Christopher Armstrong

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

By the end of 2024, the MVP Enclave and 800-171 Compliance Program will have undergone four intense Joint Surveillance Voluntary Assessments within a 12-month period by four distinct DIBCAC teams with four separate small businesses. Building enclaves and 800-171 Compliance Programs correctly is a challenging task. Who is guiding your company towards early assessment and beyond? You deserve to move forward with confidence. You deserve to win in 2025. #DIB #InformationSecurity #CMMC #CCA #CCP #ENCLAVE #JSVA #GOVCON #HAMPTONROADSDIB

67

8 Comments

Special thanks to the Long Island NY ISC2 Chapter for hosting me to speak at their Chapter Event. Another great opportunity to talk about Cyber Risk Quantification. Ask me about the Open Education Resources that are now available for download from CyberRiskModels.com. #ISC2, #cybersecurity, #CRQ, #CIO, #CISO, #Training, #riskquantification

5

Protect your organization from cyber threats with NJTEKS’s Employee Security Awareness Training! Our Phishing Simulator and Security Awareness Training services use real-world social engineering attacks and video-based training to educate employees on security basics. With over 90% of breaches caused by human error, it’s crucial to defend your team against phishing attacks. Our engaging videos and quizzes make learning easy and effective, turning your weakest link into your strongest defense! 🔒 Visit our website to learn more. #NJTEKS #EmployeeSecurityAwarenessTraining #Cybersecurity #PhishingPrevention #ProtectYourBusiness #TechTips

2

Cybersecurity Snapshot: After Telecom Hacks, CISA Offers Security Tips for Cell Phone Users, While Banks Seek Clearer AI Regulations http://ow.ly/hKiE105WiMo

8

✅ The forensic investigator (no all cyber) must understand IP networking and communication protocols... to determine if they are being exploited.

5

1 Comment

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

56

It's September 25, 2024. Do you know where your organizations vulnerabilities are? Don't wait for a cyberattack to happen! Vulnerability assessments and remediation allow you to take a proactive approach to security, finding and patching vulnerabilities before they become problems. Contact HaltSec Security Services. We can help!!!

1

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

ISC2's CISSP: Is the Certification Broken? David Malachow interviews Ira Winkler on the Professional CISO Show, discussing Ira's open letter to ISC2 and its implications for CISSP certification. A must-watch for cybersecurity professionals! #ProfessionalCISO ['#ProfessionalCISO', '#Cybersecurity', '#CISSP', '#InfoSec', '#ISC2', '#CybersecurityPodcast', '#InformationSecurity', '#DataSecurity', '#ITSecurity', '#CyberRisk']

17

looking forward to this Conference and having great conversations about Cybersecurity and Compliance.

6

The Hidden Costs of Going Back to Paper and Pencil After a Cyber Attack: Suffolk County, New York, has spent over $25 million on response and recovery efforts. But beyond the financial burden of remediation, there's another, often overlooked cost: the return to manual, paper-based processes. For months after the attack, Suffolk County was forced to revert to paper and pencil to keep essential services running, causing significant disruptions. This not only slowed down operations but also created additional administrative burdens and inefficiencies. Imagine the long lines, delayed public services, and the manual labor required to process records that once flowed effortlessly through digital systems. The cost of lost time, inefficiency, and error rates skyrocketed as the county scrambled to maintain essential services. The Suffolk County cyberattack is a stark reminder of the hidden operational costs of insufficient cyber defenses. Going back to paper may seem like a temporary fix, but it’s expensive. Now more than ever, municipalities must invest in expanding and maturing cybersecurity measures to protect their digital infrastructure and avoid the costly consequences of a breach. Let’s talk about how we can help your locality fortify its defenses. Contact us today to learn more about how TANDMM can assist. #CyberSecurity #MunicipalGovernment #DigitalTransformation #PublicSector #CyberResilience #Ransomware Sources: Suffolk County Ransomware Investigation - The Record Suffolk County Cyber Attack Report

9

It's here - CRQ Training! If you're a CISO, risk analyst or assessor interested in quantifying cyber risk don't miss this CRQ Mastery Workshop. Learn basic and advanced method. Hands-on exercises. Full toolkit and risk models. ISC2 and ISACA Chapters save and additional 20% for their members. 20 CPEs. More info and registration https://lnkd.in/ecVj8V5N #ISC2, #ISACA, #Training, CyberRiskQuantification, #CISO, #Cybersecurity

5

https://lnkd.in/gQ-kvMFK Maximizing Your Cybersecurity Skills with SANS Training Discover how SANS training can enhance your cybersecurity expertise in just weeks. Gain valuable knowledge from industry experts through digestible content and comprehensive resources. Don't miss out on this opportunity to upskill and obtain prestigious certifications. #CybersecurityTraining #SANSCertifications #IndustryExperts #UpskillYourself #CybersecuritySkills #ProfessionalDevelopment #ComprehensiveResources #CybersecurityExpertise #SANSInstitute #OnlineTraining

1