Executive Insights | The C3 Suite: Ryan Heidorn

Discover insights from Ryan Heidorn on how the C3 Suite revolutionizes CMMC compliance with effective, flexible solutions in this exclusive video interview.

• 

  C3

 

 

Q&A with Ryan Heidorn

What’s the vision behind the C3 Suite?

We’ve always been focused on helping our customers implement the requirements and now pass a CMMC assessment. And, really over the years we’ve seen kind of three categories of blockers that prevent our customers from meeting that goal. And they kind of cluster around technical implementation, resourcing and time. The technical challenges can take a variety of forms.

Most of them tend to be related to attempts to retrofit legacy technology to meet the security requirements that are required by CMMC. We’ve found that having a prescriptive approach essentially starting with the end in mind, with a system that’s purpose built to meet the CMMC requirements, can help organizations avoid the never-ending compliance project or unexpected costs and time overruns.

And on that note, I think with resourcing, you know, our customers are defense contractors that are focused on the mission. They’re focused on running their business, and they’re looking for a partner that can share as much of that compliance journey with them as possible. Because when it comes down to time, yes, CMMC has been a long time coming, and I think those organizations that have prepared well in advance are in great shape now.

But having a predictable and efficient timeline is always important because our clients can’t necessarily allocate their internal personnel to be tied up in a project for months or potentially even years to achieve that CMMC outcome. So, that’s really the genesis behind what led us to create the C3 Suite of solutions.

 

How did the final rule contribute to C3 Command and Catalyst?

We’ve been working with defense contractors for a long time now, so we’ve been tracking the CMMC rule since its infancy, and that’s taken a number of years. Right? And over those years, there’s been a lot of speculation as to exactly what form the CMMC program would take in its final state. So, I was pleasantly surprised when I saw the CMMC final rule, because I thought it provided a lot of clarity on some of the key issues and questions that we had about CMMC and the role of external service providers in the assessment.

Specifically, I’m thinking about clarity on when to use FedRAMP authorized Cloud service providers and when the use of other types of cloud service providers is permissible. Similarly, the final rule gave us real clarity on what’s required for other external service providers like MSPs. So much of the defense industrial base relies on MSPs for day to day operations, that I think it’s great news that MSPs don’t necessarily have to be CMMC certified in order to support their clients, but I think there are real advantages to working with an MSP or an MSP that has a CMMC certification because it’s going to provide a lot of assurance and de-risk the assessment on the client’s end.

 

How does C3 Command lead to faster compliance for our client?

Any way you look at it, CMMC is a pretty heavy lift. And I think that’s true both for organizations that maybe have underinvested in cybersecurity over the years and for more mature organizations as well. The industry consensus seems to be that going from zero to assessment ready is going to take an organization 12 to 18 months or longer of concerted effort.

Now, with the first generation of C3 services in the Steel Root Compliance Program, we were already able to beat the industry average with our clients achieving CMMC implementation in 9 to 12 months. But with C3 Command, we’re able to go even faster. And that’s because we’ve built an optimized approach that leverages the lessons that we’ve learned over the last several years to drive towards an even more efficient timeline, meaning that our clients can achieve implementation and assessment readiness in as little as six months.

Of course, that requires the clients to have some skin-in-the-game, right? Because we’re sharing responsibilities. And I think it’s important to note that there is no easy button for CMMC compliance. But with C3 Command and our standardized and optimized approach, we’re able to get pretty darn close.

 

How is C3 Catalyst different from other solutions in the market?

Our clients love the efficiency of our optimized approach, but we’ve learned that there are a variety of reasons why an organization might not be able to fully hand over the keys to C3 to manage the environment. C3 Catalyst lets our clients take advantage of the reference architecture. Our CMMC focused managed services and our Security Operations Center, with some additional flexibility around configuration and technical use cases that are supported.

More flexibility does come with some tradeoffs, which generally means it’s a little bit slower of a timeline, and our Catalyst clients are going to own a larger share of the compliance responsibilities. However, with C3 Catalyst, our clients can still take advantage of C3’s vetted approach that generates a very high degree of confidence in assessment outcomes.