Name: The GovCon Security, Compliance, and AI Intersection: Trends and Insights
Uploaded: 2026-08-11T19:31:17.479Z
Duration: 1 h 2 min
Description: The GovCon Security, Compliance, and AI Intersection: Trends and Insights

Transcript for "The GovCon Security, Compliance, and AI Intersection: Trends and Insights": Hello, everyone. I'm Michael Greenman, senior product marketing manager here at Deltek. Thank you for joining us today, for our presentation. While you're joining, a few quick housekeeping notes. For the best webinar experience, please use Google Chrome. And if you have a question, please type it into the q and a box at any time during the presentation. We'll address as many questions as we can at the conclusion of the webinar, and any questions left unanswered will be addressed individually offline following today's presentation. Resources, including the presentation slides, are available for you to download in the resources tab on your screen. You'll also receive the on demand recording of today's webinar via email within twenty four hours after the webinar ends. Looks like we've got a great group here today, so let's go ahead and get started. I have the pleasure and honor of welcoming and inviting Katie Arrington, who is the current Chief Information Officer at IonQ, but more famously, the former, Department of War chief information officer. Katie, welcome. Thanks for joining us today. Thank you for having me. Excited. Wonderful. And you all will have to, have the honor and privilege as well of asking your questions and getting Katie live and, unfiltered, here on the webinar today. But leading into that, part of the presentation, we wanna go into a couple of items, a couple of areas of interest, that came out in our, most recent Clarity GovCon study that Deltek does annually. And we're gonna cover IT and security landscape, as it came to be this year, as well as AI, artificial intelligence, both adoption and the anxiety kind of associated with that we'll dig into. Then we're gonna kinda wrap up with zero trust and quantum computing. Very, very, light topic, I'm sure, but we've got the expert on with us to chat about that. And, probably what a lot of you are here to talk about and and listen to, is where CMMC stands and and what's coming next. So we're gonna get into all of that and more, and then, of course, q and a with Katie. So, if you're ready, we'll go ahead and take off. Okay. So the Clarity GovCon survey, if you're not familiar, is the longest running study of its kind, in our industry. We're in our seventeenth year, and with more than 900 government contractors across The US and Canada, spanning over a dozen industries in eight functional roles, That's what makes up our survey results for this year that we're gonna be talking about the results from. What makes it useful is not just the size, and it's that we don't just tell you what the average contractor is doing. We've isolated the top performers, and the most AI mature firms in the dataset so you can see exactly what separates the winners from everyone else. And we put it into a scorecard that you can actually benchmark against your own organization line by line. So you can download these reports right now at deltek.com/clarity if you wanna follow along. As we get into it today and talk about the findings and get Katie's thoughts and feedback, the headline this year, is a tension that every one of you is very likely living in right now, speed versus control. Growth expectations are up, but 90% of firms saw at least one financial metric decline, and compliance costs are rising, for nearly all of them. And the firms that are pulling ahead are the ones that are moving faster without losing operational and financial control. How do they do it? That's the gap that we're gonna talk about today. And, not only where Deltek fits in, but what other organizations, specifically, ones that Katie can speak to, have done and are doing out there, for your pleasure and benefit today. So without further ado, we're gonna kinda dig right into it, and get into the IT and security landscape. Top challenges of this year by far, new software, new implementation, new stuff. As always, operating with a smaller budget, but rising costs inflation at the same time. It's the same old story. That's not new. Retaining talent, is always a challenge, no matter where you're at, what industry, whether it's government or government related. But more importantly, AI governance, and really AI in general, wanna get Katie's thoughts on this. AI is both kind of the fear and the cure for IT leaders. Is that kind of what you're seeing, Katie, in your travel your time at, Department of War? Absolutely. Actually, it it continues to be a day to day challenge. So hi, everybody. Thank you both. Lisa is not on screen, but Michael, thank you for inviting me. Thank you for Deltek for putting this on. But absolutely, AI is sucking, I think, all the oxygen out of the room at the wrong time, to be fair and honest. We're spending a lot of time talking about it, but we're not really thinking about beyond the fact that we want to use it and play with it. How many of you actually understand that, you know, the tools that you're the SAS offerings you're bringing in have AI behind them? And, you know, when the DoW recently put out that they wanted, anthropic, to be removed, does that mean all of your tools that you're using that are using anthropic as well behind behind that wall? I I just I'm concerned, and I and I love AI because here, ionQ, we love AI like nobody else. I mean, we're we're doing it as well, but the governance and where it's being used and applied and how it's taking over is scary to me at the fact that we're not paying attention to the, you know, the the the stuff that's presently at danger. We're very consumed about AI, and it's sucking a lot of the oxygen out of the room, a lot of the resources, for budgets that people just didn't anticipate. I don't know about you guys at Deltek, but I can tell you at IonQ, I didn't have a line item for AI last year. I do this year. And no new you know, we're we're a growing company, but out of my IT budget, I really had to sit down and talk to the users, the engineers, the developers, how much they're using so I can get that into my budget, my line items. So it has become truly one of the hot button issues, I think, at the wrong time. You know, I I wish we'd had this discussion five years ago about AI, when it was really at the forefront. We're kind of mid, you know, in the if you look at we're at the adolescent stage already, and I'm I'm concerned that we're spending more time talking about it than actually figuring out best ways to use it. Yeah. And as we get into the the numbers a little bit further, we'll talk a little bit about how everybody, at least in the survey, is is using or planning to use AI. But there's really kind of a maturity gap, which comes in when you talk about governance. And, you know, as always, shrinking budgets. Right? Number one challenge, managing all of this, you know, with all the threats, and all the potential upside of AI, that's not cheap. No. And, you know, the respondents, in the survey this year, kinda gave us that feedback. Quick high level overview of of some of the key findings, amongst IT and security. 85% of IT leaders, rate data security as their most important technology investment. I think sounds pretty straightforward, pretty reasonable. It's not optional, but it's existential. 97%, plan to use AI, in their IT and security operations this year. Adoption is nearly universal. Really curious, in your current role, former role, and and the people that you talk to, your your wide wide network, Mhmm. of IT as business leaders, is that what you're seeing and hearing as well that, you know, AI in IT and security ops is is nearly, like, universal? Oh, absolutely. I don't think there's anybody that doesn't see that. But like I said, my question, it goes back to, you know, my time in the department. For something new to start, something old has to stop. So if you're working on a program that's been you know, you're in the government and you're on a a five year acquisition, you know, What are you stopping in order to bring in AI? Those are the things that, you know, it's to me, it's concerning. But, you know, the 85% on data security, I don't think that I honestly spend more on that, because the data to me, the intellectual property is the most critical thing at at my company and for my clients, and our customers. But we're investing heavily in AI tools. Where where I think people are leaning a little bit is do you do your own organic? Right? Do you build your own, or do you buy one of blank? And that's where I think companies are trying to figure out much like cybersecurity. Right? Is it better to organically do it, or is it something it's better to to outsource? I I. think that's where the the money kinda rocks and rolls in. Yeah. And what's in scope, what's not in scope. Right? Yes. Pre setting up the discussion about CNMC. Right? Scoping is a big part of the discussion. But what do you think about ransomware being the number one security concern across all businesses? I I I believe your perspective of all would be very enlightening on this. Well, if people actually did what they were supposed to do, ransomware wouldn't be a problem. Yep. If we had the right training and we had the right cybersecurity culture, we would look, right at, you know, when the phishing schemas are still probably the most pervasive, they've gotten exponentially better. And, you know, that that training is critical. And, you know, that that's where the CMMC, you know, it was never supposed to be a compliance issue. It's are you creating that culture? And, you know, we live in this world, right, trust but verify. Why would you open an email? I mean, I I I I got a new I broke my iPhone last weekend, and I had to get a new iPhone. I know. And I don't know about the rest of you, but that is traumatizing. It's it's worse than getting a divorce when you have to get a new device. It's it's hard. But the signal app had kept asking me for my keys, and I literally I I had to stop myself. I looked at it, and then I went to Claude, and I asked Claude the question, and it immediately pulled up the news report about how signal was you know, there were people people of interest being targeted for this this particular thing. I am. one of those people that always gets targeted. Yep. And if I didn't know better, right, So but that's my cyber training. That is. that is critical thinking. Ransomware is the number one concern because most people, you know, they're not paying attention. They're just flowing through their day and they're opening emails as they go. And. that it is what it is. Right? You either gonna get people that are trained and you take it seriously or you're not. Yeah. And I heard, recently read somewhere that, you know, because of models, that are readily available to everybody now with a cloud or OpenAI or wherever, that spear phishing is becoming so much more sophisticated, and that's what that sounds, like. and deep fakes. I mean, I can't begin to tell you. You know, I love browsing the Internet to see how many deep fakes of myself are out there. Right? But this is why a culture of cybersecurity is critical for any business to survive. Just it it it is what it is. Yeah. As we dig into the numbers here a little bit deeper, let's talk about those challenges, right, that go along with this. So, basically, the way that I position this and have been positioning this is I've talked about it this year. Here's what's keeping IT leaders up at night. So number one challenge cited by over half of respondents is AI governance, which we already kind of covered. They're deploying AI, but don't have frameworks to manage the risk. Nope. That's essentially at the end of the day, governance, that's what we're talking about. Who who sets up the guardrails? Who configures the guardrails? Who makes sure they're actually gonna work for your business? Right? Because everybody's a little bit different. So followed by shrinking IT budgets, at 41% of respondents, and they're being asked to do more less as usual. Right? And, you know, regarding, challenges, in and of itself, AI governance isn't just a nice to have. It's the top IT challenge. Right? Alright. Organizations are racing to adopt AI but struggling to govern it. 36% can't find or keep IT talent. You know, the folks that you want in your organization, whether internally or as a third party, to be able to, keep it up to speed, and working through cybersecurity compliance assessments, speaking of CMMC or, the rare, maybe more frequent now, DIPCAC assessment, on NIST eight hundred one seven one controls. So, regarding the threats though, on the threat side, ransomware targeting CUI, is the number one vector, and we were specific to add CUI, into the discussion about data, extortion in this case or exfiltration. You know, AI is simultaneously the biggest investment priority and a growing attack surface, speaking to what you were mentioning before. So boil this down for us and and the audience, like, with all of these things, anything shocking on here for you or anything that, you know, that you see, is out of lines or perhaps needs further attention? No. I mean, I'm just sitting here while you're doing it, and I whipped up my phone to to ask Claude, my. new best friend, by the way. He and I have gone like, we have gone like this. So you gotta think about it. The uptick itself, they're stating that this year, and this is Claude, that we've lost about $52,000,000,000 this year to ransomware attacks. And if you think about that, you know, small businesses don't generally have a a slush fund. Right? So if you're talking to major corporations, they generally have a a ransomware fund. I know that at IonQ, one of the the the questions when I was getting my cyber insurance and, yes, everybody out there, there is cyber insurance. And, oh, by the way, yes, they do ask about your CMMC certification full stop. It's, you know, we have it's it's there for a reason, and that was part of it. Right? What are you doing to prevent the the likelihood of a ransomware attack? So I think that's absolutely and the AI, I mean, we we talked about it. The the sophistication is just mind blowing at how good they're getting. So we have to be better than that. Right? And that is even it's for the average IT professional trying to stay on top of what AI is bringing in, how it's coming at us, and then you've got mythos. Right? Let's not even bring begin to talk about what that brings to the game. You absolutely have a threat landscape that's growing by the hour. It is not shrinking. It is growing. And what are we doing to get our our arms around it? That's why I say, you know, the AI too that that got out of the gate five, six years ago. I mean, I go back to when I led the supply chain on COVID, and now I feel old. Right? Here we are in 2026, six years later. But remember, I I told from the very beginning, I used AI in that supply chain. That's how I was determining things, and I was ingesting it then into the department and and into FEMA and into HHS. I mean, we've been there, for smaller. And and I love the fact that I I'm not pointing fingers, but I would love the government to come up with a midsize classification. I love that they keep putting out small, mid, and large size. I would love to know what a midsize company is. All I know is that small business, you roll out about three year average of $48,500,000 on average for NAICS codes, and then you roll into large. And. if you're earning $48,000,000 over a three year rolling average, a ransomware bill of even 2,000,000 in Bitcoin is gonna cost you? And how many people have actually taken the time? So at at IonQ, I actually did a business we did, my CISO and I, we did a war game where we did ransomware. And we we we did the cost of how much it would cost us to be down for a day. And just think about that. It's not the fact of what you lost. Right? That's you know, because if you were if you're not if you don't have business resiliency already built in to what you're doing and a backup plan and backing up your backup plan, but just the downtime with your customers, that was more impactful to me than actually having to reset my systems. That impact the customer. So we have. it's it's and that's something that, you know, insurance isn't going to cover you because you weren't doing the right things. And that's why they were using the CMMC as a guardrail to say, okay. Are you doing the right things? But I don't disagree with anything on these. CUI guys, it's still a hairy, ugly mess if you ask me. It's it's and, you know, before we got on the call, we are in the Green Room, and Lisa and Michael and I were talking. And I still stand on on the fact that the CUI, we're looking at it program by program. It's the compilation of the data at your environment at your company that the adversary is desiring. They want the whole enchilada. But the devil is in the details on that, and and I'll get into that in a little bit further down Quick aside, the ten second answer to this. Do you think the far CUI rule or, you know, whatever it's gonna be commonly known as, should that make its way through, the sausage making process helps correct. some of that for contractors and subcontractors? Absolutely. They do it right. And this is where AI could be a great tool. Right? So wouldn't it be wonderful if we used AI to actually tell us what was CUI in in a body of work. Right? And then, like I I said on my, you know, my LinkedIn post, which I'm trying to not, you know, get too out there and and say, but use the CMMC with a scalpel, not a sledgehammer, and use AI in in the regards of what is CUI. Because right now, you know, I said a lot of the primes, which, you know, Michael, I I jumped on board and I was clapping up and down when I was in the department when I saw all the large primes saying, you know, we wanna use CMMC for our entire supply chain. Well, that that was a wonderful Katie initial thought, but then the secondary, tertiary thought came through that, oh, snap. They're making people go through and get CMMC too that don't have any reason to be. And that is where we really need I think AI could play a huge role if I'm miss Davies, the honorable Davies. I'm thinking about how to use AI for CUI to make sure that we're marking the data appropriately because, remember, I I hate I gosh. I hate that I'm this old, but 2017 is next year, decade ago. 2019. Right? I'm sorry. But where we were in this game, if you think about it, but what are we protecting? And we really need to ask ourselves, what is valuable here that we're willing to spend the money to protect it? And using AI to help us on that is huge. And we didn't have that in in, you know, when the CUI rule first came out. I think it's it's the moment where, day miss Davies can make her mark, right, and change the way the government goes forward in deploying AI in this use case, not lessening the cost of of of the compliance to secure it, but actually fine tuning what we're securing. Make it more impactful. Yep. Mhmm. And so that kind of segues well into this, next slide here. You know, compliance is no longer just a back office obligation. Right? So 96% of government contractors in the survey, expected compliance costs to stay the same or even increase over the next three years. So that's not foreign, right, to to the folks that, we we've been surveying for many years. 54% expect an outright increase. Basically, this isn't this isn't this isn't a cycle. It's a structural change in the cost of doing business, not only just for Department of War, but across government, especially as the requirements for CUI seemingly are going to expand, though, you know, Department of War is gonna have the most. CMMC certification is probably the clearest example. It's increasing, you know, the awareness of the costs of getting to the point where you should have been, you know, going back to DFAR. 12. But it's if anything has brought that awareness. And a lot of people, and we'll we'll chat about this a little bit further, you know, tend to mesh those costs together, the the cost of evaluation versus cost of compliance. that is so frustrating to me. That is so frustrating because when you sit down and you first think you know, when I first came into the this world and I sadly, I'm twenty years in now. I'm getting old. And this image makes me remind me I needed to get my Botox appointment. But that that right there, right, would we're we're opining over something that we should have done ten, eleven, twelve years ago. And gosh, guys, I know industry, I hear you every single day. I'm part of you now. Remember that. Like, my company, IonQ, where we are we are in mergers and acquisition. We just closed on SkyWater last week. I just bought another company, and tech debt is a real thing. And I I am that person now. I like I said, I am very rare because I am the the person who wrote the laws as a legislator. I owned a small business. People forget I owned a software development company. I was a small business. I sold my business. My husband still owns a small business. I've worked at large. I was a Booz Allen. The chip is still there. I worked at a service disabled veteran owned. I was the CISO in gov I was behind the the wall in the government. And I can tell you, is it Joni Mitchell you can see with the song, I can see all sides now? I can't remember that that you do, but I can I see all sides now? Right? And I see the pros and the cons. And I what I would say is that the cost of compliance, if the government wants to reduce the cost of compliance, are they going to do away with the ISO 9,000? Are they going to do away with Deltek, DCM DCAA approved rating systems? Right? Are we going to reduce the cost of compliance for all things? And if so, okay, then let's talk. But if you're just talking about cybersecurity, the cost of compliance of that, I would say that the machine on the the shop floor being able to be programmed remotely from your adversary or competitor is more of a risk to me than, you know, I have OSHA to tell me and and I have state inspections to tell me whether I'm safe or not. That cyber lens is something nobody's paying attention to but the CMMC. And. on the other side, people that have said, you know, well, no other industry does that. That is so wrong. Michael, when was the last time that you well, I I put this in a and I I I apologize to the poor soul that LinkedIn me at 2AM when I woke up. Someone asked me a question and I said, you know, when you go to the doctor's office, you don't question the security of your health information exchange. You just don't. Nope. And you don't question in a hospital the fact that that nurse walks into the room or the doctor walks into the room, and, wow, they are hard on MFA there, aren't they? That if you're gonna you've gotta scan your wristband. They've gotta put their their check put their PIV card in, then they have to enter a code. We're so concerned at that area of of our world that that is worth it. What about national security? What about weapons security? What is what all of that, the free the the banking or capitalistic markets, the fact that we do have the best health care in the world, all of that comes with the cost of cyber. Yep. But all of that is dependent on our military being able to defend us at home and abroad, and if they don't have the very best security, Yep. then we don't. This is where the common cause comes in. Right? This is where I really get passionate about it because it is not government. It is me. It is you. It is our young men and women that are fighting wars right now tonight and today around the world. And if we're not doing the utmost best to make sure that they're protected, then we are not doing the best to protect ourselves. And I am so incredibly impassioned about this. Compliance isn't a back office obligation. It is not. It is the cost of doing business. And if you care enough about your health to pay for the insurance and the the the rates to be there or you pay enough in your your FDIC insurance for your bank, why don't you care enough about your national security? I just I I can't move off of that. I'm sorry. As as far as away as I get from the department, I still come back to that. Yeah. That's your passion. I think everybody sees that, and that's why you are still, a leader in this, and many other things related to affirmative war and government. I thank you guys. I'd I'm it's it's a real thing. I hear you. So I'm gonna pivot a little bit, over to AI, artificial intelligence. I know you feel passionate about this one as well, and we're gonna get back to CMMC as a topic. So definitely stay tuned, everybody on the line here. So just high level numbers here. We've chatted about it already, that artificial intelligence, whether as a means to an end, an enhancement to business, a differentiator, or, you know, in the sense of IT security, cybersecurity, perhaps an effective countermeasure, once maturity is baked in. These are the same numbers we kind of reported on earlier here. Big adoption rates, low maturity, at this point in terms of governance and those kind of details. But where I wanna dig in here for a moment is about that maturity part. So this is where the real opportunity lives. So looking at the AI maturity bar, 75% of of respondents in the survey this year, are still piloting or scaling their AI programs, which is good if you're trying to move the needle overall. Right? If I'm selling AI systems, this is this is a good sign. It's a good time to get in. Only 5%, of respondents consider themselves fully developed. Again, that in and of itself might be a bit, subjective, but it's a pretty low number anyway. But here's the. critical insights that I'd love to get your thoughts on, Katie, here with the government's governance gap. Only 25% have established or advanced AI governance frameworks. We've touched on that. That means three out of four organizations are deploying AI without a formal structure to manage it. You know? Are are are they doing good, or are they making terminators? Yep. You know? Who knows? Right? The data shows that companies with mature governance are two times more likely, to be in the AI mature subgroup, in the report. Governance isn't a speed bump. It's a prerequisite for scaling AI effectively for a lot of reasons that I'd I'd love to get your thoughts on. But companies that skip governance in rush to deploy it are gonna find themselves creating new vulnerabilities, going back to cybersecurity, faster than they can close existing ones. And so these top planned use cases, I wanna get, again, your thoughts on this, with 40%, gonna use it for IT support, automation, help desk, makes sense, Vulnerability detection, and patching, 36%, Mhmm. one out of three. You know, but the top concerns here, 48% worry about data privacy. Going back to the health care example you mentioned, 39% about inaccurate AI outputs. They seem to want AI, but they want it to be there's Katie. They want. it. So, trustworthy. Michael, on that, do you see that? Mhmm. Yes. What's wrong so that is what AI thinks I am. Yep. Now it? has a fun interpretation. I've played that game before too. It it misses. a couple things. What is it missing right there? It misspelled the word authority. Yep. Like, guys, you can't trust the AI unless you understand the AI, and the governance has to be in place. What are you willing you know, it's fun to bring AI in. And should it do workflows? Absolutely. I mean, we should be using AI to to lessen the the menial tasks. But the OODA loop, does everybody remember the OODA loop? Right? Observe I I can't remember. Observe or whatever. But it's the human in the loop. Observe, detect, logical. I I can never remember that acronym. But it just means that you need to look at all the data and all of the indicators and all of the things, and then the human must make the decision. Using AI for workflows all in. Using AI to develop code scares the out of me. Yeah. Right? Because unless you can lift up the hood and see how the developers were were developing it, I mean, DeepSeek was not a fluke. And we all, like, we forget about DeepSeek. We're two years out. Right? Nobody's talking about DeepSeek. We very early in the department of war, I I happen they eight were able to demise that and see, you know, what it was doing. But models have to be trained. And if they're not trained appropriately, they will go off the radar. And that governance is critical. I'm hoping that in in this time of CMMC pause, that they learn to use AI for the betterment where I don't wanna see it, and I I won't use it in my company. Right? And my CISO is is firm on this. If you write an SSP, you better ready and you better be able to talk to me about it. Don't have AI create a document that you have no idea what to do. Yeah. And. the biggest thing I can say on this, to everybody thank you, mister Kalia, for orient, observe, decide, act. Thank you. In the comments. But when we we have to really get to understanding what is it we want it to do, how are we regulating it, How often do we use it that we don't? And and I I don't think one of the big fear factors for AI is it's gonna take over jobs. It's going to do you know, I'm gonna I'm gonna go back old school. So we we went somewhere already, and I don't think people realize this. Back when I ran for congress a bazillion years ago, the federal minimum wage was a thing. Right? And what happened when states or the federal government put a top line rate on basic labor? You saw Walmart sell checkouts, McDonald's sell checkouts. You saw that. And you've watched as that that went that way, but now we've come back to the other side. Right? People crave the human interaction. So I don't think. that AI is going to replace as many jobs as people fearful of. I believe that quantum, where I am, is creating a whole new workforce that no one's even touched yet. But if you're using AI into your benefit to do the small stuff, to offload your brain to do better things, if you're using it to develop code, you better be running that through some serious you know, if they can remember, if it misspells the word authority, you're trusting it with binary? Just saying. The governance gap is there, and I don't think we've we've gotten to it yet. But using AI to supplement good safety and security practices is not a good idea. And for those of you on this call and listening, if you are in a state owned enterprise in China and you mishandle their information, you are given one hour to notify them. One hour. You defy that, you're fired. Here in America, you leak CUI, you have seventy two hours. We are not playing a game we can win that route. So I just you know, use AI to the best that you can. Be smart about it, but don't let it replace truly the critical thinking that the human has. Yep. And this, could segue into barriers to AI adoption. Buyer beware. Right? And how? much are you spending? Right? Those tokens ain't they ain't for free, my friends. Nope. I think people are running into that more often than not now, especially with these, more advanced models that are coming out, which are amazing. We use, you know, various AI models here in Deltek for various purposes, and I'm sure you do as well at INQ. yeah. Absolutely. And it's the same concerns. Right? We always have our human in the loop. We have our guardrails put in in in place, and, you know, we're building that into our products to an extent. But these concerns you see here, I mean, they're very straightforward to us. Right? You know, data security. You know, what is the ROI? We constantly have to talk about that, when we're talking about the value of what AI can be in product. Nobody's gonna replace you. That's not the point, as you point out very accurately. That's always the fear. But really what it is is it's an opportunity to uplevel. And, you know, I myself and and many of my colleagues, we're challenged with that. You know, it's not this is here to replace you. This is here to uplevel your skills. So. challenge accepted. Right? It makes us, you know, better employees, you know, better operators. But I go back to you and it seems you are well, versed in and subscribed to. We need maturity. Right? AI maturity in our operators as well as the governance and making sure that there are rules that people follow. And, I mean, I use AI, you know, at I on q, we're we're we're taking a lot of, tech debt. Right? I'm looking at when I'm taking mergers and acquisitions in and I'm I'm bringing them in, I'm having AI analyze what is the best and most effective way. It will come up with three different COAs. Right? It's up to me to go actually research and make sure and validate that information, but it's taking a tremendous amount of legwork off. But I will tell you, and back to the the the top of the discussion, in government budgets, let's remember, we are still in the CR from 2024. People forget that we are in a continuing resolution since 2024. We did the big beautiful bill, the reconciliation package, but we are still in a CR. So no new starts for the most part. There were were caveats in the reconciliation, but what in a program is willing to stop to put AI in? And that's where we really need to look at that ROI and the lack of expertise. I'm I'm becoming proficient. I am nowhere near an expert, but I thank gosh. I have Claude to tell me how to become one. Yes. We'll go those daily, AI does a wonderful job telling me how to be AI. Yeah. He's gonna be looking at this. I didn't know. Look. But it's true. I mean, that's true of really any technology, whether it's AI or or something else. You you could apply these standards across the board, any any. of new, groundbreaking technology. We're gonna get into quantum too, and I'm sure that's, very part and parcel to that discussion. Alright. So last one here in the AI section, pretty straightforward, technology investment priorities here. You know, data security, cybersecurity, compliance are really top of mind for the respondents, for this year, and you can kinda see the stats. But, you know, aside from what, you know, this particular data output talks about, the key findings, what you know, what's real world? Right? What what were you hearing at the department, before your time, expired there? And what are you hearing, in your role now at INQ when it comes to technology investment priorities from real government contractors, from real businesses that you talk to? So number one, supply chain. I'm gonna say to everybody on this call, supply chain, supply chain, supply chain. And the act on semiconductors, goes into effect next year. So you gotta think about your supply chain, who's using what. I was the lady who did NDAA eight eight nine, and I remember Huawei and ZTE. The supply chain is definitely where our most you know, the supply chain is how our adversaries know who to attack on the cyber security side. They know who's getting CUI, and they also know who your who are your suppliers. And they're going at least intrusive ways to get there. Right? I will say that as as quantum, and quantum is a thing, right, this is going to skew drastically in the next eighteen months. And I say that people don't understand what quantum is today. The reason I came out of the Pentagon to go work at a quantum company is because I saw the writing on the wall. And where we were ten years about cybersecurity is, you know, let's think about this. All of the things that we're talking about are basic things. Right? How many people are prioritizing on this this spreadsheet? I don't see any money in changing my encryption. And in fact, there isn't even a thing on there about encryption. We're talking about a supply chain. We're talking about third parties. How are you going to protect your data when you have been using RSA encryption for the better part of twenty years, and that gets broken next year. Big organization. And that's a new paradigm. That's where the government is struggling because that that was the highest thing on everybody's list, munitions and securing it. Munitions and securing it. Now I don't agree with all that. I will just say that securing it is where people that cost is not really shown in there. And I think in the next two years, that is going to be a cost to businesses that they didn't even think about that they had to have. PQC, the two executive orders that recently came out, that's game changing. And that's why I left the department was to be on the other side of that because I knew it was coming. But out of that technology investment next year is going to be cryptology and how you're protecting your data. Yep. We can kinda tell where the puck is going. Oh, absolutely. In the interest of time, we made it. We're here at CMMC, and we're gonna get into Quantum as well. But I know a lot of people, have joined the webinar here today to get your thoughts, on this program you might have heard. of called CMMC. Upstart, you know, hasn't been around for very long. I'm kidding, obviously. So we've been tracking, It's older than me. we've been tracking, CMMC response data in our Clarity survey for a few years now. And this year, we, asked a lot more information, about costs and, priorities, things like that. And and this is the result that's out here. And while I kind of park this here, I think the, to the old, you know, game show $64,000 question is, where are we going, with CMMC? Like, what what's your read? What are you feeling? What's your top line answer to that? So I I did a LinkedIn post when the pause first came out because the honorable Davies, you know, what CMMC is a four letter acronym until you're in the department and you understand it. I could appreciate the pause to look at it, to understand it, although we've done this before. I mean, this is this is kind of where I'm frustrated with the government because the demand signal was clear and concise. No exceptions do the right thing. Now with that, I stated just equally that we kind of abuse the system. And I'm praying that cooler heads prevail and they understand that you don't level, you know, the the the statement of the bureaucratic requirements for compliance. No. No. No. No. No. No. No. No. No. If you wanna do something really effective, and everybody on this 599 people, if you really want to save the government money, you should write your legislators and ask them to get rid of the paperwork reduction act. And most people don't even know what that is, and y'all should Google that. They put that law into effect, I believe, in 1987 or 1994. I can't remember off the top of my head. But if you affect any more than 10 contractors, you have to make it a rule. And if you wanna save money, get rid of that requirement, that regulation. That is foolish. What I originally designed in the CMMC was a dynamic model, was exactly what the arsenal of freedom is about, dynamic and modular. And I never wanted it to be a rule. I wanted it to go in sections l and m and to be used where we needed to secure specific data. The government got in the way, and the government made the CMMC become a rule. Now it is a rule, and you have to weigh out this. Business is business, and you have had companies invest and start up. Remember, there was no money to start the CMMC. The cyber a b, all of the c three PAOs, all of the auditors, all of the people that went out because the government said to go do that, they have sunk cost in. So we have to take that into consideration because as much as they wanna say that you know? And I appreciate secretary Loeffler. She's very intelligent and knows her numbers and her stats for small businesses. And, yes, 80% of all businesses across all, you know, market sectors in The United States Of America, 80% of small businesses don't do more than a $100,000 a year. Granted, you're right. That person selling Etsy is a small business and probably not doing more than a $100,000 a year. That person that is doing, you know, printing stickers off at home or, you know, does a small event planning company. No. They're probably not, but they're not working in this sector. So I'm I don't I think the pause will be using AI to figure out what CUI is. The government had programs out there. Now I've heard rumor. I haven't you know, and I'm not in the government, and I am on my time out time, folks. So listen. You're you're not talking to I am a source of level headedness because I'm a businesswoman, and I'm a subject matter expert on cybersecurity and supply chain. And I can tell you that in no way, shape, form, or fashion is secretary Hegseth going to come back and say get rid of the NIST one seventy one. That that just isn't gonna happen. Are you willing to work with someone where you're trading CUI if you're the prime and you're the flow down that I'm gonna take your word that you're doing it? And in this day and age, there's nothing that we do that we don't trust but verify. So I think that it will remain. How often we have to get certified may be up for debate. I was definitely one that that wanted, I think, the more of a fiduciary responsibility with the auditor and the company they audited because it it the way I originally thought about it, and I've talked about this at nauseam, but the small business that doesn't know that to go to the the the the NSA cyber collaboration center and get that download or the patches that are most import important for that day. And with Methos out there, there's zero day now. It is literally zero. day, and that's a real thing. And if you take that CMMC away right now, I think it's a death curse. You're you're gonna hit into a death spiral. You also have to be considerate. The, you know, secretary, Loeffler and, you know, the honorable Davies and honorable Duffy, and the secretary of war and the DEP SEC, Feinberg need to take into consideration that multiple countries as well dove into the CMMC. And we're talking, you know, global countries. Right? You know, Canada, Singapore, Japan, others got involved. So it's not just a small question. It's a larger question. And I think that, the cooler heads will prevail. There may be a more, you know, like I said, using a scalpel. And if, you know, if, miss Davies was the you know, to make that change is how do you use AI to determine CUI? I think that is such a win for her all in every day twice a win for America, a win for everybody. So I hope that's what comes out of it. K. We're getting, close to the end of time here. I wanna make sure we get. to, Quantum here. So quick item on cost, another big debate, in the industry. You know, any Listen, quick thoughts on this? I can tell you this. I have done right now, I have eight small businesses. I haven't spent more than than 45,000 on doing a CMMC. Now. if you're getting gutted because you haven't been compliant and you've gotta get there, well, that's a cost of compliance and that's a different thing. And if somebody has come if somebody's coming into you and saying that they need $250,000 to get you compliant, that that that must be you must be an MSP coming in and you're gonna give me three sixty five, and you're gonna give me a GCC high environment for more than, you know, 75 people. If you're just coming in to advise me, don't pay that, guys. That that's that's just business sense. You the requirements are there. Hell, you can put it into Claude, and it will tell you what to do. So that cost of the audit is, I think, on the high side. I think this has also been a wake up call to anybody that was trying to be a snake oil salesman. So. good on Davies for that because she maybe, you know, got some good people, you know, to pay attention to what was important. Mhmm. Yeah. So another sense of CNMC exposed another underlying issue, Yeah. the defense industrial bit. yep. Yeah. And then, you know, kinda last slide here on CMMC with the suspension. I know you wanna do a quick, announcement of saying, hey. RFI responses. Do respond to the our vibe people and be honest. Okay? Don't don't belabor it with it's too much. It's too burdensome. Do you don't don't do that. Come up with real things that you think can I I know I submitted ours? You know, I talked about AI. I talked about better ways to look at CUI, watermarking, etcetera, using with a scalpel, not a sledgehammer. But don't put in, you know, don't because remember, there's a human being on the other side of this that has to answer that question. Every RFI question must be responded to. And please don't waste those excellent government servant civil servants time with pettiness. Let's get to the part of the matter and ways that we can make it better. And if MCODE is a great program, great. Okay. I think a a loan program would be a wonderful idea from the small business administration in the department that if you stay in good standing right over ten years, you know, a rising tide raises all boats, right? If we really care about our national security and our economic security, that means small business security. So small business administration coming out with a loan that pays over ten years. And if you are in good standing with the federal government and you're doing work, they should be relieving you of that debt after so many years. I think that is a excellent RFI. I think that is an excellent win win for everyone. That's just Katie's, my thing. But those are the things you should be saying, not compliance is hard. How to help me get compliant if you haven't built it into the rates? And and that's another thing you should put in an RFI. Are you really doing, realism on the cost rates? Cost realism is the thing, and lowest price technically acceptable is is a four letter word in my book. Well, let me get on let's move on to that one because I think we've with that one. This next slide is Yep. this is where I want you guys to focus. If if you can go one more to to get. to that one. Alright. Plus it's security. So boys and girls, ladies and gentlemen, children of all ages, the game is is still the same game, but remember, CMMC is how you handle data. Right? CUI. Zero trust is your structure, the outside. So I tried to make this and by the way, I used, Copilot to do this lovely drawing here. Your zero trust, everybody should look at what the, oh, Russ Vaught, the director of OMB, put out on June 26, the memo that states that if you're gonna be doing anything in the quantum east or crypto or or or or you must be building in a zero trust architecture. I think as well, you're gonna look at AI models saying that the models must be built in a zero trust architecture, which is, you know, that you're doing everything to you assume the adversary's in and the lateral movement is what you're you're keeping them from doing. Trust but verify. So on this, what I'm what my big come to you guys are is at Quantum. Quantum is real. IonQ put out the walking cat architecture. We have told everybody we're going to break the queue day. It's 256 qubits. When that happens, yes, we will be able to solve the world's biggest problems. But the first things first in those two executive orders that came out was how we're gonna develop a PQC strategy for your company. The reason you need to have a post quantum strategy is because quantum computers, whether we break it or China breaks it, they will be broken and basic level encryption. And what the other part of the email is asking about is, do you have for all of those cyber wonks on here, do you have a cryptographic library? Do you understand what cryptology you have? And do you have the resources to prioritize what you need to get cleaned up before Q day? And Q day is gonna happen sometime in late twenty seven, early twenty eight. And when it happens, it's gonna be silent. And a lot of systems are just gonna go off. They're just gonna get turned off. So think about that. This this what I'm trying to show is when you don't have any encryption in your your environment, that's bad. You that's why you have zero trust. CUI is just inside your environment. It's a particular way you handle data. If you're working with critical infrastructure, our adversaries and our allies all are moving out in QKD. And I know this is a a touchy subject because NSA is not down with the QKD, but our allies and our adversaries are. So I think that there's gonna have to have a discussion on that coming out. But that's where Katie Arrington's mind is as a CIO of a quantum company. I am CMMC level two. I haven't stopped, and I won't stop. Yes. You can still get a c three PAO, and you can still get an audit right now. There's nothing stopping you. I say go before the rush. Keep coming. Keep moving. It's up to us in industry to show the government that we mean business. It is a competitive advantage. It is a differentiator that you're taking it serious, and then, yes, the government can have a sigh of relief. Because where we we fall fall down is that we have an acquisition community that does not get a tremendous amount of of education in these areas. And they're they're relying on things like the CMMC to help them go through. So I think that everybody should stay the course. I think that everybody and it's don't be an echo chamber. Don't if if everybody, the 575 people on this call are all people in the ecosystem, you're in an echo chamber. And remember that. You've gotta get outside your echo chamber. You've got to tell government why it matters and do it from a point of what is the cost of not doing it. Okay? The cost of noncompliance. And I will argue, and we can, you know, quickly look at what is, and I'm gonna do it again right in front of you guys because I this is how much I use AI. What has been the r and d cost for the f 47 to date? So the f 47 now just think about this. You have paid in today over $8,000,000,000 in r and d building the f 47. $8,000,000,000 in taxpayer dollars have gone into building one weapon system. That if the adversary gets it because the people that are in charge of making it because remember, the department, the federal government doesn't make anything. We do. What is the cost? And you can't tell me that the cost of compliance is more than losing the r and d on just the f 47. Think about that, folks. You are spending $1,500,000,000,000 annually now on the defense budget. Do you not think that it needs to be secure? And Katie Arrington is not in the department. Katie Arrington is here because I will tell you while I'm reading your questions on this. Right? I think that I think the refresh or part of the refresh is awesome. I think the pause is awesome. Take a look. There are definite ways we can use AI to make it better. Absolutely. We need to think about that. The certification is such a minimal cost to the compliance. Focus on the compliance and the RFI. Come up with ways the government can help do that. Don't lessen the requirement. Don't ease it. That that that's only plays into our adversaries. I'm seeing the question, is the word army word you know what, folks? Reach out to the M code office. I've heard rumor, but I I would say reach out to them and see what they're doing right now. Army M code was a huge program to help companies with the cost of the audit, not the cost of compliance. I saw, questions on here about clouds. Several questions. I do that, Katie, we'll take a quick break. I'm gonna I gotta throw up a poll question on here and, sorry. give you a quick, drink of water, take a breath, and I'll answer a question here. So, for those of you, thank you for sticking with us in the presentation. Gonna do some q and a with Katie. But before that, if you wouldn't mind, go ahead and answering, would you like to be contacted, by a Deltek sales representative, to learn how our AI enabled platform, supports cybersecurity compliance. I'll give you a few minutes to answer that. more people should be looking at that. Well, I'm gonna say, I'm looking at that. You're sitting on this webinar today. You're hearing from me. Yeah. I would definitely take it and just see what there's offering. That's my my gist of it. No harm. No foul. Right? harm. No foul. I can take one of the questions here that, is related to Deltek, and then I'll I'll pass it over to you, Katie, for a couple of our presubmitted questions as well. How does this, information impact Deltek's push to migrate Costpoint to a cloud based solution? And what is, Deltek specifically doing to migrate, to the cloud, based on use of Costpoint? So as we've discussed, Ed, you know, in detail in this presentation today and Katie has emphasized, security is everything. You know, our case in part of Costpoint solution, we can't confirm, verify, or check, you know, the securities around your Costpoint data if it's not hosted in our environment. We've taken the steps, at least with our GCCM offering, to put Costpoint into a secure cloud environment that gets biannual audits, is FedRAMP moderate equivalent, and all the things that we've we've injected a lot of security in there, ISO 27,001, CSA STAR, level two certification. So we've we've put a lot into that one to secure the data that's going into your ERP. We're not, you know, the only one doing that as a cloud service provider, but, you can trust that, as you mentioned before, cost points used by many, many, government contractors for the DCAA compliance. And so the other half of that is the cyber compliance, whether for your DFARS seventy twelve requirements, which have not gone away, and then when CMMC, level two certifications, third party assessments our our back end, and, you know, the far CUI role as well, if and when that takes off. So thank you very much, for your feedback with the poll. We're gonna take a couple questions here. Katie, do you want me to just toss them up? Go ahead. Alright. When let's see. What do you anticipate we already kinda answered that one. How does, take it for what it is. It's written this way. How does the Department of War see cloud providing value for CMMC compliance? So originally and I I will make this quick. We we went round and round about this. Right? Getting a a cloud environment for small businesses to use. The the bottom line is and you should, you know, put it in the r five, but the liability. What if your IP is somehow tampered with in that cloud environment? Because you are putting your intellectual property in the same environment you're putting other small businesses who are saying that they're not they're they need help getting good too. So garbage in, garbage out, you gotta worry about that. If it's a zero trust environment, fine. If the government's gonna build the cloud, okay. But then remember, you better have damn good contracting for your intellectual property to take it out of that cloud. K. It was kind of a longer one, but it was interesting when I saw this come across. For subcontract subcontractors handling CUI, does phase one require a minimum spurs slash NIST eight hundred one seven one score of 88, or is that 88 threshold only triggered under phase two CMMC certification? Before I go further with the question, what is this referring to? Are you familiar with this? Is this a thing? Yes. It is a thing. So what if you're handling CUI, you should have an 88. Right? That was in phase one. But, yeah, I will double back, and I I will profess I'm not the expert on the the letter of the law, but the 88 was, basic to receive Cooley, right, on your spurs. And just so you all know, spurs, supplier performance risk scores are are calculated. They are looked at. The DIPCAC is looking at. The PMs are looking at them. Be honest with yourself because you're being held accountable to that. Putting anything in there that is false information, opened your company up to the False Claims Act. Anybody you know, the law changed, and I talked about this before. There were many things that happened over the past several the False Claims Act changed where anybody, instead of somebody from the company, anybody can provide a false claims against the government that you are defrauding the government. And if you're you know, you're at a 50 and you're putting an 88 in there, are you are wide open for something bad to happen. So be truthful. That's what I would just say. Be truthful. But the 88 is in phase one. And we'll we'll get one last question in here for you. I think I'm sure it's a lot of, a lot of people's minds. How can getting a level two CMMC certification even right now become a competitive advantage for a small business and enable them to win more business, either as a sub or a prime? So I know that in my world, when I go and I'm looking for business partners, I ask for it. As the CIO of a company, of a publicly traded company, I ask for it. If you're gonna come and do work with me, I am not gonna spend my time, my dollars, my small IT budget going out to make sure you're okay. That's your job. You need to come to the table ready to play. That's what I would tell everybody. I'm ready. You know, you don't walk into a restaurant and say, here's a $150. Can you pass the health inspection? And I know that Eye on Cue, I take it very seriously on my supply chain that if you're working with me, you better be at level two. Oh, that's great. I wanna thank you so much, Katie, for spending the hour with us today, and all of the attendees appreciate you, sticking with it. Before we officially conclude, we wanna remind you that you will receive, an on demand recording of today's webinar via email within twenty four hours. And if we were not able to get to your question today, there were a lot of them, we will be sure to follow-up directly with you offline. And with that I giggle, Michael, Yep. really quickly? Stacy. Bosgenik is on here, on the questions, and she responded. 88 requirements of the 110 must be met. Stacy, we love you. Stay active. Stay going focused, guys. Thank you all so much. Love the interaction. And with that, thank you for joining us again today. Please visit deltek.com for more upcoming Deltek events. Have a great rest of your day. Thank you. Thank you.