← Sum IT Up: CMMC News Roundup
Sum IT Up: CMMC News Roundup
What 2,005 Votes Revealed About Why Organizations Struggle With CMMC
00:20:47
Loading summary
Transcript40 lines
- [00:00]
A
All right, folks, it is June and the votes are in. Two months ago, we started with a simple question. What is really causing organizations to struggle with cmmc? You'd think it would be a pretty easy answer, but we got a ton of answers and we turned those answers into a tournament bracket and let everybody vote over on LinkedIn. So after every eight matchups, more than 2,000 votes, hundreds and hundreds of comments, we read them all. We finally have a winner. In first place, leadership buy in by a landslide was voted as the number one issue causing organizations to struggle with cnfc. In second place, bad guidance, snake oil fooling people about what the actual solutions and paths forward are out there. Very, very strong support from the voters for, for option number two. And in third place, CUI Confusion. What is cui? It's marked, it's not marked. It should be marked, it shouldn't be marked, so on and so forth. Always going to be one of the favorites for coming in the top three. It finished in third place. After looking through the comments, after looking through the voter migration trends, after looking at the voter coalition analysis, which I found particularly interesting, I think the results tell us something important. The community, not us, not our blog, but everybody on LinkedIn voted, almost a thousand people. The community repeatedly voted for upstream organizational issues over downstream technical issues. And that's what we're going to talk about today. Jason.
- [01:49]
B
Hey buddy.
- [01:50]
A
Is bad guidance? Is snake oil the core problem? Or is bad guidance and snake oil? What happens when leadership just wants shortcuts? I think that's really the million dollar question here.
- [02:02]
B
Yeah. To quote the great Julius Campbell, attitude reflects leadership, Captain. And realistically, when it comes to cmmc, the leadership reflection, if it's poor leadership is a poor implementation and all of these downstream things that were in this bracket are realistically things that a good leader nips in the bud.
- [02:27]
A
Couldn't have said it better myself. I couldn't have said it better myself. Yeah, I don't know. I mean, you paid pretty close attention to this tournament all the way through any high level takeaways. Were you surprised? I mean, does it play out? I mean, my bracket was in shambles by the time we got to the end here.
- [02:43]
B
I, I was hoping that I was going to use my wife's strategy for her March Madness brackets and pick the prettiest uniforms. Right. When you, when uniforms were out the window, Jacob, I, I started thinking about the things that I see the most in conversations that I have with people on the dip. And what I realized was, is that I was automatically taking all of those problems that were coming to me over the phone. Teams, whatever it may be, LinkedIn what, whatever it is at surface value as this is the problem. Yeah. Not realizing that there is a root underlying cause. Right. You know, like I'm dizzy all the time. Well, there's a brain tumor or something like that. Not to be, you know, insincere, but like that. What my biggest discovery through this bracket was is that I, I wasn't digging enough to the real root cause and at surface value, thinking that people fully understood what their problems were to begin with.
- [03:31]
A
Yeah, well, I mean, I think that's probably most people because, you know, the, the way that the options were seated throughout the tournament, leadership buy in was not the number one. Whenever we took the initial survey for what the field should look like, but it ended up winning.
- [03:45]
B
Is this one of those situations where post tournament you're like, yeah, the, the, the matchmakers didn't seed this appropriately?
- [03:52]
A
Yeah, it might be. Yeah, it could be that, you know, post tournament clarity is real, folks. Anyways, let's talk about tournament statistics, get everybody caught up. If you weren't paying attention to LinkedIn posts for the last two months, some tournament statistics, a quick sense of the scale of, of this thing which kind of got out of control. Honestly, it was way more popular than I thought it would be. Over the course of eight matchups, the community cast 2,005 votes. We had 907 unique voters participate, which was wonderful. Thanks everybody. The highest turnout matchup was leadership buy in versus scoping with 302 votes. The closest matchup was confusion about CUI versus scoping, which was decided by just two votes. 120 to 118. I think maybe the most interesting thing, only 11 people voted in every single poll in all eight matchups. So the results here weren't driven by the same small group of people constantly voting for leadership buy in. The tournament reached a sort of broad rotating audience over the course of two months from post to post because that's the way the LinkedIn algorithm works. So this wasn't like one group of highly motivated voters pushing this one thing through. Different groups of people consistently voted for leadership buy in to win in the end.
- [05:17]
B
Was there any situations where like one matchup an opponent got absolutely steamrolled?
- [05:22]
A
Yeah, I think the biggest blowout was snake oil over cost in round one, which definitely surprised me because I thought cost was going to run away with it because I mean, that's all you hear about a lot of times is cost, cost, cost. How much do things Cost, but it, it didn't even come close. I think that was the largest blowout out, out of all the matchups that first round.
- [05:44]
B
1:1, 1:1 verse 16 gets him every single time.
- [05:48]
A
Every time, Every time some three point specialist from some no name Midwest school bumps off a top five seed or
- [05:55]
B
the Gulf coast is just throwing alley oops all over the place and down goes right? Absolutely.
- [06:01]
A
All right, quick recap on the field. If you didn't know who the options were for, for voting in the initial round here, you know, this is who was competing. So the Original field of 8 was leadership buy in, bad guidance slash snake oil, confusion about CUI scoping, cost, timeline and unrealistic expectations, knowledge and skill gaps, technical execution or applicability and flow down. That was based off of the more than almost 400 comments that we got on the initial survey that we asked people about what are the largest issues. So out of that, you know, initial group of eight, some of those are organizational challenges, some are implementation challenges, some are technical, some are contractual. In the end, everybody who voted had largely sorted all of those things into two categories, what we would call symptoms and causes. And that was pretty much the story of the entire tournament was symptom versus cause. And then in the end the causes won out.
- [07:05]
B
Yeah. So like it's kind of like saying you said symptoms and causes. Like there were multiple. Like realistically I feel like that this is like you don't get enough sleep, so then your health starts to decline and other areas start to suffer and then that sleep is inadequate. Leadership buy in. You know, like the leadership is not sleeping enough. And now we're not running the mile quite as fast as we used to. Our appetite. Appetite isn't quite as good. Xyz. Well, in this case it's. Our scoping is completely blown out of proportion. We have some guy in here telling us there's still five levels of CMMC help us. Right, and that's literally what's happening right now.
- [07:39]
A
Yeah, yeah. And obviously, obviously, I mean, we know these are a little bit silly because we're asking for binary selections amongst a bunch of things that are all interrelated. But it's just for fun, folks. It's summertime, you know, you know, the, the Knicks won, the Hurricanes won, thank God. And so, you know, we, there's not a lot going on, so we're coming up with our own tournament here. So we know these are all interrelated.
- [08:02]
B
It's just you, you really hold those grudges against the team that eliminates your team from the tournament, huh?
- [08:06]
A
I mean, it's just. Yeah, it's that. We got to subscribe to our other channel for more hockey analysis. Anyways, let's talk about leadership taking the whole thing. So Leadership Buy in didn't just win the tournament. I thought this was the most interesting thing because we have access to who voted. It built the largest coalition of voters throughout the tournament. So Leadership Buy in defeated Snake Oil in the championship round, 143 votes to 84. But I, like I said, I think the coalition is more interesting than the score. So almost everybody agreed, especially in the comments, that snake oil is absolutely real, absolutely a real problem. There wasn't really a debate about whether snake oil was a problem, but the commenters kept coming back to is bad guidance the problem or is bad guidance more of a problem when leadership wants to take shortcuts, Leadership hesitated, they gambled. They waited until CMMC became a thing. Now they're on an incredibly short and arbitrary timeline. And so they are more susceptible to, to getting fooled by bad guidance and snake oil, by these miracle cures, because you need 6 week abs instead of taking 6 months to get through everything. You know what I'm saying, everybody? Anyways, some more information here about voter migration, right? So the voter migration data of how people moved from one option to another really sort of supports this idea that they said leadership taking shortcuts is what makes people susceptible to bad guidance rather than the other way around. So the data basically said that leadership didn't win because leadership voters kept showing up over and over again like the same core group of voters. Leadership won because voters from other camps in the early rounds moved towards leadership and then started voting for that. Right? So for instance, CUI confusion voters moved heavily towards voting for leadership rather than being split between leadership and snake oil. The third place voters almost all leaned towards voting for leadership over snake oil. So this was scoping versus CUI confusion. And then even some of the original snake oil voters in the domination first round over cost ultimately voted for leadership in the finals. And that's, you know, a big deal because if snake oil were the root cause, then the voters for snake oil would have stayed voting for snake oil all the way through the tournament. But many of them didn't. A lot of them migrated over time to voting for leadership, which I like to think is probably because of the conversations and debates that were happening in the tournament. I mean, this was two months of time, so people had a lot of time to think and reflect on what was going on. So it seems like, some people, you know, change their positions a little bit, which is great.
- [10:56]
B
Me, I'm some people. And there's no other way to put it, Jacob, kind of the way that you described it right there, as the bracket emerged and we voted in this bracket because, again, we weren't trying to facilitate the votes or anything like this. We just wanted to see how it turned out. And so as my votes started taking place, I was kind of really, really bent on scoping, I think was my number one seed. I. That's one in the tournament, no doubt. But then as it went on and as I saw the conversations happening and as I thought about it more, what I said at the beginning of the show kind of started to. To make sense to me, is that I was looking at things on surface value and not realizing that it was a much deeper problem. It was a much more systemic problem attached to it. And that discovery happened. And I think that as the numbers show, it happened for a majority of the people voting, and then those people, as things that they were rooting for, lost in their respective matchups. Where do I go with my vote now?
- [11:52]
A
Right.
- [11:52]
B
Like, who am I backing?
- [11:54]
A
Yeah, absolutely. I mean, I know a lot of my and my bracket was influenced by what I hear on calls every week. It was cost. It was timeline. It was things like that. But what I realized over the course of the tournament was the people who aren't calling us are the people whose leadership hasn't enabled them to call us. And so there's way more of the people out there who would like to get on the phone with somebody but just haven't been given the. The green light to do it. And so that's why, you know, leadership just absolutely crushed all the other options.
- [12:23]
B
It's that homer falling into the bush meme. Like, I had the CUI scoping shirt on and then emerged out with leadership.
- [12:28]
A
That's right.
- [12:30]
B
The phone finger.
- [12:31]
A
Yeah, absolutely. All the. All the Ducks fans who became Hurricanes fans. You know what I'm saying? Everybody. All right, anyways, next idea here. The community consistently voted for root causes over symptoms. We talked about this at the beginning. This is sort of how people sorted the ideas in the tournament field over time. And so if we look at who lost in round one, these were cost, time, timeline constraints, knowledge, skill gaps, technical. Technical knowledge gaps, things like that. Applicability and flow down. These are all real problems. These were all things that people said, hey, these need to be in the tournament. Because multiple people left comments saying, this is the biggest problem. These are all very common Complaints and they all lost immediately. They all didn't make it out around one, you know, which begs the question like why did that happen? And you know, based on our analysis is because voters appear to treat these things as downstream effects rather than root causes. Cost rises when the scope is wrong. As we have said many times, time goes away when leadership waits too long to buy in knowledge gaps, technical execution persist when leadership doesn't invest in training, they don't enable their people to go out and spend the time to understand the requirements in your contracts. Applicability and flow down confusion starts with CUI confusion, right? And you know, is this cui, is it flowing down? Does this trigger subcontractors to have to comply? You know, the community basically immediately voted for causes over symptoms in the opening rounds of the tournament.
- [14:06]
B
Yeah. So not like these things aren't problems that can do derail a program. Right. But they're the mid majors of the tournament. They're the things that, hey, we can make a little buzz, draw a little attention to ourselves, but realistically, there's some big hitters in this tournament and we don't stand a chance against them. And that's basically where it comes comes down to.
- [14:26]
A
Yeah. Yeah. Padres were in first place in the NL west about a month ago and now we're the worst team in baseball. You know what I'm saying, everybody?
- [14:32]
B
That collapse is even more interesting. That could be a whole episode in itself.
- [14:35]
A
But oh my God, please you like and subscribe to support my emotional breakdown here because I am struggling, everybody. All right. Just like the symptoms lost in the opening round as we moved through the tournament into the final four. The final four contenders were all upstream problems. So, you know, the final four options here kind of really tell the story of the two months. It was leadership buy in, bad guidance and snake oil. CUI confusion and scoping, which like you, I was very surprised that scoping didn't make it to the finals. They weren't individual controls or control interpretations. It wasn't concerns about technology solutions, assessment details or assessment activities, architecture decisions, tooling, things like that. Everything that survived, you know, for more than a thousand people voting were upstream organizational challenges. And you can kind of see that in the closest matchup in the tournament. The closest matchup was CUI confusion versus scoping for third place. 120 votes for CUI confusion. 118 votes for scoping. More people voted for banana in this poll than the difference in votes between these two options. The banana margin was larger than the margin of victory. So you Know, one side here was arguing you can't scope the things that you don't understand about control data. The other side was arguing that the scoping process is how you discover the data that you're supposed to be implementing controls to protect. The community never really separated these two ideas. They basically said these two things are inseparable. But that goes to show that they were talking about these things as systems rather than isolated problems. And these are organizational systemic things like you said earlier. Not, not FIPS never even came close. It wasn't even in the running. It didn't even make it into the tournament. Right.
- [16:35]
B
Yeah. So what is a tournament without a good buzzer beater? And that's exactly what this one was. Right? And I think part of it is the confusion. Not the confusion around cui, but the confusion around what is asked of you here. It's asked of you to create a boundary that is capable of protecting cui. So when you talk about the root problem, the root problem is establishing the yard that your family can safely play in without danger. Right? And nobody's able to do that. And nobody's trying to identify the family just yet, because you have to have the yard to put your family in before we put them there. So look, man, I, I was the scoping guy. I was like, if you scope this wrong, these costs are going to go through the roof. You're going to have to buy snake oil salesmen to do this and do that and do that. And then I just realized once again, you know what shuts that down, Jacob? A good leader.
- [17:21]
A
Yeah, yeah. All problems are leadership problems. You know, it, it, it ultimately comes back to that. CMMC is no different. So, all right, just to wrap it up here, what did this tournament actually measure? Right. I don't think it measured the pain of individual issues, which is kind of what we were going for at the beginning. I think it at the end sort of measures and shows how the community views the causation of problems. The final four, like I said, kind of tell this story. Leadership buy in got first place, then bad guidance in second place, then confusion about CUI in third, and then scoping decisions in fourth. The community repeatedly elevated these upstream organizational challenges over downstream technical issues. And the voters were not saying that the controls don't matter or that they're difficult or that they are not issues, but they were saying that all of those control problems are down way, way downstream after the organizational problem. So after these more than 2000 votes, literally hundreds of comments, I didn't count all of them. But there's hundreds and hundreds of comments, two months of debate. I think everybody would probably agree at this point that most organizations don't fail because they choose the wrong control or the wrong technology or the wrong architecture. They fail because decisions that are made long before implementation ever begins and certainly a long, long time before the assessment ever begins. I mean, you're talking way before that's even, you know, a hint on the horizon.
- [19:00]
B
What we do today echoes eternity, right?
- [19:05]
A
That's right. That is. That's correct.
- [19:07]
B
The decision your leadership makes today has the potential to echo throughout the entirety of your CMMC implementation. And so that's what this entire bracket proved, is that if the leadership doesn't have buy in. In a plan going into it, that is not ironclad, but at least to a point where it's competent. Right? Yeah. What's going to happen is that somewhere down the line, one of these underlying issues is going to be the problem. And everybody's got problems. Jacob, if you go and talk to anybody today, they'll say that gas is too high, my taxes are too high, groceries are too high. But each, if you talk to three different people, each one of them might introduce a different one of those problems. It doesn't mean that all three of those problems don't bother all of those people. It's just this is the most prominent one in their mind because it's what they're struggling with the most.
- [19:53]
A
Yeah. Yeah.
- [19:54]
B
All right, folks.
- [19:55]
A
I mean, this was super fun and it turned into a big tournament. Bigger than I thought it was going to be. Do you want us to run it again? Do you want us to run it during October Baseball? Should this be March Madness? Should this be NHL playoffs? Once a year? Twice a year? When do you want to see it again? Did we miss anything in the tournament? You know, let us know your thoughts and feedback because, I mean, it was super fun to run and we kind of take it whichever direction you want. So let us know in the chat, let us know in the comments. What do you want to see? Do you not want to see it ever again? We go from there, like, and subscribe. We'll see you next week.
- [20:25]
B
See you next week, folks.