u/cashmgee

So. I got onboarding to help with nist implementation for our small business and help coordinate an msp and our compliance. Ive successfully talked everyone into a tiny enclave rather than enterprise scope (months of pain prior)

Our company has spent a shit ton and 2 years working toward this . My boss is old, brought me in for help and I quickly realized the msp did his self assessment and nothing was ever verified , it was a massive mess and headache.

Anyway. Today . Im deciding to harden our scope down as we progress with our enclave im going to go through our clauses so we can really hone in on things. Idk why I just now thought this.

We've never received anything other than dfar (can't remember exactly but whatever ) 7008 . On a reoccurring po . We are way down the sub line .

Just 1 reference to it . No others . No 7012 alongside.

Oh my god my head is spinning .

I know this is very reliant out industry and which industry you reside in, but how do you guys project cui in the future when analyzing costs of becoming lvl 2 compliant ?

We are mostly defense /aerospace, but far down the list of subs . Im not in a decision making role, but am tasked in the cmmc space . I personally dont see it as worthwhile in relation to the costs , but am not sure how the projection looks in the future in terms of volume of our work.

Much of our work is EC , but I doubt they retroactively classify much of it as cui. Many of our primes are still using unsecured methods of sending cui down to us 😆

Anyway, how do we see this playing out ?

This is all subjective bs .

Audits should be black and white. Either you do or don't. Not interpretive. Not subjective.

But this is the hand we are dealt .

That and my 80 year old boss who's been wrong for the last 3 years is hard headed as fck. Just brought me on 2 months ago, ive been with company 15 years. Never any cyber experience but plenty of other auidt compliance work.

Had a msp hired that never did compliance . He's already spent 180k on it and I called the msp out on his bs and he bailed . We have a bad srps score now and are sitting at square one because my boss never followed up on anything .

This along witb the fact that primes dont even follow their own rules.

Im sitting here with a dist statement e as a low lvl sub 😆 Had to vent. Feel lost .

Hope you all are having a better Monday than I am.