CynergisTek, Inc.

2020 is behind us, and it's great to be talking with all of you now. As a company that is heavily penetrated in the healthcare provider market, our clients have been and continue to be on the frontline of this pandemic.

And our business saw the impact almost immediately, as hospitals made room for COVID-19 patients, put elective procedures on hold and stop doing anything that was not directly tied to patient care. Last year, about this time, when our business slowed down abruptly, we did not stop working, instead, we started asking, what changes, what is this new normal look like, and how do we refine our strategy.

Telemedicine is accelerated by five to 10-years, working from home, outside of the protection of the corporate network is now the norm versus the exception. And the concept of a healthcare breach is no longer just about losing data.

It likely means your entire institution is locked up of ransomware and it becomes difficult to treat patients. As customers pull back, we started to innovate and develop entirely new post-COVID relevant offerings that would be in demand by our clients, compromise assessments, privileged access management services and security validation, just to name a few.

We also started well to focus on expanding our addressable market, and our relevancy and close adjacencies to healthcare, while at the same time, we opened the door to new regulated markets that can leverage our skills, processes, technologies and our existing resources. In Q4, we saw the start of a rebound of our professional services, which we highlighted in an announcement in January of a $700,000 deal, with a large health system.

We saw new logo assigned and our services continue to be in demand, including deals with Valley Health and Fairview Health. We started to see the benefits of our diversification strategy in the close adjacencies in healthcare, that are clocking real volumes of protected data during the pandemic, with the signing of the deal with a large State Department of Public Health and our announcement of a contract with Ball State University.

And we saw expansion in the existing clients across our base, including a large academic medical system, and expanded deal with Logitech. Now, late in Q4, budget began to free up, and we saw the first increase in our booking for the quarter in over a year, which manifested itself at a 10% increase, and our presold revenue and a more diversified pipeline positioning us well for growth in 2021.

And as vaccines become available, healthcare workers have been the first to get shot in their arms, and well, that makes us opportunistic and optimistic that this will also accelerate a return to pre-pandemic business conditions. So, that’s the story in healthcare, but it's by no means all we have been up to.

In my first Investor call, just over a year ago, I talked about the opportunity we saw to expand the company beyond healthcare. That diversification has been core to my strategy, and today I want to talk with you about the opportunity we see to be a big part of securing the Defense Industrial Base.

Unfortunately, cyber-attacks at American Defense Industrial Base are, well, not unusual, as evidenced by the most recent SolarWind's breach, and the Microsoft exchange vulnerabilities making headlines this month. It’s estimated that the United States is losing $600 billion a year, in foreign adversaries to exfiltration, data theft and the loss of intellectual property.

To address this threat, U.S. Military Defense acquisition is moving from a self-assessment model to a rigorous framework that requires third-party assessment for all 300,000 vendors in the Defense Industrial Base, which handle controlled unclassified information.

This new initiative, known as the Cybersecurity Maturity Model Certification, or CMMC. CMMC is unlike other cybersecurity regulations, as it requires a comprehensive security maturity that has both breadth and depth, but it also has real teeth.

Simply put, if you do not meet the requisite security requirements, you will not win your government contract. To prepare, secure and assess 300,000 defense contractors, over the next few years, will require a small army of consultants and assessors, likely several thousand strong.

We believe the emerging market opportunity for both assessments and the remediation services, which we expect to be three times the opportunity of assessments alone to be in the 10s of billions over the next five years. We recognized the opportunity more than a year ago, and we believe we are uniquely positioned to capitalize on it.

We are not a government supplier today, we are completely independent, and that's an advantage. All of our current employees are U.S.

citizens, and approximately 17% of them are U.S. military veterans.

With CMMC leverage is nearly identical frameworks to what we use in healthcare, where we already have intellectual property in place, including automation, training and quality control. Most importantly, we have 60 assessors already in position, that we believe can meet the required qualifications, once the certification process fully opens up, allowing us to enter this market with existing resources and capabilities.

Now becoming a CMMC assessor is not a trivial process, required training, credentialing, background checks with people, along with new controls, procedures, and an enhanced security posture of our organization is significant. We are one of the first companies to be approved as a third-party assessment organization.

We have a provisional certified assessor of our ranks. It represents one of the first 100 in the program.

And we are ready to provide our organization, authorizing us to do consulting work now. And I want to announce today that we have already begun closing consulting deals, helping government suppliers prepare for the CMMC initiative.

The next critical step for us in this process, which is already underway, and will continue over the next few months is to have the Department of Defense conduct a review of our security posture. Our strategy is twofold.

We remain focused in healthcare, and we are seeing the signs of recovery. But we also believe that the CMMC effort, along with customer diversification efforts and investment in our go-to-market in new industries can get us growing at a much higher rate than our baseline growth strategy.

With that, let me turn the call over to Paul.

Thank you, Caleb. This year was all about constantly reacting to what the market threw at us during the pandemic.

This reaction included numerous efforts to reduce costs, improve efficiencies and respond to customer pullback due to budgetary constraints. As a result of the impacts from the pandemic last year, we expect Q1, 2021 to be our revenue low point, down approximately 10% from Q4 of 2020.

But as Caleb said, we are seeing strong signs of a rebound with an increase in our presold revenue. And our Q4 bookings were the highest we experienced in over two years.

Given that our revenue in some cases can lag bookings by several quarters, and our emphasis on closing long-term recurring revenue contracts. It will take some time to show in our numbers.

From a balance sheet and financial resources perspective, we ended the year with $5.6 million in cash, that included a net issuance of $1.8 million of the $5 million eligible takedown of the ATM under our shelf registration. This was done at an average price of $1.54 in the total share issuance of 1.3 million shares.

We still have the $2.8 million in debt that we received under the Paycheck Protection Program, and we expect the majority of the loan will be forgiven. We are also expecting tax relief as a result of the CARES Act, where we expect to carry back available losses from this year to the extent possible, which at this point exceeds $1 million.

Outlined in our Q4 standard financial disclosures, revenue decreased $1.1 million to $4.7 million, but it was up 4% over Q3. The decrease from prior year was due to lower revenue from managed services, which reduced by $0.3 million to $2.8 million due to the impact of some customers canceling or delaying renewals, and a reduction in net new customers due to the pandemic.

Professional consulting services decreased $0.8 million to $1.9 million due to lower revenue from synergistic business, as a result of pandemic, offset by an increase of $0.2 million in revenues from Backbone. Again, this Backbone increase was lower than we had projected, due to a pullback our customers use of third-party services that are again directly related to the pandemic.

Gross Margin was 37% for Q4, 2020, compared to 40% in 2019, and it improved from 35% in Q3. As I mentioned in my highlights, the improvement in gross margin is due to staff and expense reductions we made over the last couple quarters, while with reduced travel in reaction to the lower revenue and the COVID-related travel restrictions.

Sales and marketing expenses decreased to $1.1 million for Q4, 2020, compared to $1.4 million for the same period '19. This decrease was due to lower headcount as we looked to rebuild part of the sales team and lower stock-based comp.

We do expect this to increase as we get back to full headcount levels, and our investment in marketing to support our increase go to market activities. G&A expense decreased by $1 million to $1.1 million for Q4, 2020, compared to the same period of '19.

The decrease is due to $1.1 million in temporary and permanent expense reduction efforts, taken to improve operating margins for 2020, offset by $0.1 million in additional costs for Backbone. We do expect expenses to increase going into 2021, as we start to reinstate some employee benefits that were suspended in 2020, in reaction to the pandemic, but we'll react as we see how 2021 shapes up.

During the quarter, we did record a non-cash impairment to goodwill and intangibles amounting $16.5 million. Our non-GAAP adjusted EBITDA loss was $0.3 million for Q4, 2020, compared to $0.4 million for Q4, '19 and $0.8 million in Q3 of this year.

Full year financials and reconciliation of GAAP to non-GAAP information can be found in the earnings release that came out today. Caleb highlighted our growth strategy during his discussion earlier.

The funding through the ATM was a step in supporting these initiatives with a small infusion of capital. We're bullish on the long-term prospects for the company, and any subsequent capital raises would be with a mind to accelerating growth and creating incremental value for shareholders, beyond the current plan.

This concludes the financials and prepared remarks for Q4, 2020. Operator, please open the floor for questions.

Good afternoon. Thank you for taking the questions.

And it's nice to hear that things are starting to free up a little bit here. I guess a few questions.

First off, on the CMMC opportunity, you said that you started to close some deals. Maybe if you could help provide a little bit of detail regarding size, timing?

Why these evaluations versus consulting? Any additional part would be helpful.

Sure. First of all, thanks for asking the question, Matt.

Okay, so the way you have to look at this is this is a government initiative. And, it's really an all the bias and things are slow and bureaucratic.

And there are multiple hurdles to go through. And, that's not unusual in this space.

But I'm going to explain in a second Matt, why that's actually proven to be very advantageous. The reality here is that we today can go out and make money doing consulting work, to help companies prepare for the CMMC initiative, and it's an enormous amount of work.

We just went through it ourselves. And, we're a security company, we have lots of these policies and procedures in place.

We had to put new solutions in place enormous amounts of documentation. It's not unlike what financial folks go through in a Sarbanes-Oxley audit and preparing for that.

It's rigorous, it's detailed. You have to have multiple forms of evidence to prove that each control is in place and working properly.

So, that work we're actually authorized to do right now. And we started closing deals there.

On the other side, actually doing the assessments. We're one of the first companies that's kind of cleared the hurdles to be authorized to do that.

And what's most important there is there's only 100 people out there today that have the credential that had been trained and authorized by the DoD to do this work during their provisional period. We have one of those assessors on our staff.

What we are waiting for now before the DoD will open this up more widely, is the actual assessment of our security posture. So, us and the other leading companies that are in the first wave of going through that security assessment now, and as soon as that is completed, then the actual assessment will open up now.

So, the prep work, the consulting work, I think, these deals can vary anything from, hey, I need a few hours of time from somebody to understand what's really involved here to, I need help building the comprehensive documentation, which could be literally 1000s of hours of work.

Okay. Got it.

So, as far as timing for revenues from this is probably more that we should be thinking about like Q2, Q3, when these will start to layer in?

We're starting to see revenue for it now. I would say when I think this is really going to heat up, is when the government starts opening up contracts that will actually require the CMMC certification.

The initial approach was to have 1500 government contractors through the process this calendar year. It looks like we're a little bit behind in that.

Now, I'll tell you, as much as this is cumbersome and there's a lot of steps to go through, you got to remember every step, every hurdle that we have to go to also weeds out competition in this space. So, I just become more and more bullish that further we get into this, realize the sophistication of it, and the fact that a lot of companies are going to be able to handle this.

Got it. Okay.

And then on the healthcare side, it sounds like things have started to free up. And obviously, as we start to see the vaccinations having an impact, and we start to see the elective procedures happening and hospital budgets starting to improve a little bit.

Maybe walk through, are there -- I would assume you've got a pipeline of opportunities, some of which maybe were put on pause last year, some of which are maybe new, given even the Microsoft situation here a couple weeks ago. But how quickly, do you anticipate being able to close some of those?

And how will that start to be reflected in the financials?

So, what happened here, Q4 obviously saw a lift of opportunities that in my opinion had been delayed during the year as people, those that had budget left spent it in Q4. I think as we kind of look forward from there, we are definitely starting to see things pick up.

In almost every case, the actual buyer is ready to go. We may still see some extra hurdles with procurement and financial teams, as they work through the challenges of recalibrating finances and budgets coming out the other side of the pandemic.

But overall, we're really starting to see that return. The other thing not to lose sight of is there were some very significant, well somewhat catastrophic impacts late in Q4 to many hospitals due to ransomware.

And this was no longer the case of just a hospital going down. Adversaries were targeting entire systems.

We saw in two cases, the remediation costs exceed $60 million. And I think those have the attention of cyber insurers that are now looking at real risk in this case, but also the recognition from many systems that they're realizing, if they don't show up their defenses, they're not going to be able to stay open in a ransomware incident.

Interesting. Okay.

And maybe one last question for Paul. I think in your prepared remarks, you talked about expenses starting to maybe ramp up a little bit here in fiscal '21.

And just for point of clarification, are you talking about kind of recovering a little bit versus Q4? Or are you talking year-on-year?

So for example, sales and marketing call at $1.1 million in Q4, that was down from $1.5 million in Q1 of '20. Will Q1, you start to see that go off of the $1.1 million and maybe getting closer to where you were in Q1 of '20?

Or just to help us think about the ramp in those expenses over the course of the year? Thank you.

Yes. This is specifically as it relates to sales and marketing, that's exactly right.

We're looking there for the Q1 numbers to ramp back. Q1 and really into Q2 to get back up to that Q1 number.

And that's what we're expecting the run rate to be about the same as we saw in Q1 of '20.

Okay. Got it.

All right. Thank you.

Thanks, Matt.

Hi, Caleb, Paul.

Hi, Jeff.

I have a couple of housekeeping questions for Paul, as my interview first came up. What would you guess is your goal or your hope for achieving the distribution business as a company in a few years between healthcare and the defense industrial space?

Is it like 50/50? What's your image of what you'd like to see?

It’s a great question, Jeff. I mean, the first thing to remember is, although we say healthcare in government, I think most people's first reactions those sound like two very different animals.

The reality on our side, if you put yourself in the seat of one of our assessors, it's almost identical work. So, even though we're moving more into government, it's a lot of the same thing we do today.

Here's the way I look at it, there are about 5,000-ish hospitals in the United States, so that equates to and this is rough math, let's say roughly 1,500 systems that are slowly consolidating down to even less. So that's your addressable market in healthcare, 1,500 systems.

And obviously they are adjacencies to healthcare, which we think of providers, which is kind of our strong suit. If we then pivot over to the government side, there's 300,000 military contractors, and that's just to the U.S.

military. There are already signs in interest in other parts of the government, particularly homeland security, in leveraging the same model for their suppliers.

So, the addressable market here on the government side is, what, 35, 40 times larger than the addressable market on the healthcare side. And, I think we've done a nice job at capturing a decent market share in healthcare providers.

I'd like to do the same thing as part of the CMMC initiative.

That suggests, I presume, your growth rate could be vastly higher with your view down the roads. Is that a fair assessment?

Well, I think it is a -- let's put it this way. I would love to say yes to your question, the only thing holding me back from that, Jeff, is its government.

There are hurdles we have to get through. And a lot of this is going to come down to the number of contracts and the pace of contracts that the government decides to put underneath this initiative.

They have said that they want to get all 300,000 vendors through this program in the next five years. And if that is the case, I do think the growth rate here could be quite significant.

Great. And I have a couple of housekeeping questions for Paul.

Paul, on the $6.5 million write off a casual view which suggests that means that the former management, not including Caleb, pay twice as much as they should have for the CynergisTek acquisition, that it might have been just driven by the stock price, having declined to a point where you're forced to review it, if I understand accounting rules right. Could you give us a little more color on the right conclusion to draw from the write off?

Yes. You understand the accounting rules better than most, yes.

So, Jeff, you're absolutely right. The stock price in and of itself require -- put us in a position where we definitely had to analyses the business in more detail and take the steps that we did.

In addition, we came to our conclusion, we had to use our market cap at the end of the year as a barometer for what the ultimate fair value comes to. So, we are really -- that the share price at the end of the year had a lot to do with ultimately where we ended up.

Okay. I thought that was the case, but I was going to be sure.

And the other question is, your $2.8 million PPP loan, are you still expecting all or almost all of it to be written off within a reasonable period of time?

That's our expectation. We submitted all the paperwork with the SBA.

Our bank has authorized the submission to the SBA, so they did their part and put forward that their recommendation and then given the requirement, given the size of the loan we have to fill out the necessity questionnaire, that was the last minute addition the process. And so it’s in submission and then it’s really a black hole to me right now.

Okay. Thank you very much.

Thank you, Jeff.

Hi, Caleb. Thanks for taking my questions.

Hey, Paul. Two quick questions.

What is the share count today? And where are we with presold revenues as of today?

In the 10-K we announced where we got $17.2 million in presold. And then from an outstanding share count $12.1 million.

So, is the presold through where we are today, is it higher than it was at the end of the year?

It should be. Yes.

But I don't -- we don't have final numbers. Still haven't closed the quarter.

Okay. And if you say that if I got what you said to prepare remarks, you're looking at 1Q, I mean, we're almost done with 1Q here looking at it down 10% year-over-year.

For revenue in the past, down 10% from Q4.

From Q4?

From Q4, 2020. Correct.

Okay. More than 10%.

And is most of this driven by, I mean, you talked about a client who either didn't renew or a client was that most of it you from that? You got a single client.

A large percentage of the drop in presold and the drop in revenue was from a specific client, our largest managed services client at the time, when they had to cancel due to budgetary reasons.

So again, just to clarify, a large percentage of this decline is because of a client that cancelled that you previously talked about.

Correct. The contract continued through the first quarter of this year.

Cancellation was for the renewal and go forward expansion.

It sounds a little confusing. At the first quarter for 1Q, '21, you were guiding to 10% sequential decline.

That still includes that client or that is due to that client?

It does. We have -- the base business went through Q1 of this year.

That's correct.

Can you elaborate a little bit on the decline? If it's not because of this large client who has cancelled why do we seen such a big decline?

And more broadly speaking, Caleb talked about a lot of that issue there.

It wasn't a full quarter of revenue. So that's one of the -- and we had a number of cancellations and things that occurred throughout the year.

Those cancellations again, didn't occur upon the date they cancelled. They may have extended for additional periods.

They just indicated they wouldn't be renewing the business, so we still had revenue tailing off or trailing off through this first quarter.

Have any of these cancellations that are non-renewals indicated that that they now that business has improved for them, they will come back?

Not at this point for those that had actually cancelled, we have not seen them. For those who have delayed we have seen those -- we have seen delays come back and ultimately side renewal.

Can you elaborate? I have just a quick question for you, and then I'll turn it over.

But, you talked about the dynamics in the healthcare space. I've talked to some other cybersecurity companies that smaller than you, but approach to healthcare space.

They're talking about a massive rebound in 2021. And I'm just trying to get an understanding of what aspect of your businesses isn't working properly, so that you're not participating in what seems to be a rebound in the cybersecurity in the hospital and healthcare space that some of your competitors are seeing?

Thank you.

I think that's your conclusion, not mine, Avi. I mean, we're absolutely seeing things pick up.

I think not only we are seeing budgets come back, but in fact, many of you have asked us before when does healthcare start to take security seriously, many of them saw that during the pandemic. I mean, imagine having an entire system locked up with ransomware for a month, or you can barely treat patients in the middle of a pandemic.

Multiple hospitals, 12 hospitals went through that in November of last year. So, the whole dynamic has changed and I think that they're starting to take security very seriously, budgets are starting to open up.

And I'm very bullish in where we're headed over 2021.

So you expect, I guess, in brief, that 1Q will be the low point of revenues for the year?

Yes. I mean, the challenge you've got here on revenue was it's always trailing, because of the managed services business, right.

So where we were getting beat up in March, April, May, the heat of the pandemic, when everything was closed down, and hospitals had to clear out all of their elective surgeries, that trail just worked its way through in this quarter. So, in a lot of ways, you're seeing the tail of that work its way through the system.

Okay. Thank you for your questions.

Thanks, Avi.

Hey, guys.

Hey, Michael.

Good tone seems to be improving. So, certainly good to hear.

I just want to follow-up on kind of the last theme, Caleb. We're seeing activity pickup with health systems.

Do you anticipate that we're going to start hearing about more contract signings over the next 60, 90-days? They can't put this off.

Yes. I mean, the simple math on this is on right at the end of the quarter.

So, our focus right now, as you can imagine, is on doing everything we can to get every deal over the wall here before the end of the month. And then we'll regroup and start figuring out how we want to talk about the successes we got.

Okay. Considering what the shareholders have gone through, it'd be great if it was sooner rather than later that we have more of an indication of how our company is doing.

You mentioned something in your script in regards to the insurers are seem to be getting more involved now in regards to the requirements of the health systems. And perhaps, are they -- do you anticipate that they're going to require a cyber-assessment in order to write some of these policies?

It's very timely question. We started with ski signs and things.

So we obviously, get involved with insurance, in some cases when clients get breached, or when they call us if they've been breached. And, we also started to see a flurry of questions over the last months about renewing insurance policies, and I didn't understand where it's coming from.

So we started digging in and actually talked with some underwriters. What we're seeing now that we've never seen before is that underwriters are calling out specific solutions that they expect to be in place.

And things like endpoint detection response, multi factor authentication, we have not historically seen that call out with the same rigor that we're seeing a called out in these contracts. The other thing is, there have been some very significant payouts in the insurance space, specific to healthcare in 2020.

So, I am by no means and expert on insurance, but all the signs I'm seeing is that the insurance and specifically in the underwriting process they're starting to require things. I think it is very reasonable that we start moving to a posture where either insurance companies are requiring some form of inspection, and we are aware of one company that is allowing a third-party to provide input on the insurability of a client.

But in addition to that, what's probably going to drive it even more is this SolarWind's breach. I mean, 18,000 impacted companies, it's honestly staggering, and it's a supply chain issue.

So, the problem here is that any company of significance is looking out at their supply chain suddenly being concerned that that's going to be the pathway and adversaries going to get in. I actually think the supply chain is where we're going to see the movement in the short-term.

What we do today in those cases to check out a supply chain, because it helps people answer a questionnaire. I think we're going to start to see much more definitive requirements around testing and assessments start to pop up in that space, and we'll probably start to see some of that this year.

Okay. A couple of questions on the CMMC opportunity as well, and what it's going to take for our company to truly leverage that opportunity to really build up that spin the brand.

And so I guess we were one of the first 20 certified third-party assessment organizations, and that's based upon one person having the right certification inside of our organization.

No, it's based on a -- so there's a couple of pieces to this, and this gets fairly complex. But the individual needs to have an assessment, so we have one individual in the provisional program.

I don't think anybody has more than one. The second piece of this is the company had to go through a background check and have certain policies and procedures in place and certain trained individuals, that has also been done.

The last remaining piece, is that we have to have our security posture validated by the DoD. So we have already passed all the steps to do consulting work.

And now we are at the very final step to be able to actually go to the assessment work. And there isn't anybody in front of us.

We're on the same path with the initial group here to get through this security assessment from the DoD.

And when do you anticipate that will be concluded?

Well, I would have liked to have been done already. We're dealing with some delays there, as they've been trying to get these security assessments done.

We're in the middle of hours right now.

Okay. But do you anticipate this is another 30 days, 90 days after six months.

Yes, I would say it's you know, I think they finished talking to us at the end of May. And I don't know how long it takes them to dot the I's and cross the T’s, but their interaction with us will be completed in May.

Okay. And then what is it going to take for us to truly support this business going forward?

I mean, we're going to have to train staff. And again, if we think there is the healthcare opportunity, it's going to be enormous this year.

We don't want to take people kind off of that focus that are already trained and ready to go, ready to generate revenue. Are we going to have to train some of our existing staff?

Or are we going to bring in potentially new people and train them in order to be able to make these assessments for the CMMC?

Well, the short answer to your question is, yes to all of it. But here's my basic strategy.

We're in a very unique position, unlike a lot of other players in this space, and that we can swim in two lanes. So, I have the ability to move assessors back and forth between the lanes.

Now, it will likely take and I'm guessing here, but it will take a brand new assessor to get fully certified to be able to do a CMMC assessment, it's probably about six months a year process. So what that allows me to do, is bring them into the healthcare space, get them tooled up, maybe even give them a few years of experience, and then start taking those more experienced individuals and slowly matriculating them into the CMMC space.

So in a lot of ways, I've got a built in on ramp. The other thing we did during the pandemic, is we retooled everything.

Our executive team literally met in an agile scrum every single day. And what we've done is become much more efficient in what we do in our healthcare delivery, so that we don't need as many people to deliver the same work product.

Now, what that does then also it creates a bit of capacity so that we can go tackle the CMMC work, at least in the early days of this, without having to hire any people. And I think that's a huge advantage.

Great. And then I guess one other question on the deals that we've signed so far, how many deals have we signed up for the CMMC?

And can you give us an aggregate dollar amount value?

We haven't released that yet. They are still -- I mean, these are early deals, so they're still relatively small.

But I look forward to talking with you guys more about that when we've got some material deals in there. And, that would be definitely be something we want to talk about broadly as we start to see bigger and more material deals there.

Very good. Thanks, guys.

Thank you, sir.

Good afternoon, gentlemen. Are you hearing me okay?

Yes, we can. How are you doing today?

I'm fine. Just adding on to the last question on CMMC activity.

Congratulations on getting some revenue contributions already. I think that's first and foremost.

Secondly, can you give us an idea of the structural deals? Are they a multiyear platform that you'll be on?

Or is it just simply lump sum certification from some projects initially?

Great question. So the short answer is, it's complicated, but you asked, so I'll explain it.

So think of this as two parts. There's all the upfront work to get ready, to get your documentation or the test that these controls actually work.

Let's just call that consulting. And then on the other side is actually doing the assessment.

Much like a financial auditor coming in and validating, do you do what you say, do you say what you do and can you prove it. No company can swim in both lanes in the same client.

So, you have to pick your lane, you're either the auditor, or you're the consultant and a client. Now, if you're the consultant, that work is significant upfront, and likely continues on in perpetuity, because when you get certified to go win government contracts at a level one, you might decide six months later, geez, I want to go bid on a contract, that's a level three, well, I got to go back and add a whole bunch of new security provisions.

And remember, security is not a formula, it's constantly evolving, and bad guys are changing their techniques. So there's work that you always have to do to be able to maintain that CMMC certification.

So if your relationship with a client is in that consulting lane, it is likely a longer-term arrangement with lots of renewal work, and lots of remediation work. If you were in the assessment lane, with that particular client, you are only brought in when the assessment work needs to be done, you are prohibited from providing any guidance or support along the way.

And that's really kind of a once and done type of work. Now, it has to be redone every three years, and might be done more often, if they decide to move levels, let's say they want to go from level one to level three to level four.

But those are kind of the two lines. And, part of my assertion in this is that I think it's important to be strong in the assessment business, because that will lead to strengthen the consulting business.

I mean, who would you rather bring in as a consultant, someone that has never done an assessment or some of that's a fully certified assessor? So, we're trying to swim strongly in both lanes.

But the money and the repeat business is certainly on the consulting side.

Okay, good color there. And do you need to then educate adjacent markets on this?

Or are the IT and the cyber in-house groups are they familiar with this certifications?

You should talk to my own team. They've been in a force march on this every single morning for the last year.

This impacts HR, marketing, finance. Paul's had to rewrite procedures he's had to make sure every time he changes a policy or procedure, it's being updated.

Today, social media training for our marketing team, of what do they do if someone accidentally posts a comment to one of our social media channels with government information in it? How do we respond to that?

It is a all of business activity, and the entire business needs to become security aware. So, I guess the short answer to that is, it’s a lot of work to get ready for this.

And that's the case any business is going to be certified.

And correct me if I'm wrong now, peers that are publicly traded, how many others have this at this time that you are aware of?

Okay. So you got to break this into two ways here.

There's government suppliers that will be required to pass this in order to win a government contract, there's roughly 300,000 of those, and they're companies from very small mom and pop shops all the way up to massive government contractors. In terms of the companies that have gone forward and there are effectively two lanes in this program.

You can sign up to be and do consulting work, and there's several 100 companies that have stepped into that lane. And then you can sign up to be an assessor, which is what they call a C3PAO or Certified Third-Party Assessment Organization.

I think there are -- I think, the last number on this, it's certainly around 100, maybe as many as 400 that are applying to that. But the reality is when we went out and look at everybody that was in the mix, and what we found was, most of those organizations were very small shops, three, four or five people.

And you find that often in government contracting, but the reality is, they're probably not going to have the infrastructure to operate on their own, because of the security requirements of their own organization. So, a big thing that's evolving in this is the ability of 1099 contractors to operate underneath another company as their umbrella.

And that's one of the business models we're looking at with this is that many of these other entities, we may leverage them to be our hands and feet operating under our umbrella as a certified organization.

Okay. And my last question is just on the pricing, I know it's a difficult question to answer.

But broadly, how the margins on both of these divisions? How do I look upon this?

Paul, you want to touch on that and then I'll add some commentary?

Yes, we're not expecting any -- at least at this point-- this early in CMMC effort, we're expecting a difference in the margins necessarily mean, between the different types of…

And let me just interrupt here quickly. The margins are pretty much the same, then I guess you can sort of leverage your wins in marketplace as well with these government agencies, correct?

I'm not sure, I followed what you mean.

Yes. I'm not sure I understand the question.

I'm sorry.

Once you start to land these contracts with the DoD, does it help you on other ones that you will be bidding on?

Oh, I should say, so, first of all, let me clarify one thing. We are actually not contracting directly with the DoD, we are contracting directly with the party that is looking to be assessed and approved.

So, our authorization, if you will, is done for a group called the CMMC accreditation body, they're a nonprofit that was set up to do this work. So, I think probably the biggest example of what you're talking about is imagine a prime sub relationships.

So there is some engine you're making for government aircraft, let's say. You might have 300, 400 subcontractors.

Well, when you bid on that contract, let's say that contract requires a minimum of a CMMC level three, that means that you and any of the subcontractors are going to touch that controlled information have to all be operating at that level. So, one of the things we're hoping will happen, we'll see how this evolve, is that those prime sub relationships might be very interesting opportunities to drive repeat business, on either the consulting side, or the assessment side, because think of it this way.

If you're a prime and you know your contract date is coming up in let's say, October, you want to work with companies that have the scale to get all 200, 300, 400 of your subcontractors ready for that in time.

All right. And one last one, just in general on your base business with healthcare and some adjacent markets that you're seeing.

Is it fair to say, given what has occurred in the marketplace over the last six months, that's the cycle time to close contracts with your sales team, I think quicker than in the past?

Yes, our sales VP and I was just talking about this literally yesterday. We are definitely noticing an acceleration there.

And I’m cautiously optimistic, what I don't know yet, is that a product of pent up demand just because of the pandemic, or have we actually seen the change we've all been waiting for in healthcare, that they're really starting to take security seriously. My own opinion on this, and I don't really have the data to put to this yet.

I think the sea change is starting to happen. Ask me that question again next quarter, because I think that's an important thing to watch.

But at least in the short-term, we've definitely seen a reduction in the time frame it takes to close the deal.

Okay. Gentlemen, thank you for the time.

I appreciate it. Thank you.

Alright. Thank you.

Well, first of all, thank you to all of you that asked questions there and continue to be long-term supporters of what we're doing here. I think if we kind of look at 2020, this was a year that well it challenge just about everything we knew about our business, our personal lives.

But for our team, what was also an opportunity. And we used this time to retool, to become more efficient and learn new skills.

I mentioned this earlier, but our entire executive team meets every single day and as well scrums focused on improving our position. And today we're a much smaller organization than we were a year ago, but we still operate with a similar delivery capacity.

And as conditions improve, we will expand to meet that demand. Most importantly, we can now leverage our resources, our infrastructure, intellectual property now across this much larger addressable market than we could a years ago.

And we're looking forward to that opportunity. In closing, I want to thank our employees, partners and all of you as our investors for your ongoing support in this year that was 2020.

And now let's get back to the real work on growing a business. Thank you.