Phase 3 (Months 5–6): The rules of the business

acoustic guitar, lyrical music, hand clapping, no drums · 3:56

Listen on 93

Lyrics

[Verse 1]
Ottawa keeps a ledger, the Export Control List,
every drone part numbered, every circuit that exists.
Cross the border with the wrong line item in your case,
and the Controlled Goods Program will ask you for your face.
South of us, ITAR and EAR draw their own kind of moat—
Canadian firms still tremble when American parts float
through their supply chain, tangled in a foreign flag's design.
And deemed export means the secret's out the second that you type it in
your Slack channel, if a listener abroad can read the line.

[Chorus]
E, C, L — lock the crate before it flies.
I, T, A, R — mind the foreign eyes.
Deemed export: the whisper in the wire still counts as trade.
Learn the rules of the business, or watch the deal degrade.

[Verse 2]
CMMC, two-point-oh, the Pentagon's own creed,
levels stacked like armor for the data that you feed.
Canada answers back with CPCSC, twin and true,
built to guard the secrets that the northern skies fly through.
Underneath them both, a bedrock, plain and gray as slate—
NIST Special Publication, eight hundred, one seventy-one, the weight
of fourteen families, access, audit, and control,
a punctilious checklist for the paranoid and whole.

[Chorus]
E, C, L — lock the crate before it flies.
I, T, A, R — mind the foreign eyes.
CPCSC, CMMC, eight-seventy-one on the wall—
learn the rules of the business, or you don't get the call.

[Verse 3]
Open up CanadaBuys, find the RFP entire,
read the DND's demands like scripture, not like fire—
statement of work, evaluation grid, the closing date,
and ITB, the Industrial Benefits debate:
if you win the contract, you owe the country back—
jobs and training, spending here, a paper trail, a track.
Read it end to end, don't skim the middle for the gold;
procurement is a language, and you're only getting told.

[Bridge]
So write it down — the lifecycle, the twenty-person shop,
map every gate and firewall to the control it's built to stop.
Access management, incident response, the audit trail unbroken,
your pipeline as the imprimatur, the proof that you have spoken
the sedulous language buyers trust before they'll shake your hand.
This document isn't paperwork — it's how you get to stand
in the room where contracts open, where the clearance gets its seal.

[Verse 4]
Twenty people, one repository, a firm that doesn't yet exist—
but the document is real, and the reviewer's on the list.
Every commit gets a badge, every merge request a name,
eight hundred seventy-one controls now wearing your build's frame.
This is the capstone, this is the letter that you send—
not a resume of feelings, but a system built to defend.

[Chorus]
E, C, L — lock the crate before it flies.
I, T, A, R — mind the foreign eyes.
CPCSC, CMMC, eight-seventy-one on the wall—
learn the rules of the business, or you don't get the call.

[Outro]
Deemed export, ITB, the ledger and the code—
the rules of the business ride with you, drone by drone.

← Phase 2 (Months 3–4): Hardware CI and air-gapped delivery | Habits →