This auto-generated transcript may contain errors. Please contact us for clarification if needed.

1
00:00:00,000 –> 00:00:03,520
But if you had to pick a part of someone else’s job, what would it be?

2
00:00:04,920 –> 00:00:11,320
That you had to do. We’re gonna start with Anne. I want to go. I want to go. I want to go. Okay. Good time. Go Ted.

3
00:00:11,320 –> 00:00:13,920
I would pick my job. I’m living the dream, baby.

4
00:00:17,760 –> 00:00:20,720
Who gets to talk as much as me? Nobody!

5
00:00:20,720 –> 00:00:28,480
Ariel’s got the face on that goes, I don’t know. I have to be meetings with Kelsey. I was gonna say that.

6
00:00:30,640 –> 00:00:36,720
That’s a good point. Is there a way to be able to have more meetings

7
00:00:37,840 –> 00:00:42,560
with Ariel and Kelsey than that’s the part of their job?

8
00:00:42,560 –> 00:00:50,000
That’s my job. Are you saying that’s the part of Ted’s job you want is the power to be like,

9
00:00:50,000 –> 00:00:53,360
this is the meeting that I want with the people that I want. Go.

10
00:00:54,880 –> 00:00:57,520
Everybody does have a calendar so they can do that anytime they want.

11
00:00:58,080 –> 00:01:03,840
You can, but I’m just saying I’m like the totem pole. You could schedule over a meeting and I’d

12
00:01:03,840 –> 00:01:06,320
probably take you. Decide. Decide. Right. Yeah.

13
00:01:06,320 –> 00:01:14,240
Yeah. Yeah. For sure. And you, Kelsey, do you want to read more compliance documents?

14
00:01:14,880 –> 00:01:24,480
We love reading. Yeah. I don’t envy a lot of Todd’s responsibilities either,

15
00:01:24,480 –> 00:01:28,560
which is probably just being pessimistic on a Monday, but I’m going, that sounds like a lot

16
00:01:28,560 –> 00:01:35,520
responsibility. That sounds like a lot of compliance responsibility. Not to steal Todd’s

17
00:01:35,520 –> 00:01:44,080
answer, but I do really like my job. But I don’t know. I think I would like to the fact that Todd

18
00:01:44,080 –> 00:01:48,480
gets to work cross-departmentally. I’ll probably a little bit more than I do. Some of the operational

19
00:01:48,480 –> 00:01:53,760
stuff I find fascinating. So maybe just a day shadowing some of the operational stuff would be fun.

20
00:01:53,760 –> 00:02:06,560
I wouldn’t mind. I mean, these regulations are deep in the weeds, but I actually don’t mind

21
00:02:07,760 –> 00:02:12,800
a little bit, and maybe Ann’s going to say that’s not how it is, but sometimes the black and white

22
00:02:12,800 –> 00:02:20,480
of it, this is the expectation and this is what you do. And just kind of going down your checklist

23
00:02:20,480 –> 00:02:26,320
and where you at, what do you have to get done? I actually wouldn’t mind that. I don’t know about

24
00:02:26,320 –> 00:02:31,680
all the reading that comes with it, but the process I think is very interesting.

25
00:02:34,800 –> 00:02:41,040
So today on our TechBurbett Business Podcast is the Ann Show. We’re discussing government

26
00:02:41,040 –> 00:02:49,040
regulations. We’ve got Kelsey and myself are joined by Ann, our quality assurance analyst and GRC

27
00:02:49,040 –> 00:02:56,720
specialist, and then Todd, our COO and CISO. And we’re going to kind of do a little bit of

28
00:02:57,520 –> 00:03:03,120
basic introduction to these government regulations and then maybe deep dive a little bit towards

29
00:03:03,120 –> 00:03:11,200
the end. But I don’t know if Ann wants to give us maybe a little introduction as to, you know,

30
00:03:11,200 –> 00:03:16,160
how many acronyms you have to know and maybe a couple of the top ones.

31
00:03:16,160 –> 00:03:21,680
Well, I would start with saying there’s always a place to look up the

32
00:03:23,040 –> 00:03:32,720
acronyms that we don’t know. Really working with our state, local, and federal regulations

33
00:03:33,520 –> 00:03:38,720
across the board. There’s like we mentioned it just a little bit ago, there’s always a manual.

34
00:03:38,720 –> 00:03:43,920
There’s always a place to refer and there’s a way to find out what the rules are

35
00:03:43,920 –> 00:03:51,840
with these different regulations and everything from a statute to a law.

36
00:03:55,120 –> 00:04:02,400
We’ve had a lot of opportunities with our very customer base to see a lot of sides of different

37
00:04:02,960 –> 00:04:09,680
regulations that our customers have and being able to support them with their technology

38
00:04:09,680 –> 00:04:18,720
and how they do their business best. So needing to know or understand where our customers are,

39
00:04:18,720 –> 00:04:27,600
CIT as a whole doesn’t have a government regulation based on our products or our services.

40
00:04:27,600 –> 00:04:35,200
We have certain accreditations to support our customers and theirs, but we as an entity

41
00:04:35,200 –> 00:04:45,760
don’t have any specific. So I’m just trying to think too. There’s a few two big ones that have come

42
00:04:46,880 –> 00:04:55,200
to the surface in the last few years are CMMC and Sejas and we’ll start with Sejas because it’s

43
00:04:55,200 –> 00:05:03,680
smaller, but that’s helping our customers manage not smaller, but it’s a less lengthy and gooey mess.

44
00:05:03,680 –> 00:05:16,960
It’s very black and white. It is the criminal justice information services and our police

45
00:05:16,960 –> 00:05:26,480
departments, our cities have information sometimes that requires us to understand how

46
00:05:26,480 –> 00:05:33,120
Sejas information has to be protected in that there’s a really riveting manual that I think

47
00:05:33,120 –> 00:05:39,600
is about 260 pages that you can go through though and find that anytime you need to,

48
00:05:39,600 –> 00:05:48,320
where that those controls are, we can refer to any portion of it. Luckily, that we can say,

49
00:05:48,320 –> 00:05:54,960
okay, we’ll recommend that you set it like this. It is always up to our customer though to

50
00:05:54,960 –> 00:06:06,160
to ensure those are set appropriately. We can advise but not force. But just kind of going back,

51
00:06:06,160 –> 00:06:13,120
the criminal justice Sejas information is the information that law enforcement uses to work,

52
00:06:13,120 –> 00:06:26,080
to conduct business. It is things about criminal evidence. I’m looking at our notes too, but

53
00:06:26,080 –> 00:06:35,120
the biometrics, a lot to do with the identity of a criminal and realistically, CIT doesn’t

54
00:06:35,120 –> 00:06:40,560
actually ever touch that kind of data. I just again want to make crystal clear with that, but

55
00:06:40,560 –> 00:06:53,760
it’s used to make assessments, make notes by law enforcement to support the legal system, I guess.

56
00:06:56,640 –> 00:07:01,280
I’m going to jump in real briefly. I’m guessing that almost everybody that joins the podcast is

57
00:07:01,280 –> 00:07:07,120
probably going to be having at least some level of engagement on the government level, most likely,

58
00:07:07,120 –> 00:07:13,360
but just real briefly, Sejas is criminal information services. We keep throwing out the

59
00:07:13,360 –> 00:07:19,040
acronym. I thought a little background would help. What’s in information is the data is typically

60
00:07:19,040 –> 00:07:25,680
collected by government, whether that’s FBI, local government, etc. It is contained a lot of

61
00:07:25,680 –> 00:07:32,160
information about what you’d expect, fingerprinting, criminal background history, missing persons data,

62
00:07:32,160 –> 00:07:36,000
background checks, firearms, that kind of stuff. If you’re going through the legal process, that’s

63
00:07:36,000 –> 00:07:43,920
the kind of information that’s in the Sejas services systems. Sorry, continue. No, I did say the

64
00:07:43,920 –> 00:07:49,680
criminal justice information systems, I just didn’t say Sejas right after it. It made sense to me.

65
00:07:50,800 –> 00:07:55,760
We’re so immersed in this all the time that we forget that nobody knows what I’m thinking.

66
00:07:57,360 –> 00:08:04,160
It is important to be aware of all of the regulations surrounding this so we can best

67
00:08:04,160 –> 00:08:14,080
support our customers. But it’s ensuring at a base level, it is really the methods that are

68
00:08:14,080 –> 00:08:21,120
required to protect the data, but it’s still protecting data. It’s compliance at a base level.

69
00:08:21,120 –> 00:08:26,080
We want to protect the sensitive information. We want to ensure people that have access to the

70
00:08:26,080 –> 00:08:32,480
sensitive information only have the need to know to do their job. They don’t have

71
00:08:32,480 –> 00:08:42,480
access just because they feel like it. Being able to guide some of our customers where it is rare

72
00:08:43,200 –> 00:08:49,760
that a law enforcement officer would read the security manual because that’s not what they do.

73
00:08:53,200 –> 00:08:59,600
Boots on the ground serving and protecting our communities, they certainly have no idea.

74
00:08:59,600 –> 00:09:07,680
Yeah. It is really difficult from my perspective and I feel for them because they are

75
00:09:07,680 –> 00:09:13,200
loving these requirements. We’ve found more than once that a chief of police is now being

76
00:09:13,200 –> 00:09:20,320
expected to be an IT director. That’s really not what they signed up for, but again, our customers

77
00:09:20,320 –> 00:09:28,960
are fantastic in helping us help them and really looking at the types of information

78
00:09:28,960 –> 00:09:35,840
the CGS information and going through these types of manuals and getting that, does this make sense?

79
00:09:35,840 –> 00:09:46,560
Is this set up to the requirements in this manual? I think we always provide value to these customers,

80
00:09:46,560 –> 00:09:56,880
but it’s just another layer of protection, I guess. And knowledge of those levels of protection is

81
00:09:56,880 –> 00:10:05,200
always the best to understand. With our team, go ahead. Oh, that’s fine. I was going to say just

82
00:10:05,200 –> 00:10:09,920
kind of wrapping around a bubble around that a little bit. I mean, there are a lot of different

83
00:10:09,920 –> 00:10:16,160
organizations that do have some kind of, I was going to use the word culpability, I’m not sure

84
00:10:16,160 –> 00:10:22,080
that’s really right, but the reason why it matters is I mentioned not everybody is going to be in

85
00:10:22,080 –> 00:10:27,040
government, or most people that are listening might be, but there is also an extension to it.

86
00:10:27,040 –> 00:10:31,600
If you’ve watched any of our podcasts in the past, we’ll get into things such as supply chain or

87
00:10:31,600 –> 00:10:36,480
just being a part of a third party. And as the world continues to get a little bit more complicated,

88
00:10:36,480 –> 00:10:42,800
you start to see this rise in cybersecurity attacks, etc. You’re seeing that there’s a trickle down

89
00:10:42,800 –> 00:10:48,480
process of it may be a city, it may be a county, it may be whatever, it may be the federal government

90
00:10:48,480 –> 00:10:52,080
itself, but they are starting to hold everybody accountable to make sure that they’re doing the

91
00:10:52,080 –> 00:10:59,840
right things. And so you’re starting to see that those organizations or government operations are

92
00:10:59,840 –> 00:11:05,440
being told that anybody they’re working with has to comply as well. So one of the things that Ann

93
00:11:05,440 –> 00:11:10,320
mentioned early on was we don’t really have the compliance requirement to ourselves, and yet we

94
00:11:10,320 –> 00:11:16,240
do. So if we’re working with a city, a county, a state, a contractor for the federal government,

95
00:11:16,240 –> 00:11:20,960
they are looking to us and saying, how are you doing your due diligence to make sure you’re

96
00:11:20,960 –> 00:11:25,600
doing the things that you need to do and or help us get there. But if we’re helping them,

97
00:11:25,600 –> 00:11:31,840
they’re still expecting us to be able to do all the things. So there is a strong guideline, whether

98
00:11:31,840 –> 00:11:37,120
that’s, I’ll throw a NIS too, and I never remember the acronym, but we use it enough that you should

99
00:11:37,120 –> 00:11:43,280
know by now. But there’s, there’s, let’s do acronym soup, right? There’s NIS, there’s CMMC,

100
00:11:43,280 –> 00:11:48,240
there’s CGIS, etc. They’re all kind of largely the same. And I think this is where Ann was going

101
00:11:48,240 –> 00:11:53,840
to go next is what are the things that you’re being asked to do? And they do have a lot of,

102
00:11:54,480 –> 00:11:58,480
a lot of similarities. They may phrase them slightly different. They may categorize them a

103
00:11:58,480 –> 00:12:03,360
little bit different, but at their core, they’re still more or less the same things to make sure

104
00:12:03,360 –> 00:12:10,800
that you’re doing in the security world. We call it the triad. It’s the CIA, confidentiality, integrity,

105
00:12:10,800 –> 00:12:16,880
accessibility, or availability. And so they’re all trying to get to that same thing. And I’ll be

106
00:12:16,880 –> 00:12:21,280
quiet again, because Ann was on a roll. I’m sorry, I disrupted your flow. That was perfect. No, it

107
00:12:21,280 –> 00:12:28,480
really is. That, I always say at the base level, so many things are really the same.

108
00:12:29,600 –> 00:12:37,520
One of those key elements in compliance in general and in information protection is knowing

109
00:12:37,520 –> 00:12:45,120
what you need to protect. And then based on that, the layers add, we need to protect this specific

110
00:12:45,120 –> 00:12:52,640
type of information or device or fill in the blank at this way. These devices are a different way,

111
00:12:53,280 –> 00:13:02,080
but the different regulations for government are kind of taking all of that in a big circle and

112
00:13:02,080 –> 00:13:09,120
saying, hey, we’ve identified the specific kind of information, rather than not knowing what to

113
00:13:09,120 –> 00:13:16,720
protect. We know, and now we have to apply it regardless. So if it’s the Seegis information,

114
00:13:16,720 –> 00:13:25,520
like Todd elaborated on that person data, then we know it has to be protected this way. If it’s

115
00:13:25,520 –> 00:13:36,480
CMMC or what’s called CUI, controlled unclassified information, then you know that this specific

116
00:13:36,480 –> 00:13:42,960
data has to be protected this way. That’s where all of these manuals, as riveting as they are,

117
00:13:42,960 –> 00:13:48,240
they really do spell out exactly what you need to do. And CMMC has been a little different,

118
00:13:48,240 –> 00:13:54,320
because it’s evolved a little. But I think with CMMC, it’s really just been who’s allowed to

119
00:13:54,320 –> 00:13:59,600
review the rules and protection haven’t changed or the methods.

120
00:14:01,280 –> 00:14:05,680
Yeah, one of the things that I wanted to kind of touch on briefly was what is the purpose behind

121
00:14:05,680 –> 00:14:11,440
it. And as I mentioned, it’s trying to do the triad, the CIA. And the reason for this being a

122
00:14:11,440 –> 00:14:17,840
concern is as the world continues to change, the threats continue to evolve. You’re starting to see

123
00:14:17,840 –> 00:14:23,440
more people work remotely and brought up peacekeepers as an example of someone that would

124
00:14:23,440 –> 00:14:28,160
potentially have access to sieges information. So they’re mobile, they’re outside of the building,

125
00:14:28,160 –> 00:14:33,360
but still potentially having access to it. The threats are getting more and more complicated.

126
00:14:33,360 –> 00:14:38,800
You’re getting third parties in it. I’ll use CIT as an example, since we do work with cities,

127
00:14:38,800 –> 00:14:44,800
counties, etc. You’ll typically see where we unintentionally may have access to a system.

128
00:14:44,800 –> 00:14:51,360
So we still have to do all of the due diligence to make sure that we comply as well. It may be

129
00:14:51,360 –> 00:14:54,960
something that was inadvertent. We weren’t necessarily looking at it, but as we’re working on a system

130
00:14:54,960 –> 00:15:00,160
to get it to work properly, you may come across it. So we do have to do all the things. We have to

131
00:15:00,160 –> 00:15:06,160
do the vetting, the so on and so forth. That’s the main reason why you do this, these threats,

132
00:15:06,160 –> 00:15:10,080
kind of as I mentioned, even with the tools themselves, where they’re kind of universal and

133
00:15:10,080 –> 00:15:15,280
they’re kind of mix and match, the threats are too. There’s a lot of sensitive information that

134
00:15:15,280 –> 00:15:20,720
the bad guys are after. And so you see the same kind of motivations behind everything. They’re

135
00:15:20,720 –> 00:15:26,400
trying to get access to information that they want because there’s value to it. And so when you see

136
00:15:26,400 –> 00:15:32,720
the how do I then turn around and slow it down, same concept, I need processes and procedures,

137
00:15:32,720 –> 00:15:37,040
etc. to do it. And of course, we need the people to be able to follow those processes and procedures

138
00:15:37,040 –> 00:15:47,760
as well. Yeah, I was in a huge overview and maybe something to definitely deep dive in at a later

139
00:15:47,760 –> 00:15:56,000
time. But you, Ian mentioned earlier, you know, speaking about law enforcement and maybe people

140
00:15:56,000 –> 00:16:02,720
expected to be IT or doing compliance, who that is not their job. I’m curious, you know, as a

141
00:16:03,440 –> 00:16:10,000
tech partner, when you’re working with these people who maybe don’t know and haven’t read all

142
00:16:10,000 –> 00:16:17,440
these things, where are those biggest, where are their biggest kind of missteps or miscommunication

143
00:16:17,440 –> 00:16:22,080
or what are kind of those big things that they sometimes are missing when it comes to compliance

144
00:16:22,080 –> 00:16:28,640
that you’re helping support them? I’ll jump in briefly and I’ll turn it over to Ian. But I think

145
00:16:29,920 –> 00:16:35,600
the comment of having responsibilities that they wouldn’t normally have, we work with a lot of the

146
00:16:35,600 –> 00:16:39,920
small and mid-sized organizations. And I think that’s kind of a reoccurring theme we see in a lot

147
00:16:39,920 –> 00:16:44,160
of cases where people get to wear many hats, unfortunately, and sometimes it’s not their

148
00:16:44,160 –> 00:16:50,320
forte. But when we see that come to fruition, things that you’ll occasionally see is that

149
00:16:51,040 –> 00:16:56,160
cities can be very large, they can be very, very large, or they can be very, very small.

150
00:16:56,160 –> 00:17:00,640
And when you’re looking at that variation, you’re going to see that they’re going to just naturally

151
00:17:00,640 –> 00:17:05,840
be at different levels of maturity. And what that could mean is that traditionally, they’ve

152
00:17:05,840 –> 00:17:11,280
inherited what they always have. I’ll use a small city as an example where the city may just be

153
00:17:11,280 –> 00:17:15,920
small enough where all of their systems came online and they just kind of stayed that way.

154
00:17:15,920 –> 00:17:21,280
They were too small to worry about it any other way. As this starts to mature and the threats

155
00:17:21,280 –> 00:17:26,560
continue to evolve, they’re being asked, now you really need to do all the things. And that may mean

156
00:17:26,560 –> 00:17:33,520
something like separating the city from the PD, separating, some may have the library,

157
00:17:34,160 –> 00:17:39,120
where you’re going to have people that go to the library jump on the wireless, making sure that

158
00:17:39,120 –> 00:17:44,000
the liquor store is off the network. Those kinds of things are things that we typically see where

159
00:17:44,000 –> 00:17:48,960
they’re just not quite mature enough where they’re saying, okay, how do I do these? What are the

160
00:17:48,960 –> 00:17:54,320
natural steps? And of course, like everybody, budget is a concern. So where do you start?

161
00:17:54,320 –> 00:17:59,760
How do you start to untangle what we’ve got today and put in a strong road map of where do we go

162
00:17:59,760 –> 00:18:09,920
forward from here? I think to put a circle around that it’s helping our customers,

163
00:18:10,560 –> 00:18:16,080
they often ask Todd uses a version of this, tell me what I don’t know that’s important.

164
00:18:17,440 –> 00:18:24,240
And we can try to stay apprised of any changes in the regulation or know the regulation. So

165
00:18:24,240 –> 00:18:31,120
of any kind to try to see going into a new customer or an existing to say, hey, maybe this isn’t an

166
00:18:31,120 –> 00:18:39,120
align and maybe you’re aware, maybe you’re not. There are times and places where they’ve come

167
00:18:39,120 –> 00:18:44,000
back and said, yes, we are aware and that is something we’re not, it’s not even on the radar

168
00:18:44,000 –> 00:18:52,240
for a while. Well, you have to maybe be compliant by December 31st. Oh, that I wasn’t aware of. Okay,

169
00:18:52,240 –> 00:18:59,600
so like, and in almost every type of regulation, though, to whether it’s the government industry

170
00:18:59,600 –> 00:19:09,760
is banking with rare exception, if you are taking steps to meet compliance and you’re not quite there,

171
00:19:10,320 –> 00:19:16,320
almost every auditor we’ve encountered of or examiner, that kind of thing, if you have a plan

172
00:19:16,320 –> 00:19:22,240
in place to meet the requirements and you’re not blatantly disregarding them,

173
00:19:24,640 –> 00:19:30,880
there’s a lot of leeway in that. It’s not that people willfully miss these regulations, but

174
00:19:30,880 –> 00:19:37,040
like Todd said, they had one server this whole time and now they’re being asked to have a firewall,

175
00:19:37,040 –> 00:19:44,400
two servers and 20 more users at a small city where those didn’t exist. That’s a huge burden.

176
00:19:44,400 –> 00:19:52,240
That’s a huge burden on a city. And when you think about coming to all of us as taxpayers to be like,

177
00:19:52,880 –> 00:20:02,400
why did we have to spend another $150,000 on what, why? But knowing those kind of things to say,

178
00:20:03,280 –> 00:20:11,520
we may need to show a plan and even helping in budgeting. I mean, having those regulations

179
00:20:11,520 –> 00:20:18,320
to point to to say it’s not just a suggestion, it really is a requirement. So let’s try to get there.

180
00:20:19,120 –> 00:20:27,680
So that, I mean, that’s the more fun of our job, I guess, of my job that when you know that someone

181
00:20:27,680 –> 00:20:33,040
isn’t quite there in any one of these regulations, how can we get you there? Do we?

182
00:20:33,040 –> 00:20:40,960
That’s the fun of looking and saying what tools exist, what don’t, how can we

183
00:20:41,920 –> 00:20:46,160
will tell you where the holes are and maybe these give

184
00:20:48,320 –> 00:20:54,000
priority to certain ones or even adding them to a budget. I think that’s really where

185
00:20:54,000 –> 00:21:01,840
your CIT is great in doing those kind of things with our customers. But I’m not trying to brag or

186
00:21:01,840 –> 00:21:05,760
anything, but I think we do a pretty good job of doing that.

187
00:21:05,760 –> 00:21:11,760
I mean, definitely you can brag, you can brag on our podcast.

188
00:21:11,760 –> 00:21:13,760
It’s us.

189
00:21:13,760 –> 00:21:17,760
We do it all the time. Yeah, it’s us. But we do recognize there are other people out there,

190
00:21:17,760 –> 00:21:24,240
so we encourage you to reach out and find out what you have that comes up all the time,

191
00:21:24,240 –> 00:21:29,760
no matter what we’re talking about, know what you have. Is there anything else you want to kind of

192
00:21:29,760 –> 00:21:34,720
share? We very much skim the surface. I think we’re going to come back to this, do a little

193
00:21:34,720 –> 00:21:40,880
deep dive, but anything else that you want to share about government regulations, best practices,

194
00:21:40,880 –> 00:21:47,360
tips or tricks or anything like that? I will touch on it real briefly. I mean,

195
00:21:47,360 –> 00:21:52,000
it does look very complicated. As Ann mentioned, there’s these documents that are 20 pages long,

196
00:21:52,000 –> 00:21:59,840
and that is very typical in the world of compliance, but they do exist for a good reason,

197
00:21:59,840 –> 00:22:03,680
and they are trying to spell things out as clearly as they can. Unfortunately,

198
00:22:03,680 –> 00:22:07,280
when you’re trying to be incredibly clear, sometimes that means you end up using a lot of

199
00:22:07,280 –> 00:22:11,840
words. That would be me. The reality is you can boil these things down, and this is where your

200
00:22:11,840 –> 00:22:17,760
tech partner starts to be able to translate those documents into meaningful, actionable things.

201
00:22:17,760 –> 00:22:22,720
Some of those things are the stuff we talk about over and over again. Do your cybersecurity training,

202
00:22:22,720 –> 00:22:28,720
make sure you’ve got an incident response plan in place, make sure you got your physical security

203
00:22:28,720 –> 00:22:34,400
in place. There’s a lot of stuff that’s pretty standard, but I think that’s a good thing to

204
00:22:34,400 –> 00:22:39,040
make sure that you’re dotting your eyes and crossing your T’s. Some of the things that

205
00:22:39,040 –> 00:22:43,280
become a little bit more complicated in the government layer is that you need to make sure

206
00:22:43,280 –> 00:22:47,440
that you’ve got some agreements in place. They call them the information exchange agreements,

207
00:22:47,440 –> 00:22:51,840
and those are really kind of in the typical business world the analogy I’d make would be

208
00:22:51,840 –> 00:22:57,200
your NDAs. You’re trying to make sure that you’ve got agreements in place that say we

209
00:22:57,200 –> 00:23:03,040
can share information without giving out too much. Then the last thing that I want to make

210
00:23:03,040 –> 00:23:08,320
and then the last thing that I wanted to add on and again I’ll turn it over to Ann so she can expand

211
00:23:08,320 –> 00:23:14,000
on anything that I covered too quickly or didn’t at all would be that there are concerns about not

212
00:23:14,000 –> 00:23:19,520
being compliant. Now, if you’re a government entity and you’re being told you need to be

213
00:23:19,520 –> 00:23:22,720
compliant, they’re not going to kick you out of the government. There is a little bit of leeway

214
00:23:22,720 –> 00:23:27,280
in there, but there are certain things that if you’re a partner, there are issues and concerns.

215
00:23:27,280 –> 00:23:32,000
If you’re a non-compliant as a partner and you’re being asked to, some of the downsides are you

216
00:23:32,000 –> 00:23:38,000
could potentially lose access to information. So, see just in particular, a great example would be

217
00:23:38,720 –> 00:23:44,160
banks do background checks on their employees, and if you lose access to the data, you can’t really

218
00:23:44,160 –> 00:23:49,760
be compliant in making sure that you’re doing good hires. There are fines and then worst case,

219
00:23:49,760 –> 00:23:54,480
it’s possible that criminal charges could be brought against individuals as well. So, there

220
00:23:54,480 –> 00:23:59,520
are concerns to make sure that you take it seriously and of course it’s the government and they can

221
00:23:59,520 –> 00:24:09,760
enforce their will. So, be cautious, be diligent. That is the, I think that contractors are actually

222
00:24:09,760 –> 00:24:16,000
held to a slightly higher standard than say a government entity like the city’s municipalities,

223
00:24:16,000 –> 00:24:23,680
that kind of thing, because we can have fines and I’m sure a city could too, but we don’t,

224
00:24:23,680 –> 00:24:31,120
we lose business then and we don’t want to do that or a contractor not compliant with the

225
00:24:31,120 –> 00:24:39,360
government regulations will lose that big contract that, you know, employees 25% or 50% of their

226
00:24:39,360 –> 00:24:53,520
business. So, it gets to be very real when you potentially lose something as significant as a

227
00:24:53,520 –> 00:25:00,800
good chunk of your business, but it’s not, it makes people suddenly pay attention as well.

228
00:25:00,800 –> 00:25:10,480
For sure, for sure. Well, thank you Todd and Ann for joining us today. I think we’ll definitely

229
00:25:10,480 –> 00:25:16,880
have a deep dive on this in the future. If you enjoyed this podcast, please like, subscribe so

230
00:25:16,880 –> 00:25:21,600
that we know that you’re into this subject. If you have a question or a topic you’d like us to

231
00:25:21,600 –> 00:25:31,440
discuss, reach out to us at info at cIT-net.com or head out to our website cIT-net.com slash podcast

232
00:25:31,440 –> 00:25:52,320
and we’ll be back next week with an all new episode.