Government Contracts And Cybersecurity With Mike Crandall
19th February 2020 • Business Leaders Podcast • Bob Roark
00:00:00
00:49:04
Shownotes
Working with the government can be very rewarding yet challenging especially when you are under contract. Today, Bob Roark talks to Mike Crandall, the CEO of Digital Beachhead which is a company that seeks to build customer trust and corporate value by delivering Information Technology (IT) and Consulting Services Solutions in inventive economical ways. Mike describes what they do, who their target audiences are, and what they look forward to. He shares how it is working with the government and how they find people to fulfill their contracts. He also talks about cybersecurity including how they protect their clients in this field.
Government Contracts: Joy comes when you start doing well and winning contracts.[/caption]
We used to call it double-dipping.
You’ve got to double-dip for a couple of months while you're on your terminal leave. I talked at the Air Force Academy a lot. I talked to the people that are getting out as part of their transition class and I tell them, “You can save up three months in that terminal leave.” I thought, “I'm going to do nothing in the first month.” I went to enjoy a 30-day vacation because everyone needs cyber people. I'm not going to get a job right away. I started putting out my resume, thinking, “Here comes to my job.” Thirty days later, I'm like, “I hope I get a job.” They did start rolling in. It wasn't as easy as I thought. I ended up working for a large firm. I started doing proposal writing and I won a few things that I wrote. They let me manage the contracts. They said, “If you kill it, you can eat it.” If I won the work, I could PM or Program Manage the work. I went from having a few contracts, I was program managing to where they're like, “We need to hire program managers. You don't have enough time.” I became the Director of the program managers. I worked up from the guy writing it to be the Director of Operations for the company.
Did you have any of that experience in the Air Force?
None. The only thing I had and I tell the guys in the transition, we are taught to adapt and overcome. We are taught to figure things out. Everything was a process. What is the process? When I first got my program management gig, after the first thing I won, I went to the Senior Vice President and asked, “What do you need? What does this mean?” He gave me the spreadsheets and told me we're looking about profit margins and this is what the people make. They said, “This is your wrap rate.” I asked, “What's a wrap rate? Can you explain that to me, sir?” He explained it all to me.
What is a wrap rate?
It is basically what your company puts on for costs, G&A, which is your accounting and running of your company, general expenses and you tack that onto what an employee is making. Effectively, that's what you're charging the customer. He said, “Do you want your percentage to go up in what you're making? You have to do that either by growing the contract, getting rid of employees who've been there a long time and hiring newer, fresher blood for less money.” There are all these different ways to do it. I jumped in and the thing in the military taught me was not to be afraid.
I know what crappy looks like. It doesn't look like this.
My wife always yells at me because I've told her many times, I'm like, “Calm down. We're not being shot at.” Which doesn't make her very happy at all to say that she needs to calm down because we're not taking fire. She's since adapted to that and tells other people, “Calm down. You're not taking fire.”
There’s no dirt in my food.
No one's lobbing grenades at me at night. I could face them and ask questions. I wasn't afraid to ask questions. I learned that in the military, if you don't ask, you don't know. Ask as many questions as you can and figure it out. I knew math. I was okay in math and I’m the computer guy. I used to tell my friends, “I did a lot of joint assignments,” and they always say, “We're the chair force or the Air Force.” I would say, “Our officers or your officers look at you and say, ‘There's a hill, go and take it.’ You're not all going to make it, but you're going to take this hill. As Air Force guys, I will look at our officers and say, ‘When you hop into that plane, sir, I do hope you come back and then I get a meal at the chow hall while they're all fighting.’” I said, “Which one was the smarter?”
Having been in the army, yes. That was pretty apparent for a long time. You have the military experience. You're in the computer space. You were on a leading edge of when computers were becoming mainstream. I can remember trying to network computers before networking was a thing.
I go back as far as a Windows 3.0, 5.0 and 1.0, which is where they took Windows 3.0 and 5.0 and Windows 1.0 was the networking component.
[bctt tweet="The hardest part in any government contract is showing you can do it and manage it." username=""]
What was the networking software?
They had Novell. It follows that. I learned on Novell. The Marines use a lot of Banyan VINES. I was fortunate enough that from 1991 to 1992, I worked with General Blaisdell, who is a colonel then and General Skinner, who was a captain then. We developed a barrier reef, which is the whole idea of having a DMZ and a Boundary Protection System and Defense-in-Depth. It was basically five kids that didn't know anything in a basement building and network with Linux boxes and Cisco PIX. That got passed out to the whole DOD. We were the first and no one cared. If they email it down, commanders had their secretaries printing them out and then writing on it and the secretary finishing it, sending it out or it's right to your desk and everyone needs it on their phone. I said that the military people now have an issue with the young guys coming in because of everything's click a box. The software comes and if you want a five email box, they click a box and say, “Five,” and it's all done for them while we were going into every line of code and saying, “What does this do?” “That was bad. Build it all again and start from scratch.” We got to understand how things work from the bits up versus plug and play.
We were talking before and I said, “How would you get trained to do this? You said you went to work for a company where you did it.” You got OJT on the company for a period of time.
I worked for that large company for several years. They thought foolishly, I was going around to every office pricing and the marketing departments and saying, “Let me help you. I'm writing these proposals and I'm winning a few jobs. I'm managing these contracts, what do you do? How do you do it?” At first, they were like, “Don't take my job.” I was like, “I'm not after your job. I'm happy doing what I'm doing, but that could help you by doing 90% of your work.” They perked up and thought that it was wonderful if I was going to be supporting them. I learned every position in the company. When I finally moved out on my own, I knew how to price. I knew what the wraps were and how they were divided and created and how G&A is incorporated.
I think about the old apprentice program, essentially. You go through and you apprenticed. Either they make you an offer that you can't refuse to leave or you already know enough to leave. You were at the breakpoint, you go in like, “I'm considering going to do this on my own.” You finally made the decision when you went home and talked to your bride. What was that discussion like?
I effectively evolved in that since I am a service-disabled veteran. I have a retirement and a VA payment that will cover the house, so we won't be homeless. We may have to live on ramen for a while, but can I have two years to live on the ramen? I had savings, but the joke was we'll live bare necessities for a couple of years and see what happens. I was fortunate within the first by a year three, I was at about $1 million in revenue.
We talked about $1 million in revenue. For the people that are reading going, “That's not net.”
That's the joy is when you start doing well and winning contracts. I remember that the first contract was $2.5 million over five years. My family was like, “You won $2.5 million? I was like, “I didn't win.” The company has won a chance to work and earn that money over the next five years. By the way, I have employees. That's where that goes.
You look at all the overhead unanticipated, if somebody raises the cost of something, it eats into your margin and the government has a narrow view on the margin.
For profit, it's against the law to charge more than 15%. It is the max by law and now you're competing with everybody, so start scaling down from there. You're lucky to get 5% to 8% when you're doing well.
I think about an increase in rent, utility bills and healthcare costs.
With insurance, we have won a contract for the US Forces in Japan. The one thing you don't factor in is, workmen's comp that you paid for insurance in America doesn't work in Japan. You have to buy something called the Defense Base Act, which workmen’s comp is pennies on the dollar. We pay about $12,000 a year for workmen's comp, DBA for our overseas employees. It's a big difference in pennies on the dollar.
You go, “Education is expensive in that world.” You made the decision to take and the wife says, “I'll put up with you for a while.” You're sitting there with your business firm, Digital Beachhead. What was the process like to go from day one to, “I'm going to start chasing contracts?”
It was eye-opening. I was ready to chase right away because I already knew how. I was like, “How do I respond to RFPs, which is Request For a Price or Request For Proposal. It's basically the government's requirements that you respond to. I knew where to find them. I knew how to get them, but you have to register with the federal government. I had to go through their database to get registered to be a federal employee. To become a Service Disabled Veteran Owned Business, I had to register with the VA so that they could verify. There are two types, you can self identify, which is fine. If you're VA certified then everybody knows that you're not just saying you're broken but the VA also knows it. Those took a long time.
They took longer than I thought. You couldn't even start chasing work until you had at least the registration with the federal government to be a contractor, then which funds, how do we run this business? We need money. Fortunately for us, we were a service-oriented, so we were trying to win butts in seats. We get a contract, hire the people to do the work. We had no initial overhead of employees or other things to worry about. My concern was when I do win that contract and I have employees to hire, how will I pay them? The government doesn't pay you if you're lucky in that 30 days, sometimes 60 days contracts and 90 days.
[caption id="attachment_4865" align="aligncenter" width="600"]
Government Contracts: Don’t be scared to compete with the big boys.[/caption]
You can take a bunch of contracts and go broke.
You won't see a dime for 60 to 90 days. I was going to the bank who said, “What is your collateral?” I had my laptop and my cell phone and said, “This is my business. This is all I need right now.” They're like, “Thank you. Come back when you have something.”
Did you find a lending institution that understands contracting?
I have. I funded it on my own, at first. You have to put up or shut up and I put the money in knowing that if you win a contract and you have that contract, that money is not at risk. The employees get paid well for the work they did and the government will pay us for that work. Whatever I've put into the employees to be paid, even if they cancel the contract after a month, they might take me 30 to 60 days, but they would pay for that month of work. There's no real risk. I've since found a company called StreetShares. They are a veteran-run business and they will effectively pay payroll for you on contracts you've won. If you go to them and say, “This is my contract. It's signed. We're ready and I need the money.” They'll turn it around in two weeks. They'll give you all if you need extra for miscellaneous insurance and other things that can incorporate that too. If all you're looking for is, “I need to pay my people for three months until the government pays me.” They understand the business and they're like, “We got that, we cover you.”
It is a good business model for them and a nice thing for the contractor. It is needs-driven.
They have a program if you want to work with them that way, where they charge lower interest but effectively, they become your receipt. The funds from the government go direct to them. They take out that first month for what they paid into payroll and they ship you the rest to your bank account, whatever you put in for your profit line.
They provide the cashflow.
They manage it all and take out their percentage. It's an easy-peasy handshake deal. Once you get going, you might want to manage it yourself and keep that percentage for yourself, but when you're one guy in your home office wondering how you're going to pay a bunch of employees for 60 days.
That's not been your background.
That was a learning process. I went to every bank in town and asked, “Can I do this? How do I do that? I got a business plan.” I even went back when we won the first contract and says, “Here's a contract in hand.”
I was talking to an individual here in town about various opinions on business plans and the quality thereof. When you went in with your business plan, had you written business plans before?
Only through college, while I was doing several years with a big company. I also used my GI Bill and got my MBA. All parts of that growing and learning as I was out. I hadn't written one, but I effectively went in with a pipeline. My business plan per se was simple. Win government contracts and make money. The real meat to me was going into the bank and showing these are all possible contracts that could fit within my relevancy.
Did they understand?
They had a good understanding of that. They’re like, “I had no money. I had nothing.” They literally said, “If you were starting a construction business, we could give you hundreds of thousands of dollars tomorrow because you'd buy the equipment with it.”
[bctt tweet="Corporate entities are both civilly and criminally liable if they're breached for the loss of their records." username=""]
They have collateral.
I tried to explain, “How about if I win a contract? I don't need your money. I'm asking you for a loan, but effectively, I don't need that loan until I had my first win and then I can tell you it's five people. This is the rate of pay over three months.” That does not compute to how they look at their lending, which I understand. It's not their normal business.
You've got your shingle hung out. You’ve got your computer and your cell phone at home. You’ve got to start looking for contracts and your area of expertise, which was what we call cybersecurity nowadays. I'm not sure that's the right name.
I tend to say cyber risk management because nothing is secure.
It's somebody else's less secure go over there.
You manage your risk. You can accept it. Do you want all your doors open? Part of your door...
---
Government Contracts And Cybersecurity With Mike Crandall
We have Mike Crandall. He's the CEO of Digital Beachhead. It is nice to be here. Thanks, Bob. Mike, thank you so much for taking the time. Tell us about your business and who you serve. My company is Digital Beachhead. It's a term I coined on a performance report back when I was in the military and the commander asked me, “What is a digital beachhead. How dare you to say you can protect it, that you're in charge of it and then you're so good at it?” I explained that he has email and that's what I protected. Instead of a typical beachfront, you have the digital one, which was everywhere. His eyes lit up and he was like, “That digital beachhead is everywhere.” Years later, the Under Secretary of Defense used it in a speech, saying that the adversary had secured a digital beachhead on our network. They went from my performance report to a Wing Award on up. The Pentagon had heard the word and that got incorporated in a speech. I bought the name. We primarily focus on cybersecurity for the federal government, but I am branching out to provide cyber risk management for small and medium-sized businesses. People don't understand the designations of many government contracting businesses and you have a specific designation. I am a Service Disabled Veteran Owned Small Business or SDVOSB. Going back a little bit, you served in the Air Force and in the Middle East. Talk about a little bit of that experience and how that started to help you start this business. Back in the day, before we had networks, during the First Gulf War, there were only a few PCs around. I had got in trouble for breaking into one of those PCs. The commander explained how much money they paid to protect them and they had software that was supposed to be secure. There was a two keystroke per entry to get to the DOS Prompt. He effectively destroyed my “I'm in trouble paperwork” and said, “You are in charge of small computer security for the Air Force.” I was one young kid who didn't know much. They sent me to school. I learned how to do some basic hacking and defensive work, as well as offensive work. In those days, you couldn't network in to break into a computer so we had to touch them. If the adversary had some computer systems that they needed information off of, we had to go physically to the machine, wherever it may be to gather the data. I got to work with some much more powerful and influential military people. The special forces people dragged me along as their computer boy. I trained with them but I wasn't raised as one. I tagged along for the ride. I think about the progress we all take to develop our careers. You had the Air Force time and then you had the time in the field and at some point, you rotate out of the military. Maybe it would be useful for the people that are curious, how do you go from being in the military and doing what you did to be qualified or where to do government contracting? What was your path? When I retired, I was in almost 21 years. I got out like anyone else and thought, “It's time to get a government contracting job and work doing the same job I'm doing, but for more money and wearing civilian clothes.” [caption id="attachment_4864" align="aligncenter" width="600"] Government Contracts: Joy comes when you start doing well and winning contracts.[/caption]
We used to call it double-dipping.
You’ve got to double-dip for a couple of months while you're on your terminal leave. I talked at the Air Force Academy a lot. I talked to the people that are getting out as part of their transition class and I tell them, “You can save up three months in that terminal leave.” I thought, “I'm going to do nothing in the first month.” I went to enjoy a 30-day vacation because everyone needs cyber people. I'm not going to get a job right away. I started putting out my resume, thinking, “Here comes to my job.” Thirty days later, I'm like, “I hope I get a job.” They did start rolling in. It wasn't as easy as I thought. I ended up working for a large firm. I started doing proposal writing and I won a few things that I wrote. They let me manage the contracts. They said, “If you kill it, you can eat it.” If I won the work, I could PM or Program Manage the work. I went from having a few contracts, I was program managing to where they're like, “We need to hire program managers. You don't have enough time.” I became the Director of the program managers. I worked up from the guy writing it to be the Director of Operations for the company.
Did you have any of that experience in the Air Force?
None. The only thing I had and I tell the guys in the transition, we are taught to adapt and overcome. We are taught to figure things out. Everything was a process. What is the process? When I first got my program management gig, after the first thing I won, I went to the Senior Vice President and asked, “What do you need? What does this mean?” He gave me the spreadsheets and told me we're looking about profit margins and this is what the people make. They said, “This is your wrap rate.” I asked, “What's a wrap rate? Can you explain that to me, sir?” He explained it all to me.
What is a wrap rate?
It is basically what your company puts on for costs, G&A, which is your accounting and running of your company, general expenses and you tack that onto what an employee is making. Effectively, that's what you're charging the customer. He said, “Do you want your percentage to go up in what you're making? You have to do that either by growing the contract, getting rid of employees who've been there a long time and hiring newer, fresher blood for less money.” There are all these different ways to do it. I jumped in and the thing in the military taught me was not to be afraid.
I know what crappy looks like. It doesn't look like this.
My wife always yells at me because I've told her many times, I'm like, “Calm down. We're not being shot at.” Which doesn't make her very happy at all to say that she needs to calm down because we're not taking fire. She's since adapted to that and tells other people, “Calm down. You're not taking fire.”
There’s no dirt in my food.
No one's lobbing grenades at me at night. I could face them and ask questions. I wasn't afraid to ask questions. I learned that in the military, if you don't ask, you don't know. Ask as many questions as you can and figure it out. I knew math. I was okay in math and I’m the computer guy. I used to tell my friends, “I did a lot of joint assignments,” and they always say, “We're the chair force or the Air Force.” I would say, “Our officers or your officers look at you and say, ‘There's a hill, go and take it.’ You're not all going to make it, but you're going to take this hill. As Air Force guys, I will look at our officers and say, ‘When you hop into that plane, sir, I do hope you come back and then I get a meal at the chow hall while they're all fighting.’” I said, “Which one was the smarter?”
Having been in the army, yes. That was pretty apparent for a long time. You have the military experience. You're in the computer space. You were on a leading edge of when computers were becoming mainstream. I can remember trying to network computers before networking was a thing.
I go back as far as a Windows 3.0, 5.0 and 1.0, which is where they took Windows 3.0 and 5.0 and Windows 1.0 was the networking component.
[bctt tweet="The hardest part in any government contract is showing you can do it and manage it." username=""]
What was the networking software?
They had Novell. It follows that. I learned on Novell. The Marines use a lot of Banyan VINES. I was fortunate enough that from 1991 to 1992, I worked with General Blaisdell, who is a colonel then and General Skinner, who was a captain then. We developed a barrier reef, which is the whole idea of having a DMZ and a Boundary Protection System and Defense-in-Depth. It was basically five kids that didn't know anything in a basement building and network with Linux boxes and Cisco PIX. That got passed out to the whole DOD. We were the first and no one cared. If they email it down, commanders had their secretaries printing them out and then writing on it and the secretary finishing it, sending it out or it's right to your desk and everyone needs it on their phone. I said that the military people now have an issue with the young guys coming in because of everything's click a box. The software comes and if you want a five email box, they click a box and say, “Five,” and it's all done for them while we were going into every line of code and saying, “What does this do?” “That was bad. Build it all again and start from scratch.” We got to understand how things work from the bits up versus plug and play.
We were talking before and I said, “How would you get trained to do this? You said you went to work for a company where you did it.” You got OJT on the company for a period of time.
I worked for that large company for several years. They thought foolishly, I was going around to every office pricing and the marketing departments and saying, “Let me help you. I'm writing these proposals and I'm winning a few jobs. I'm managing these contracts, what do you do? How do you do it?” At first, they were like, “Don't take my job.” I was like, “I'm not after your job. I'm happy doing what I'm doing, but that could help you by doing 90% of your work.” They perked up and thought that it was wonderful if I was going to be supporting them. I learned every position in the company. When I finally moved out on my own, I knew how to price. I knew what the wraps were and how they were divided and created and how G&A is incorporated.
I think about the old apprentice program, essentially. You go through and you apprenticed. Either they make you an offer that you can't refuse to leave or you already know enough to leave. You were at the breakpoint, you go in like, “I'm considering going to do this on my own.” You finally made the decision when you went home and talked to your bride. What was that discussion like?
I effectively evolved in that since I am a service-disabled veteran. I have a retirement and a VA payment that will cover the house, so we won't be homeless. We may have to live on ramen for a while, but can I have two years to live on the ramen? I had savings, but the joke was we'll live bare necessities for a couple of years and see what happens. I was fortunate within the first by a year three, I was at about $1 million in revenue.
We talked about $1 million in revenue. For the people that are reading going, “That's not net.”
That's the joy is when you start doing well and winning contracts. I remember that the first contract was $2.5 million over five years. My family was like, “You won $2.5 million? I was like, “I didn't win.” The company has won a chance to work and earn that money over the next five years. By the way, I have employees. That's where that goes.
You look at all the overhead unanticipated, if somebody raises the cost of something, it eats into your margin and the government has a narrow view on the margin.
For profit, it's against the law to charge more than 15%. It is the max by law and now you're competing with everybody, so start scaling down from there. You're lucky to get 5% to 8% when you're doing well.
I think about an increase in rent, utility bills and healthcare costs.
With insurance, we have won a contract for the US Forces in Japan. The one thing you don't factor in is, workmen's comp that you paid for insurance in America doesn't work in Japan. You have to buy something called the Defense Base Act, which workmen’s comp is pennies on the dollar. We pay about $12,000 a year for workmen's comp, DBA for our overseas employees. It's a big difference in pennies on the dollar.
You go, “Education is expensive in that world.” You made the decision to take and the wife says, “I'll put up with you for a while.” You're sitting there with your business firm, Digital Beachhead. What was the process like to go from day one to, “I'm going to start chasing contracts?”
It was eye-opening. I was ready to chase right away because I already knew how. I was like, “How do I respond to RFPs, which is Request For a Price or Request For Proposal. It's basically the government's requirements that you respond to. I knew where to find them. I knew how to get them, but you have to register with the federal government. I had to go through their database to get registered to be a federal employee. To become a Service Disabled Veteran Owned Business, I had to register with the VA so that they could verify. There are two types, you can self identify, which is fine. If you're VA certified then everybody knows that you're not just saying you're broken but the VA also knows it. Those took a long time.
They took longer than I thought. You couldn't even start chasing work until you had at least the registration with the federal government to be a contractor, then which funds, how do we run this business? We need money. Fortunately for us, we were a service-oriented, so we were trying to win butts in seats. We get a contract, hire the people to do the work. We had no initial overhead of employees or other things to worry about. My concern was when I do win that contract and I have employees to hire, how will I pay them? The government doesn't pay you if you're lucky in that 30 days, sometimes 60 days contracts and 90 days.
[caption id="attachment_4865" align="aligncenter" width="600"] Government Contracts: Don’t be scared to compete with the big boys.[/caption]
You can take a bunch of contracts and go broke.
You won't see a dime for 60 to 90 days. I was going to the bank who said, “What is your collateral?” I had my laptop and my cell phone and said, “This is my business. This is all I need right now.” They're like, “Thank you. Come back when you have something.”
Did you find a lending institution that understands contracting?
I have. I funded it on my own, at first. You have to put up or shut up and I put the money in knowing that if you win a contract and you have that contract, that money is not at risk. The employees get paid well for the work they did and the government will pay us for that work. Whatever I've put into the employees to be paid, even if they cancel the contract after a month, they might take me 30 to 60 days, but they would pay for that month of work. There's no real risk. I've since found a company called StreetShares. They are a veteran-run business and they will effectively pay payroll for you on contracts you've won. If you go to them and say, “This is my contract. It's signed. We're ready and I need the money.” They'll turn it around in two weeks. They'll give you all if you need extra for miscellaneous insurance and other things that can incorporate that too. If all you're looking for is, “I need to pay my people for three months until the government pays me.” They understand the business and they're like, “We got that, we cover you.”
It is a good business model for them and a nice thing for the contractor. It is needs-driven.
They have a program if you want to work with them that way, where they charge lower interest but effectively, they become your receipt. The funds from the government go direct to them. They take out that first month for what they paid into payroll and they ship you the rest to your bank account, whatever you put in for your profit line.
They provide the cashflow.
They manage it all and take out their percentage. It's an easy-peasy handshake deal. Once you get going, you might want to manage it yourself and keep that percentage for yourself, but when you're one guy in your home office wondering how you're going to pay a bunch of employees for 60 days.
That's not been your background.
That was a learning process. I went to every bank in town and asked, “Can I do this? How do I do that? I got a business plan.” I even went back when we won the first contract and says, “Here's a contract in hand.”
I was talking to an individual here in town about various opinions on business plans and the quality thereof. When you went in with your business plan, had you written business plans before?
Only through college, while I was doing several years with a big company. I also used my GI Bill and got my MBA. All parts of that growing and learning as I was out. I hadn't written one, but I effectively went in with a pipeline. My business plan per se was simple. Win government contracts and make money. The real meat to me was going into the bank and showing these are all possible contracts that could fit within my relevancy.
Did they understand?
They had a good understanding of that. They’re like, “I had no money. I had nothing.” They literally said, “If you were starting a construction business, we could give you hundreds of thousands of dollars tomorrow because you'd buy the equipment with it.”
[bctt tweet="Corporate entities are both civilly and criminally liable if they're breached for the loss of their records." username=""]
They have collateral.
I tried to explain, “How about if I win a contract? I don't need your money. I'm asking you for a loan, but effectively, I don't need that loan until I had my first win and then I can tell you it's five people. This is the rate of pay over three months.” That does not compute to how they look at their lending, which I understand. It's not their normal business.
You've got your shingle hung out. You’ve got your computer and your cell phone at home. You’ve got to start looking for contracts and your area of expertise, which was what we call cybersecurity nowadays. I'm not sure that's the right name.
I tend to say cyber risk management because nothing is secure.
It's somebody else's less secure go over there.
You manage your risk. You can accept it. Do you want all your doors open? Part of your door...