Ab Vand

DoD Contractors: FCI vs CUI We discuss CMMC Compliance requirements, implementing NIST 800-171 110 controls to meet CMMC Level 1 and prepare for CMMC Level 2 assessment.

2

1 Comment

DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement contractual requirements related to the Cybersecurity Maturity Model Certification (CMMC) 2.0 Program. Read the proposed rule here: https://hubs.li/Q02Lt0VR0 #CMMC #CMMC2.0

10

Physical and Logical Convergence through Design The Cybersecurity Infrastructure Security Agency (CISA) released guidance on the topic of Convergence for federal agencies in 2019. Physical Security and IT departments are increasingly recognizing the reality of converged threats. The traditional separation between these two domains has often led to isolated management of vulnerabilities, which might seem manageable on their own. However, when malicious attacks or simple oversights bridge these gaps, the risks can escalate dramatically. As Dark Reading’s Thomas Kopecky says: “Physical security and cybersecurity are intrinsically connected, and it is no longer effective to manage these threats separately. Cyber-physical incidents can quickly lead to physical harm, destruction of property, environmental disasters, and worse.” To address today’s evolving security challenges, Physical Security and IT departments need to better align their budgets and objectives. For example, the Department of Defense (DoD) has made strides in this direction by investing in integrated security systems that combine physical access controls with cybersecurity measures. This alignment is crucial for reducing risks while maintaining convenience and ensuring compliance with company policies. Advanced converged technologies, such as biometric access controls and real-time monitoring systems, can aid in managing these risks. However, the ultimate responsibility lies with security professionals to chart the right course, integrating both physical and cyber security measures to safeguard their organizations effectively. Here is an example of a physical access breach leading to a logical access breach as completed by an ethical penetration testing company. “I went into the manager’s office and assumed the role of, “I’m here with the help desk. We’re trying to make the network faster.” He escorted me to every machine, and I did a 100% compromise of every machine in that branch, including the wire transfer computer and the network servers. He gave me full access to everything, and he walked with me to do it.” Jayson E. Street, Secure Yeti. Solution: To overcome these challenges, federal agencies can implement a converged security strategy involving the following key steps: Read the remainder of the article and recommended solutions here:

7

1 Comment

Cybersecurity risk management continues to be a top challenge facing federal agencies. We worked with the Council of the Inspectors General on Integrity and Efficiency and other OIGs to report on trends across the government. Read about progress made and what can be improved. https://lnkd.in/etKZ4WSy

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4

What does CMMC entail? CMMC serves as a validation of a contractor's cybersecurity posture. Mandatory for all DoD contractors and subcontractors handling CUI, CMMC compliance mandates adherence to NIST SP 800-171 controls, verified through third-party certification. Achieving CMMC compliance is not only crucial for securing contracts with the DoD but also for demonstrating your commitment to safeguarding sensitive data. https://cmmc.smeinc.net/ #IYKYK #CMMC #DoD #Cybersecurity #SMEInc

1

Our #massdatagov recently commented on the Cybersecurity and Infrastructure Security Agency #CIRCIA #cybersecurity reporting requirements NPRM including suggestions around reporting requirements for incidents at third party organizations #security #MHDCregulatory Read our comment here: https://ow.ly/JRRW50SiqLG

3

What's the best way to protect #CUI? Find out in our ebook: https://ow.ly/xAXf50Q5GV3 Includes scoping diagrams, process flows, team exercises and more. #DoD #cybersecurity #DIB #govcon #governmentcontracting #cmmc #cmmc2 #dfars #nist800171

4

What's the best way to protect #CUI? Find out in our ebook: https://ow.ly/xAXf50Q5GV3 Includes scoping diagrams, process flows, team exercises and more. #DoD #cybersecurity #DIB #govcon #governmentcontracting #cmmc #cmmc2 #dfars #nist800171

3

Download OSIbeyond's DoD Contractor’s Guide to CMMC 2.0 Compliance to learn the steps DoD contractors need to take in order to prepare for, achieve, and maintain CMMC 2.0 compliance. https://lnkd.in/dtqNsHTh #CMMC #DoD #DoDContractor #GovCon #Manufacturer

6

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

There are new cybersecurity requirements for defense contractors. Are You Ready? 
With the Department of Defense's latest rule on cybersecurity compliance (CMMC), companies working with the DoD must meet stricter standards to maintain contracts. The stakes are higher than ever for those in the defense supply chain. Compliance isn’t just about meeting the minimum—it’s about protecting your company from risks and staying ahead of the competition. Need help navigating these new regulations? Apogee Global RMS can guide your organization through the process, ensuring you meet the necessary standards while safeguarding critical data. Learn more at https://lnkd.in/epwFY82b. Special thanks to JD Supra for publishing insights on this topic. #Cybersecurity #CMMC #DefenseContractors #RiskManagement #Compliance #ApogeeGlobalRMS

2

1 Comment

⚠️ Attention DoD Contractors in the Defense Industrial Base (DIB): ℹ️ The final rule for the Cybersecurity Maturity Model Certification (CMMC), governed by 32 CFR, has successfully passed the Office of Information and Regulatory Affairs (OIRA) review as of September 2024. This advancement is significant in formalizing the CMMC framework designed to improve cybersecurity across the Defense Industrial Base (DIB). The rule is expected to be published in the Federal Register by late October 2024. After publication, a 60-day Congressional review period will follow, with the rule likely becoming effective by the end of December 2024. While this sets the foundation for the CMMC program, full integration into defense contracts is anticipated around October 2025, with some assessments potentially starting earlier. 🔗 www.cmmccompliance.us #attention #dod #contractors #cmmc #rules

1

Download OSIbeyond's DoD Contractor’s Guide to CMMC 2.0 Compliance to learn the steps DoD contractors need to take in order to prepare for, achieve, and maintain CMMC 2.0 compliance. https://lnkd.in/dtqNsHTh #CMMC #DoDContractors #CMMCCompliance

7