Ronald Bushar

I was in AFCEA's Signal talking about the Cyber Security Risk Management Construct (CSRMC), which is the DoW's new replacement for the Risk Management Framework. Change is good, and some of the streamlining is excellent. However, you're always dealing with the checklist nature of the compliance beast, and like most things, it comes down to intelligent execution. https://lnkd.in/e3nQ6_J5

21

Conditional access fails when ICAM is fragmented. Civilian agencies can deploy MFA, PAM, and identity tools and still miss the intent of OMB M-22-09 if those controls are not tied to an enterprise ICAM platform. CISA ZTMM is clear: Advanced maturity requires dynamic, risk-based access decisions using current identity attributes, privileged access controls, and continuous policy enforcement. The common failure pattern: - Multiple IdPs with different rules - PAM outside the ICAM workflow - Static application roles replacing real attribute-based decisions What we look for first: - Is there an enterprise-wide ICAM control point? - Is PAM integrated for provisioning and deprovisioning? - Are permissions adjusted from trusted enterprise attributes? AISE gives civilian agencies one assessment and produces separate scores for CISA ZTMM and DoD ZTA CoA. The CISA ZTMM score maps to OMB M-22-09, while the DoD ZTA CoA score provides additional context. That gives CISOs, IT directors, and procurement teams a clean baseline before buying another point solution. Comment ZTMM or visit zephon.tech/zt #ZeroTrust #CISA #FedRAMP

1

Hundreds of vulnerabilities in 24 leading GenAI models Explore security profiles of 24 leading GenAI models, revealing hundreds of chatbot vulnerabilities with attack success rates up to 64%. Learn strategies to secure AI systems, meet compliance and close the prevention gap. https://lnkd.in/gn4BvKiQ

1

“This directly affects two NIST SP 800-171 practices: 🔒 IR-4 (Incident Handling) — Assessors will expect integrated CUI classification workflows in incident response procedures 🔒 IR-6 (Incident Reporting) — Assessors will review tabletop exercises, playbooks, and historical incident documentation for evidence of this integrated approach” #CMMC #DefenseContracting #Cybersecurity Boyd Williams Jared Chambliss Keith Nicoletti

3

The Cybersecurity and Infrastructure Security Agency's Infrastructure Security Division is seeking public comment on an extension of its information collection for voluntary vulnerability assessments of critical infrastructure organizations. In a Federal Register notice published last week, the agency requests an additional 60 days for comments on the CISA Vulnerability Assessments program, with submissions due by Sept. 10. The assessments collect high-level information on an organization’s security posture and dependencies and use the data to generate Protective Measures and Resilience Measure indexes that organizations can use for risk identification, mitigation, planning, and security-related decisions.  Under the proposed extension, CISA would continue collecting information electronically through assessments conducted by Protective Security Advisors and Cybersecurity Advisors, or through organizational self-assessments. The agency said changes since its previous Office of Management and Budget approval include moving three cyber-focused questionnaires to a separate system and decommissioning the Stakeholder Risk Assessment and Mitigation, reducing estimated annual respondent burden costs from US$1.91 million to $640,685. The collection covers an estimated 1,100 respondents and 7,150.5 burden hours annually, with information also shared with the Federal Emergency Management Agency for public assistance grant determinations.  Winfield P. Werntz, acting chief information officer at DHS’ CISA, said that the Office of Management and Budget is particularly interested in comments assessing whether the proposed information collection is necessary for the agency to perform its functions effectively and whether the information would have practical utility. More at: https://lnkd.in/d56Q6HPZ

17

1 Comment

DFARS 7012 requires contractors to implement NIST SP 800-171 to protect Covered Defense Information (CDI). DFARS 7019/7020 requires contractors to perform a basic assurance self-assessment and submit a score to SPRS that is within 3 years of contract award. DFARS 7021 specifies the CMMC level required to be awarded a DoD contract. CMMC levels require either self-assessment or third-party assessment. When making the determination of the level required for a contract, there is a memo that outlines the process that must be followed by the DoD program manager to obtain a waiver to "CMMC assessment requirements" for that contract. "Program Managers and requiring activities should identify information security requirements for the types of information most likely to be associated with the planned contract effort. When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the SAE, CAE, or DAE may approve requests to waive inclusion of CMMC assessment requirements. SAEs and CAEs must carefully weigh the risk of potential loss of CUI associated with mission critical capabilities before granting a waiver." Level 1 - "There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements." Level 2 - "In rare circumstances. such as when seeking competition from non-traditional DoD sources. waivers may be warranted for CMMC Level 2 third-party assessment requirements. Such waivers are not appropriate for contracts requiring performance by a cleared defense contractor. Approved waivers on a class basis must include a planned expiration date and guidance for requiring CMMC certification in subsequent solicitations." Level 3 - "In rare circumstances, waivers may be warranted for CMMC Level 3 third-party assessment requirements: such waivers, however, are not appropriate for contracts or work statements requiring access to both unclassified and classified DoD information." Full memo on the process found here, starting on page 6: https://lnkd.in/eeBCW53n #cmmc #dib #dfars

57

12 Comments

If you’re interested in OT cybersecurity, this webinar will walk you through the recently released "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators". You’ll learn the steps to building and maintaining a robust asset inventory, because if you don’t know what you have, you can’t protect it. #otsecurity #securebydesign #cybersecurity

6