Oh man
So. I got onboarding to help with nist implementation for our small business and help coordinate an msp and our compliance. Ive successfully talked everyone into a tiny enclave rather than enterprise scope (months of pain prior)
Our company has spent a shit ton and 2 years working toward this . My boss is old, brought me in for help and I quickly realized the msp did his self assessment and nothing was ever verified , it was a massive mess and headache.
Anyway. Today . Im deciding to harden our scope down as we progress with our enclave im going to go through our clauses so we can really hone in on things. Idk why I just now thought this.
We've never received anything other than dfar (can't remember exactly but whatever ) 7008 . On a reoccurring po . We are way down the sub line .
Just 1 reference to it . No others . No 7012 alongside.
Oh my god my head is spinning .