute the US's foreign policy around the world.
- [17:49]
C
So you talked about getting multiple people through as quick as possible. Right. And so when last July, when we got those multiple assessments, that was a shock. That was the first time it was experienced. Now, that's the regular, that's the norm, you know, and I think that that's the norm across the board. But another thing that we had talked about and we had hinted about in, in the intro to the show about being awarded the encode, you know, program, and that what that program represents is really an avenue to break down some of that barrier for innovation, to keep bringing those companies the dip. Do you mind talking about that program and kind of what it means?
- [18:23]
B
Yeah, that program is, you know, I think it's a fantastic opportunity for the micro businesses. And when I say micro businesses. I'm talking one to 20 employees, right? These are businesses that have, you know, they typically have great ideas, potentially great, you know, hardware, software, services, solutions, but they don't necessarily have the scale internally to be able to build and maintain these infrastructures themselves because they just, you know, they are doing their science or their engineering or whatever it is that they're good at. They don't have a built in, you know, IT capability and compliance capability. And so they need help. And so The army and DoD, Dow recognized that. And two years ago, and they announced the ENCODE program that we've been working, you know, with the army on now for almost two years. It was awarded obviously, you know, very recently. And the great thing about it is that the target for that program is to support 6,000 businesses. So their goal is 6,000 businesses, you know, small businesses to be able to be supported. And that is going that, you know, that's a game changer. And it's also really the first time that there's been credible dollars from DOW put behind the requirement set. Right? And so now you've got a situation where army has set aside dollars to support army contractors. They've opened it up so that the other components, Navy, Air Force, Marines, you know, missile defense, whoever, can put money against this contract vehicle for their contractors, and they can use it to, you know, to acquire the services of the ENCODE awardees as well. And so, you know, army said they're doing it for 6,000 Navy, Air Force, Marines, et cetera, could decide they're going to do it for however many thousands that they want to do it for. And so it's a fantastic opportunity for the micro businesses to really leverage an enclave solution. Now, enclaves aren't going to work for everybody. We've had that conversation in multiple formats over many years. So enclaves aren't going to work for everybody. But we believe we have a solution set that we've architected and designed that is going to be flexible and is going to allow, you know, small businesses to get what they need in a very fast timeline compared to building out their own environment or, or, you know, enclave or going what we call all in and uplifting their entire infrastructure into, into an 800171 compliant environment. So it's, it's, it's a really great opportunity for the micro businesses.
- [21:05]
A
Let's. Scott, this sounds, this sounds nice and all right, but let's, let's just, let's just cut to the chase here. Summit 7 only helps big businesses, right? Summit 7 only helps large enterprise clients. We don't help small businesses. Right. This is the, this has been the reputation that honestly feels like has been garnered over the years because the service delivery is just pretty mature. And we got 100 L2 clients. But those 100 clients, this encode program, you know, we work with these small businesses more than we work with the large businesses. Right. I mean, that. You want to maybe talk about that?
- [21:41]
B
Yeah, I mean, we, you know, we, we work with businesses across all size and scope. Right. And I think ENCODE is just going to, you know, enhance that capability. You know, we've been, we've done, you know, small. We literally have multiple businesses that are under five employees that we've been helping for years. And so, you know, that is, that is pretty standard and pretty, you know, pretty part and parcel of what we've been doing for the last upcoming, a decade. But yeah, I mean, we also help the big, the big businesses. You know, a lot of the large, you know, what we would consider very large businesses, you know, they go into Enclave Solutions because, you know, they, you know, they are large commercial organizations that, you know, they have just a division or, you know, or what have you of their business that does DoD DoW work. And so they're building enclaves for that work. And so those enclaves in many cases aren't much bigger than small businesses. They just happen to be tied to a really big logo. Right. And then on the flip side, you have, you know, what many would consider smaller businesses, but that are all in.
- [22:42]
A
Right.
- [22:43]
B
That all they do is DoD DoW work. And so their environments are larger than some of the multinationals that are out there. And so it really just depends on the specific need of the individual company. But we've got, you know, customers that we're supporting all the way down to a couple users, up to thousands of users. Users, right. And, and you know, every customer is a little bit different.
- [23:06]
A
Yeah, absolutely. Well, everybody, I mean, this Scott's first time on the show and we're supposed to be here just talking about 100 clients. And I feel like by the time, by the time the show's done, we're gonna have a hundred more. What do you see coming up by the end of phase one, end of this year, for Summit seven, for the ecosystem? What's your perspective moving forward here?
- [23:26]
B
Yeah, well, we know that we already have, I think north of 60 more scheduled through, I think the end of third quarter ish right now. So it's not slowing down. It's just going to continue to accelerate. So you know, potentially by the end of the year, we're talking about, you know, having 200 done. You know, we'll see. We'll see where we, where we get. But, you know, yeah, I could see us doubling, you know, we're sitting here in May. I could see us doubling over the next seven months and getting to 200. So it's certainly something that I don't think is slowing down. I think ENCODE is definitely going to accelerate that. I mean, they're talking about 6,000 businesses in the ENCODE program. And so we're working on how do we streamline that, how do you execute? There's eight awardees on that contract right now. If they are evenly spread, and it's only those 6,000. You're talking about 500 per awardee. I guess that'd be 750 per awardee. And so, you know, how do you streamline so that you can support 750 assessments over the next year for that set of small businesses? And that is one of the problems that we're working on right now. And we believe we have a good idea about how to execute that. But it is, it's definitely, you know, a scaling issue. And scaling is really going to be, I think, the word for the next 24 to 36 months across the whole ecosystem. You know, we're not talking about, you know, you know, doing an assessment a week. We're talking about doing, you know, potentially dozens of assessments a week.
- [25:07]
A
Yeah, absolutely. Well, folks, like we said, we had a hotline recently with the, with everybody from the assessment support team. So we'll make a link down to that below. We'll make a link down to the ENCODE program and how you can find more. Find out more about it on the 77 website. You've seen Scott on the hotline. He's there all the time. You've seen him on the road, you've seen him on stage, first time on the show. So let us know if you want him to come back because we'll listen to what the comments say. Scott, thanks for sharing your perspective and everything that's going on, and we hope that we'll have you back soon.
- [25:41]
B
I look forward to it.
- [25:42]
C
Great.
- [25:43]
A
All right, thanks, everybody. We'll see you next week.
- [25:44]
C
See you next, Sam.