Comply or Cry:
Making it real at scale

I suggest we probably get started then, guys. If you're all game with that, let's do it. Cool. Well, I'll kick off with a quick intro for everyone, but this is obviously the last one in our webinar series. So, thanks for joining. But yeah, just a quick kind of closing chapter. The idea of this is just to kind of wrap up what we've discussed and kind of change our focus a little bit more on thinking about the one tenant and five frameworks and what that means for you all.

So we've obviously covered five frameworks which we'll discuss in a minute. We're just kind of narrowing out our kind of talk track and ideas or thinking around how do we make sure that we can still evidence the frameworks we have to support and follow. Obviously there's all three of us on the call. So myself, Tim, one of our architects here. And then I'll let the other two do their intros.

Go Dakota.

Hi, Dakota McElligott. I'm in the North American region for M365 team and I hosted the CIS and NIST webinar series episodes.

Super. And I'm Milo. I'm here in the UK with Tim covering our Europe and Middle East region. I'm also in the Microsoft 365 team and I was hosting the Cyber Essentials webinar. So, good to see you all again.

Well let's start off then with going through the realization. Probably kind of bit of a recap more than anything around what we've discussed. So obviously I did the NIS2 and DORA which was mainly kind of focused around the EMEA area. And just kind of giving you guys a bit more context around what was discussed. We kind of looked around three key principles or key focuses. So how does the framework map to Microsoft 365 controls across the board?

What the obligations were essentially for you guys as MSPs. And there are big ones when it comes to DORA, but it all focuses around supply chain. So, if you've got any companies that do support financial sector in any way, then we do technically follow the supply chain model around DORA, which means we also have to be DORA compliant to be able to demonstrate those elements. So, we covered talking points around those and that's the same application against NIS2 as well.

And the key area that I kind of always like to bring up whenever we go through some of these kind of webinars and series is also how do we map that with inforcer. So, we covered some of those topics with NIS2 and DORA. But Dakota, do you want to just go through some of the bits we went through with NIST and CIS?

Absolutely. So, yeah, I took NIST and CIS. So episode 3 was the CIS 365 foundations as well as we talked about Intune a little bit how those work in the benchmarks works in with the controls. So I think it was a very prescriptive conversation especially just because of how inforcer opera oper operate oh my gosh sorry I can't speak this morning but utilizes these specifically for the foundations to map out to 30 other frameworks.

So, that's really great. And then we talked about NIST too, where we went over CSF 2.0 and then 800-171. I know I literally can't talk right now, but it's totally okay. To be fair, it is 8 a.m., so I'm just like my brain's just waking up right now. But anyway

If you're anywhere near like US defense, etc., like NIST was definitely a part of that conversation, especially with CMMC, etc. So, that's what I covered. Different acronyms but kind of same foundation I would say especially with the CSF 2.0 and the CIS controls.

Awesome. Super.

And then my

Yeah and then my one with Cyber Essentials on you know on the contrary Cyber Essentials is a little less prescriptive when it comes to the actual controls that we're putting in place for Microsoft 365 but tends to be sort of a bit of a broader brush stroke around some of these controls we all still need to be thinking about. Right. So the big thing for the new Cyber Essentials release that came called Danzell on the 27th of April this year was that MFA is now enforced everywhere.

It's not just a it's not just a recommendation anymore. We've got automatic failing for missing MFA from cloud services that don't or that support it. As well as some other sort of general recommendations around like patching, right? You know, there's not necessarily prescriptive controls for how you patch these devices, but there are it is one of the few of these frameworks that talk about you know, specific windows around patching.

So, there's a strict 14-day patching window for Cyber Essentials. Again, and we can use things like Intune and the lovely features that we now support in inforcer with things like Autopatch and hotpatch to be able to control this for our endpoints. Amazing. Cool. Well, we'll move on then to kind of go through some of the information we want to cover. So, Dakota, I'll pass this to you on this slide.

So, this is just kind of what we've been basically bumping around every single episode, right? Kind of learning how to strip that regulator language out. Looking at all the like detailed nuances in between. I think all five frameworks kind of pointed to the same type of short list M365 controls right so we covered MFA conditional access anti-phishing etc encryption at rest even as well so I think focusing on those things if you're a competent MSP you're already doing a lot of it so I don't really think the configuration gap is really the gap it's more about creating an audit trail understanding the commonalities between being able approve it per tenant is like the most important thing.

So you know kind of re without rebuilding that picture from scratch every single renewal cycle. Being able to understand this is the work that was done this year. This is what we need to change this year. This is the drift in between is the most important for auditing especially for like those required frameworks that we talked about throughout this session. So I think that's basically like the most important thing, right? We've got one operating model configured once across every single tenant that produces multiple evidence views on demand.

You build it once, you have evidence in five different ways and then you also focus on the nuances in between as well, which is really important.

Amazing. Yeah, very true.

I think for those of you that didn't join every single webinar, this just kind of gives a rep a recap of what we've covered and sort of why they're important. So episode two was around DORA which is you know regulation introducing you know strict operational requirements for financial entities focusing on their you know IT risk instant reporting also third party oversight and we've got a decent amount of coverage there in inforcer that we can support on the Microsoft 365 side and how those how those controls can be mapped to actionable things that you're doing within the tenant.

The CIS M365 benchmarks specifically. Actually Dakota I mean it says the M365 benchmarks here. Did we touch on some of the Intune stuff as well?

Yeah, I went over it overall just basically what's covered in the platform. So we talked about benchmarks overall and then what we offered within inforcer including Intune in Microsoft 365

CIS always is an interesting one. It was actually Dakota that taught me this was that you know they are different to some of the other more sort of prescriptive frameworks that these ones do tend to be more like recommendations right that you need to take a bit of a practical view on when it comes to applying these to you know your business or your customers businesses right it's not necessarily a sort of tickbox ex tickbox exercise or a sort of like pass fail compliancy right is that fair to say Dakota So

100%. Yeah, I would say like with CIS a lot of the time, right? They provide a lot of recommendations for you to choose from also with like the level one and level two which we see throughout different frameworks. We see the different leveling set where like you start here and you end here or you build upon but I would say like CIS focuses a lot heavier on that especially from a benchmark perspective because what we saw right like if a tenant for instance like if we're talking about Microsoft 365 you're harden all the way up to level two like that tenant's not going to be usable so I think it's just definitely picking and choosing what's relevant to your organization it's really great one for on ramping to different frameworks because they map out but then also just for those folks that don't use compliance, they have some sort of standard to go off of as a foundation.

Gotcha. Good starting point. That's great. We covered Cyber Essentials as well, which is our you know, our UK government-backed certification for technical controls around, you know, common cyber threats. So pretty market specific this one for us folk here in the UK. But you can see we've got pretty good coverage of the controls that you need to be aware of when it comes to Microsoft 365 configuration and how we're able to help you with that and inforcer.

Similarly NIS2 right again a less sort of prescriptive framework and more sort of broader brush sort of like guidelines on what you should be adhering to and less around the actual technical controls. But you can see we've still got pretty good pretty reasonable coverage on the things that you need to be thinking about when it comes to inforcer and setting up your baseline to be able to help deliver some sort of version of NIS2 compliance for you or your customers.

And then we have NIST which I will shamelessly admit I know a little less about NIST but again it's a sort of broader framework. It's a little more prescriptive and a proper set of frameworks and standards for providing you know risk based guidance for identifying, protecting, detecting, responding and recovering from threats there. Again pretty reasonable coverage there that we have in inforcer as you're starting to build out your baselines and looking to maybe offer some governance as a service type models and sort of add-on services for your MSPs.

Some good coverage there for us to think about. C keep in mind these aren't sort of total coverage of the whole framework sets right so for example we cover 92% of the Microsoft 365 specific requirements in Cyber Essentials or I should say cloud services there are obviously plenty of other things that you need to do to be able to comply with some of these frameworks right so for Cyber Essentials for example there's a lot of controls around your on premise networks but also your devices that aren't in scope of Microsoft 365 so just because we got 92% coverage doesn't mean that's the be all and end all, right?

There's still other things you guys have to think about. Obviously as inforcer, we want to help you do as much as you can on the Microsoft 365 side of things, especially as we're moving more and more of our data every day into Microsoft 365. So, that's where these become really pertinent.

Yeah, couldn't agree more.

So just to kind of put a bit of context around some of these elements of what we've what we've covered and those percentages you see, we've got a bit of a convergence map. We'll share some of this information with you guys at the end of this session. But just to kind of put into kind of an area of controls. There's eight specific controls against those five frameworks that you see. So identity access, endpoint, email data, patching, logging, and response.

All of these specific control families can be mapped with Microsoft 365. And what we've done is presented to you where they map against some of these specifically. Please ignore the CIS ones. Dakota's going to go mad at me because I didn't update it properly. But the there are actual specific numbers and I'll update them beforehand.

Syntax honestly works fine. Yeah, it's okay.

And then just covering things that what's covered within those frameworks. So it's quite important to know that not everything within patching for example is needed with some of the frameworks that we discussed. So we're highlighting just a handful of what's covered. But the majority of what you can do and I think this is always crucial is to think that sometimes you might not implement antivirus or phishing emails for example in Microsoft you might look at doing these with third party products and that's absolutely fine they still map those controls to the frameworks or regulations you follow but what we're focused on being a Microsoft house is how can we and can we implement all of these controls on the Microsoft tenant, and if so where do they map and how do they map so this just gives you a bit of an overview of where these controls sit what we look for against those kind of eight specific families and the five frameworks and it's just designed to give you that one picture guys.

I mean, we've got loads more frameworks than just these five that we've discussed specifically, but we did work quite hard to kind of decide what's relevant for every region that we work in today that we're talking to or who's on this call today and making sure that we're mapping as many as we can or the controls and frameworks that meet you guys probably most like NIS2 for EMEA is pretty consistent. The same with NIST in terms of the defense and then CIS is just that really well-known kind of recommended benchmark across the board of which most frameworks actually follow or regulations follow anyway or look to adopt as a control measure.

So it's worth just being aware of those things. Maybe to you Dakota.

So again right we talked about the convergence map on the last slide. I would say this is definitely the part where we talk about how a lot of the frameworks are basically agreeing right there's four buckets to it all I would say that parallel exists with most frameworks that are cyber security focused in general I think there's a lot of commonalities between every single one obviously each one has its different focus and why it's scoped out the way that it is if we're talking about HIPAA which we didn't really cover to this session but it's still something to talk about right it's healthcare focused so we're talking about privacy etc But there's still underlying commonalities that we need to talk about.

So I would say like the main focus on this slide, right, we're talking about identity, endpoints, email, data, and audit. I think just really focusing on doing those well. Right, so identity MFA on everything, phishing resistant for admins, right? So like anything that's very basic with identity having those conditional access you know configuration set up having tight control on external collaboration etc right that is what you need to focus on for identity and I think that's very common focus that's set in most frameworks if not all of them that we talked about this entire you know series and then you know with endpoints if we're talking about Defender for Endpoint specifically making sure that's deployed and also reporting actual data that you can use for auditing purposes.

That's super important. Not just having it activated, but also having a trail arguably more especially like when you're being you know audited by a CMMC or something like that if we're focusing on email you know having the anti-phishing with the mailbox set to on all the basic things like safe links etc. But I think overall the last point is the most important commonality between every single framework that we talk about in this series and beyond, right?

It's making sure that things are set up properly with data and then auditing for that data. So sensitivity labelings are spec or specific to M365, right? So we're talking about also just like DLP too for Exchange, SharePoint, OneDrive, etc. Having those set up. I think it's a it's a foundational understanding between most frameworks that we talk about from a general standpoint and then it's just one taking that information or expectations from a high level like if we're talking about NIST or if we're talking about NIST CSF 2.0 you know that I should say or if we're talking about the controls it's saying hey make sure that identity setup or if we're focusing on asset management this is what this should look like generally and then kind of looking at it from a prescriptive standpoint like okay this is the high level expectation but how do I actually get that from a settings granular level in 365 and that's kind of where you know CIS benchmarks definitely come into play to assist with that but being able to fill in that gap is I think the most important part of compliance second to auditing everything properly.

So, but once you're there, right, you're 80% of the way there, which is awesome.

Yeah, agreed. Cool.

Well, what isn't covered, I think, is probably a good conversation to have outside of the 80% that we just spoke about. And just to cover the ones that I've kind of discussed specifically, every single one of these frameworks that we focus on, and I emphasize more the regulated framework. So, it's these four that we've been discussing today, they all have additional measures or controls that we also need to be aware of and think about.

So, with NIS2, there are specific controls around incidents. So they actually have a requirement to make sure that if there's been a breach or an incident that's taking place. We are holding upheld to a time scan or timeline where we have to make sure we meet these deadlines and we have to demonstrate them not just to the body or representative in the EU specifically but also to our customers. And these things are quite often overlooked when we focus or our narrative on Microsoft controls.

We also have to bear in mind that some of these specific controls are also don't map to Microsoft or inforcer in this instance. But there are actually controls we need to also be making sure our customers implement or we need to implement and that also applies to DORA. So some of their control mappings is around third party arrangements. How do we deal with penetration testing for example? What the requirements and controls are? It needs to be done on I think it's every three years.

I know it says it every three years. So there are just elements around particularly those two where it doesn't quite map to Microsoft and their specific configurations. Don't if you got anything else to add there, Milo, on Cyber Essentials.

I think I Yeah, I mean, we talked specifically a little bit about, you know, some of the specifics that Cyber Essentials has around their 14-day patching SLA and things like that and the fact that it's like an annual renewal, but I think what I will say just in general, and something that I've sort of learned a little bit more watching you guys talk about some of these other frameworks as well, is how there's a big emphasis on the evidence sort of side of things these days.

You know, it's not again Cyber Essentials in times gone by especially the sort of base Cyber Essentials. It's a self assessment, right? So, a lot of it for a lot of people has been about you know, just it been a bit of a box ticking exercise that they can, you know, get the little badge that they can put in their email certificate or, you know, put in their put on their website or whatever.

But you know there's definitely been a shift I think with more focus put on you know evidencing these controls and making sure that you can actually back up what you're saying you're doing right so that's just an observation I've had when looking at these and how they sort of changed over you know even in just like the last few years here right

Yeah agreed Dakota, what's the difference really that you see in some of the frameworks outside of more the US side not just NIST but also things like HIPAA are there specific controls because you definitely see a different between the two versus what we can deploy in the tenants.

So I would say a huge gap with like CIS controls in particular is risk management.

So there's not a lot of coverage on risk management topics within the CIS controls. What I used to talk about when I worked at CIS was that it was cyber security focused. So anything outside of that scope we don't necessarily cover. I think NIST definitely dives into risk management more from that perspective. So I think like you know there's that 20% where each one has an outlier but then there's always something else to cover it.

I would say if you're talking about just like industry focus like with HIPAA right it's a it's a smaller set of controls that are only focused on like data governance security etc right because it's really focused on protecting people's data how are you protecting you keeping that data so I think it's just like more regarding the fact are we looking at a framework that's very general that can be used by many industries like CIS for instance can be used by pretty much any this industry from academics to small businesses to large enterprises like my customers were very wide ranging I would say in my previous past life at CIS but I think like if you're looking at NIST it's kind of the same thing except not because you actually talk to more government entities so I think it's just more about the font of is this required for me if it is obviously there's more scrutiny on specific expectations So I think it's like a multi-pronged answer I would say.

But you know aside from like NIST or CIS I think it keeps it more just like industry focus like if you're talking about CJIS which is like a judicial type of framework like that's going to be mostly focused on what's required for you know protecting people's information again right so

Yeah that's just the outliers that I see it's more about the purpose of the framework rather than what's within it.

Yeah, very true. Very true. Okay, cool. Thank you.

So let's talk about what we can do. Say it's chapter two, it's not really chapter two. We want to walk give you guys some an opportunity to walk away with some elements not just outside as always outside of what we've just spoken about today. But our real focus for you guys is what can we make sure you are enabled with outside of these fra five frameworks or against these five frameworks we've discussed today. So over to you Dakota to cover this one.

Yeah absolutely. So these are kind of five operational moves that we went over discussed and decided on being like the best pathway in general. Step one would obviously be building kind of a CIS aligned baseline. I think CIS maybe I'm biased but it is definitely the technical foundation that can map out to about 30 other frameworks. So, it is a really nice place to start, especially just because that's what inforcer kind of has too.

But I would say like every other framework kind of borrows from the same vocabulary. So, it's really nice to be able to standardize, especially if you're looking at those more very complicated frameworks. I would say NIST 800-171 isn't the easiest framework to tackle if it is kind of your first compliance breakdown. So, starting from somewhere and then mapping it to another place is always great, right? So you know two would be mapping those controls not necessarily policies yet but looking at a control catalog.

So this single conditional access policy satisfies NIS2. It satisfies DORA it satisfies CIS it satisfies NIST all at once. So you don't have to write it five different times. I think that's the huge issue with compliance sprawl, not just like with an individual company, right? Especially if you're talking about an MSP because you guys are focused on hundreds if not thousands of different customers, etc., and it's like, well, I have this customer that has this requirement, this one, this one.

If you had some sort of commonality foundation that you could branch out from, that would be fantastic. And that's also why we focused on having CIS in our platform for that specific reason. Because it allows a repeatable process for sure.

I think too with like a standardizing that would be step three, right? So like making sure that those workflows are standardized over time. You know making sure that notification artifacts are differing. I think like making sure that detection and classification work is the same within that but then like having an internal workflow that's unique to identify okay this maps out to this framework etc. Like it's really helpful because that allows you to audit properly and then step four would be making one supply register for every single framework right so I would say specifically with DORA right they want a register of information, NIS2 wants that supply chain risk evaluation Cyber Essentials wants asset inventory NIST is always asking about that vendor catalog so having one registered for all of those is really important you know all the columns that every framework needs in one place maintaining it once to stop keeping a million different spreadsheets just having one place where it's like we've covered all of these are the outliers you know this is how we can use our auditing from here on and then obviously five would be focused on evidence continuously not annually I think this is a big one obviously we're not perfect obviously we have a lot of other things on our plate but I and continually monitoring drift changes, anything internally that's occurred.

On an not just an annual basis, but continually will save you a lot of time at the end of the year. Because if you're collecting evidence at renewal, it's going to be a lot of scrambling through

Potentially screenshots. Yeah, so it's just a lot

To the finish, right?

Exactly. So I think

Two weeks before the audit finishes. Yeah

100%. And also like if you're talking about CMMC, like if you're not doing it properly throughout the year and then you're scrambling when it's due, you're going to have a huge headache on your hands when it comes back and it, you know, it's not properly approved by your reviewer, etc. So, I think from that point like auditor's questions will stop being something that's like a reactive approach where you're like, "Okay, this is a new project.

We're going to have to find this information." And it's more a query that you already proactively answered a few months ago.

Yeah, I think this is where MSPs can start to really think about how they can use, you know, use these types of frameworks and especially, you know, building on a foundation just to offer this type of, you know, sort of compliance as part of a service, right? You know, if you can wrap it up in part of a service, it makes it part of a continual evaluation and not that like last minute, you know, end of the year project, right?

Where you have to sell hours to be able to go through the audit to start with and then all the remediations and you got to try and fix all this within you know a matter of like 4 weeks for example right if it's something you can do over the span of a year or you know multiple years continually to be able to keep them topped up then you know it's a it's an it's a nicer revenue stream for MSPs it's a much more manageable service right because we're not putting pressure on our professional service team to have to like book in a load of these you know as they come into renewal it just makes the whole thing a little bit more manageable and just gives you the opportunity to add sort of more recurring revenue to your business.

I'd also say as well like I just echo what Dakota said about you know starting with CIS as a baseline you know especially when we've got some of these less prescriptive frameworks like NIS2 and like Cyber Essentials where they don't really describe like the actual individual policies that we should be creating or how we should be configuring these sorts of things.

Having that as a start so that we can map it to that sort of broader structure that those frameworks talk about you know offers you a few more actionable you know configurations right to be able to able to cover those areas off

Definitely want to carry on Milo

Super yeah I guess it's just kind of touching on again some of the stuff that is outside of M365 that these frameworks still require right and know I'll talk specifically about Cyber Essentials like for example there's things like backup of data right is included in some of the framework so things like DORA will include like strict requirements around that Cyber Essentials for example doesn't actually have strict requirements around backup but they do have strong guidance around best practices there so you know even if it's not strictly required within your framework you know h have a look at others and see what the general advice is just because you're not following one specifically.

I think it's worth looking at others and seeing where you can sort of help build out your general sort of compliance practice. You know, still offer good levels of service in these areas. You know, even if it's not a strict requirement. And there's loads of things here that are really important, right? You know, things like penetration testing and security awareness training for your customers, right? That there's lots there that even if it's not specifically aligned with what you're dealing with or the specific compliance service you're offering is it's still worth thinking about and think about how you can build that into your service because you might have customers that come to you one day and ask around a different framework that you've not been offering today.

And if you've already got some good practices in place there, it's much less of a lift for you to then be able to add that to your you know add that feather to your cap if you like. Cool. Oh

That went very quiet. I don't know if I got everything got cut off then. Sorry.

All good.

So coming to an end here really guys, we want to just give you some areas just to focus on. We've got it three key areas that inforcer kind of helps to leverage. You know, the first one is obviously as we've already discussed on the slide before last was, you know, starting with a benchmark. Where does your security standard sit? When we talk about these frameworks and as Dakota and Milo rightly said, if you think about these mappings and controls at the moment, we've actually got opportunity to really focus on creating a CIS baseline or a baseline that meets those regulations, having that one standard tenant and mapping the frameworks around those controls specifically before we start implementing policies.

That capability is available in inforcer today and we should absolutely be leveraging that because it gives us the ability to kind of unify our policy library across the environments. We look at standardization with naming convention descriptions are always helpful in policies when we do those configurations. The other area is obviously evidence on demand continuous posture. So us utilizing things like the alerting that we have baked into the product already today, but also tenant alignment reports play a huge part in providing the evidence that we need to demonstrate a customer is following along on a journey around frameworks and security principles that we're following or recommending as an MSP.

And that foundation is really important because we can leverage things like policy tags to say, you know, this conditional access policy meets NIST meets NIS2 meets CIS meets Cyber Essentials. Can demonstrate this all with utilizing things like policy tags to provide the evidence. And the other one is that multi framework view which is leveraging the tags specifically. It's the ability to kind of demonstrate that we are building one specific control or one specific tenant with security principles at the forefront.

But it's mapped across five different ways or five different regulations and we can evidence that utilizing things like the tenant alignment report but also the assessment engine. And as inforcer continues to kind of build out the assessment checks, we'll also be leveraging elements like NIS2 assessments and others. So you can start to demonstrate or run reports specifically around your Microsoft 365 controls that map that for you. And before we come to a wrap- up on this, we also want to make sure you walk away similar to what we did with DORA and NIS2 and the other frameworks is give you some controls that you can walk away with.

So five frameworks and one tenant. We've got a HTML document that goes through how that works today, how we can start that mapping between our one single tenant against those five frameworks, but also giving you an Excel sheet guys that you can use for running those assessments and controls. You'll be able to see how it all maps, where inforcer can help you against some of that evidence that we can support within Microsoft 365. And then giving you almost like an assessment checklist to say, yes, right, we're starting from the ground up on this proper regulation and frameworks that we're following.

We're going to start with making sure these are the names of our policies. These are the configurations. We know they map to these following frameworks. Like a checkbox exercise, bit like what we said before. And so we're hoping this is going to really help to enable you for that. Make sure you've got that confidence. I know not all these frameworks are relevant for every region naturally. You know, if you're in the US, it's going to be NIST and it's going to be some part some parts of CIS, but we do try to make sure CIS is that benchmark where we work towards or start building from in order to meet those frameworks.

It's kind of a wrap to be honest with you guys. I don't know if anyone's got any questions at all. But otherwise we're happy to leave it there. I think Dakota and Milo got anything else to add?

No, I don't think so. It's been I have to say, like I said, it's been good it's been good to sit in on some of these webinars and sort of learn about some of the other frameworks that I've got less experience with. Cyber Essentials was definitely my bag back when I was back when I was working in MSP. So, it's been particularly interesting for me to understand, you know, how these how the how different controls map between them and how we can actually use CIS as a really good foundation to be able to map a lot of a lot of the requirements to other frameworks as well.

So, that's been the biggest takeaway for me.

Yeah, I just I appreciate everyone being so interactive. This series was really fun for me personally. I think our webinars, not to be biased or anything, but I do think ours were really great. The ones that I led specifically, yeah, and I had a lot of fun. So, thanks everyone for joining and you know, laughing with me and yeah, it was great.

Yeah. And the same here. Brilliant. Well, we'll finish there, guys. If you have any questions in the meantime or perhaps you're still kind of learning a bit more about what inforcer has to offer, feel free just to drop a call in. Get some book demos booked or you want a refresher for some of these things, we'll have them published as well. But yeah, thank you very much for joining and have a good rest of the week.

Cheers everyone.

Thanks so much. Take care.