It started four years ago in Orlando with one question. This was not a big conference- if you can picture it: the defense contractors gathered in a hotel conference center: pull and pop-up banners, standard 6-foot table, 2 chairs, and a tablecloth. Modest compared with the story-tall carpenter-built booths, or jet-skies in water tanks, or robot dogs roaming around convention centers that I would see at future conferences. MNS Group was there to give a talk with our colleague, CISEVE, on the CMMC program to mostly Air Force contractors.
CMMC assessments hadn’t started yet. In fact, there were a few attendees we encountered who were familiar enough with the program to speak on it, let alone self-assess their business to see if the security controls they had in place to protect CUI or FCI could pass an assessment. Those who had heard of CMMC argued that assessments would never happen anyway.
These events are not inexpensive to travel to and exhibit at. But we had to take the chance: we were actively preparing to become a CMMC Third-Party Assessment Organization (C3PAO). Soon, we would assess these contractors, and we wanted to meet them and understand their businesses better. Not only that, we wanted to make sure they had a fair chance to get security controls in place in time, so they were eligible to win government contracts and provide for their families. Not to mention, honor their contractual obligations and safeguard the interests of our nation. At first, it was very discouraging to walk around those tables and meet blank stares when I asked about their CMMC preparation. My tactic soon changed to ask whether they had heard of CMMC. Those answers were similarly disheartening.
Before we left, at the last minute, I ordered some gold stars- the tiny, foil stickers that elementary school teachers put at the top of graded papers that meet the mark or indicate success on a habit tracking chart. At the time, I had no idea of the power in this centimeter-by-centimeter sticker.
As the conference members streamed by the tables, I changed my question, asking instead, “Have you earned your gold star?”
Caught off guard, many attendees would stop dead in forehead-wrinkled confusion- and curiosity.
I would explain that if they had even started planning CMMC preparations, they got a gold star. If they were actively implementing CMMC, they got 2 stars, and I explained how MNS Group could help. Some left our conversations with gold stars on their conference badge. Some left with my business card and a list of questions to ask their management and IT.
Some left with tears.
Not because they were upset. But because they were seen.
I placed the star in the corner of one man’s badge, and he twisted it around and took a good, long look at it. He met my eyes with tears in his own, and shared that he had never gotten a single gold star in school. He had always wanted one- and now, here, he had finally earned not one, but 2.
You see, people want to be caught doing the right thing. Even a small token- like a tiny gold star on a conference badge means something.
Years later, this week at TechNet Cyber in Baltimore, with a pocket full of gold stars, I asked the same question to conference attendees: “Have you earned your gold star?” And this time, the man I approached smiled, looked at our booth, and said: "I am a Lead CCA and your company is building our enclave!"To say it was a defining moment for me is an understatement.
Times have indeed changed since Orlando. Now, when we attend conferences, we are giving out more gold stars than ever. This spring, we celebrated our 3-year anniversary as an authorized C3PAO by undergoing our triannual reauthorization by DIBCAC. I am pleased to share that we are authorized to continue serving our country and to offer CMMC Level 2 assessments to the defense industrial base and supply chain. This means more gold starts for businesses that earn them, and a couple for us, too.
I look forward to a time when every conference badge glows gold with the confirmation of CMMC accomplishment. To me, this means that security, compliance, stability, and patriotism are a priority. I am proud of MNS Group’s work. I am also proud of the business leaders who make hard decisions and persevere to GET CERTIFIED.
Have YOU earned your gold star yet?