Bruce Hidaka-Gordon

A few things to digest here: 1. Thank you Robert Metzger for volunteering all of your time to help make things happen. 2. A tax rebate or reduction is only available AFTER the fact, so that's not going to help much at all. Small businesses live or die on cash flow. 3. Any kind of loan - with interest - doesn't help the business, it just puts it further in debt. 4. Even if a business goes through with all of this, there is NO GUARANTEE they will ever win or renew a DiB contract. Ideas: Why not just have the government front the cost, and then deduct it from the payment? This would incentivize the government and prime contractors to use many different sub-contractors. Why not just use DIBCAC assessors to do the third party attestations? There is no training necessary.

5

1 Comment

EXIT QUESTION: ever wonder what scares a retired Lt. General & Commander of Marine Cyber Force? - China’s embedded “into as much of America’s critical infrastructure” as possible - New, persistent approach to maintain access - Significant operational capabilities - Waiting for the opportune time I’ve been saying this for a long time. The wake up call on this is that we see now China is shifting from this intellectual property grab to a more persistent approach. Meaning embed yourself into as much of America's critical infrastructure as you can. And by critical infrastructure, we're talking water, energy, power, telecom. Embed yourself. Keep checking to make sure that the accesses that you stole are still good. So you might see some repeat kind of visits to some of these infrastructures. And that signals to us that they are waiting to use these capabilities and these cyber accesses at a more opportune time. Maybe as they are thinking about making a move on Taiwan. Maybe when the U.S. wants to do something in support of Israel. So it becomes more of an operational capability for them—if they're successful in maintaining these kind of clandestine accesses. 🚨 And that's what's changed. And that's what should scare us a little bit.

28

2 Comments

New Hub-and-Spokes post! 🚀 Capitalizing on Critical Technologies: DoD's Office of Strategic Capital and its Plan to Secure America’s Strategic Edge Three key stories shaping U.S. defense and Indo-Pacific alliances this week: 1️⃣ DoD's Office of Strategic Capital Unveils 2025 Investment Plan Focused on supporting critical technologies and national security priorities, OSC's new strategy aims to catalyze private investment in sectors crucial to America’s edge. 2️⃣ $3.6B Sale of Air-to-Air Missiles to Japan A significant step in bolstering U.S.-Japan defense cooperation with the sale of AMRAAMs, ensuring the security of U.S. personnel and regional stability. 3️⃣ NSA Jake Sullivan’s Capstone Trip to India Sullivan's visit underscores the growing U.S.-India relationship, focusing on space cooperation, nuclear collaboration, and emerging technologies. #Defense #NationalSecurity #Technology #USIndia #USJapan #Investment #StrategicAlliances https://lnkd.in/euN3a_Bb

15

🌟 Proud Partnership! NetCentrics is thrilled to partner with the Air National Guard to enable ANG’s cloud missions and cloud threat hunts and enhance security! Washington Air National Guard and Maryland National Guard are the first to receive these new capabilities.   Our innovative solution Wraith® seamlessly integrates with existing cloud and on-premise architectures, reducing overall costs and training duration ─ while supporting readiness and agility of Cyber Protection Teams (CPTs).    This collaboration not only strengthens ANG’s cyber defense capabilities but also sets a new standard for the Department of Defense.   Together, the ANG and NetCentrics are making strides in securing critical mission assets and workloads across multi-cloud environments.    Read the press release: https://lnkd.in/eirq3V8f #Partnership #CyberDefense #CloudSecurity #DoD #ANG

20

1 Comment

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

DoD Weapon System Production and Sustainment at Risk: National Security Implications of Port Disruptions The recent U.S. port strike resolution may seem like a temporary reprieve, but it highlights significant vulnerabilities for the Department of Defense (DoD) supply chain—particularly in the context of weapon system production and sustainment. As labor costs rise and U.S. ports struggle with automation adoption, increased shipping fees and delays could severely impact the delivery of critical components needed for military platforms, from aircraft to precision-guided munitions. In a time of rising tensions with near-peer adversaries like China, these disruptions pose a real national security risk. The U.S. is already facing a $19 billion backlog in weapon transfers, including to key allies like Taiwan, and studies have shown that the U.S. could run out of long-range precision munitions in less than a week in the event of a major conflict. Supply chain vulnerabilities like these will only be exacerbated by rising costs and port inefficiencies. Furthermore, reliance on alternative foreign ports, particularly those in Mexico, where China has significant influence and investments, could introduce additional risks. Supply chain visibility in these ports is less robust, increasing the potential for foreign adversaries to exploit weaknesses in the defense industrial base. The DoD has already acknowledged its limited visibility into the lower tiers of its supply chain. This is a critical oversight that needs urgent attention, especially when many critical materials and electronic components are sourced from regions vulnerable to adversary control. The inability to track these vulnerabilities across the supply chain means delays and disruptions could cascade, undermining weapon system production and sustainment. To mitigate these risks, the DoD must accelerate its supply chain risk management efforts, modernize its industrial base, and reduce reliance on foreign ports by investing in domestic production capabilities. The development of “ever-warm” production lines for critical materials, as well as increased automation at U.S. ports, are key strategies that can enhance resilience and ensure the U.S. is prepared for any conflict scenario. Now more than ever, a robust, resilient, and secure supply chain is essential to maintaining military readiness and safeguarding national security. Govini #SupplyChainRisk #SupplyChainRiskManagenent #NationalSecurity #DoDLogistics #DefenseLogistics #WeaponSustainment #DefenseIndustrialBase #DefenseReadiness

4

13 Comments

DISA continues to innovate and enhance security measures with #AI and #Analytics to protect the DoD's missions and defend their networks. Lt. Gen. Robert Skinner emphasized strategic alignment and stressed the role of partnerships, talent, and innovation in staying operationally ready and maintaining a positional edge. Together with DISA, Leidos is delivering resilient and flexible IT capabilities at scale and speed to connect and protect the warfighter. Read more about the insights that were shared at AFCEA's TechNet Cyber 2024 here: https://bit.ly/3VYPxH0 #Innovation #CyberSecurity

23

The Defense Department is actively working on plans to build cybersecurity requirements for the defense industrial base into defense contracts as part of its Cybersecurity Maturity Model Certification https://ow.ly/EA4V50TNGPJ #DoD #cybersecurity

1

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4

ICYMI: On Thursday, the Biden-Harris administration issued a National Security Memorandum on Artificial Intelligence. I had the privilege of being present for the rollout by Jake Sullivan at NDU that morning. My initial thoughts: it's good to see the conversations around this have moved past where we were just two years ago talking about AI being the end of humanity. To be sure, there are risks - people doing bad things with AI, people doing bad things to AI, and just bad/shoddy AI. However, the risk of the United States falling behind strategic competitors both in national security applications as well as broader applications that ripple throughout our economy is far greater than any Skynet scenario we might dream up. The NSM strikes a good balance here, summed up as: we need to manage the risks prudently (and have a framework for doing so) but ABSOLUTELY need to gain and maintain the lead (not only in training better models but also directly related areas such as chips and energy). https://lnkd.in/eFwJ7yZm

8

🚀 Major Milestone for Army Software Modernization! 🚀 On the heels of the proposed CMMC Level 2 readiness gate criteria requirement on the massive Army MAPS IDIQ opportunity from yesterday - the Army continues to lead the way towards a more secure and resilient supply chain! The Army CIO just released five pivotal policy memos driving forward Initiative 8 under Army Directive 2024-02. These memos are a game-changer for cybersecurity and DevSecOps, embedding security directly into software development for faster, more secure tools to support soldiers on the modern battlefield. 📜 Key Memos Include: • Army Software Modernization Directive—Initiative 8—Implementation Plan • Army DevSecOps Configuration Management Framework • Army DevSecOps Platform Certification • Army DevSecOps Pipeline Certification • Army Transition to Continuous Authority to Operate (cATO) These policies lay the groundwork for a faster, more agile, and secure development process, with cATO as a centerpiece — enabling continuous monitoring and faster approvals. 📚 Links to Memos can be found below in the commments👇 #ArmyModernization #DevSecOps #Cybersecurity #cATO #ArmyCIO #CMMC #SecurebyDesign #SSDF Benjamin S. Katie Arrington Jason R... Weiss Chris Hughes Scott Edwards Dr. Pete Dowdy, DSc., CISM, CGRC, CDPSE, CEH David A. Africano Ryan Gibbons Alex Hoang To Ben Tchoubineh Sherif Said, PMP David "SPUD" Webb, MSIT, CISSP, CCISO, CAPM, Opinions are MINE Jen Easterly Jeremy Stinson, MBA Ntoh O Etta Aaron Aaron Burrows Jerry Leishman Tony Barrett Kristin Sargent Eric Levitas Tom Sanders Angela Rittenbach Greg Goldwater Robert Metzger Carter Schoenberg Kyle Lai Regan Edens Megin Kennett Eric Power Mackenzie Burkhammer George Perezdiaz Jeff Baldwin, D.Sc. Koren Wise Linda Rust Tom Cornelius Lauren C. Ayers Jacob Horne ☁️ Dave Fairburn Jr. CISSP, “Father of FedRAMP" Alexy J.

34

9 Comments

We have the opportunity to collaborate with some of the best technology companies in the industry to match capabilities to critical government needs. In discussion with government, one of the common questions that you will hear is, "What TRL is the technology." Technology Readiness Level, or TRL, determines whether a technology in mature enough to include in a larger system. In 1999, the GAO published an influential report called, Best Practices: Better Management of Technology Can Improve Weapon System Outcomes. This report concluded that using immature technology increased program risk and recommended wider use of TRLs. The revised and reissued report is a great reminder of best practices for evaluating the readiness of technology for use in acquisition programs and projects. The Office of the Under Secretary of Defense for Research and Engineering also published a Technology Readiness Assessment Guidebook in June 2023. C5BDI Office of the Under Secretary of Defense for Research and Engineering NavalXDoD SBIR/STTR Program Office Naval Sea Systems Command (NAVSEA)Naval Air Systems Command (NAVAIR) Marine Corps Systems Command

10

1 Comment

Heads Up...DoD News related to Architect - Engineering (AE) Services! (1) FINAL RULE Effective 8/26/2024 - DFARS Case 2024-D019 Architect and Engineering Service Fees. This rule changes DFARS to implement Section 2881 of the FY24 NDAA to increase the limitation of the contract price (i.e., "fee") for A-E services for the preparation and delivery of designs, plans, drawings, and specifications from 6% of the project's estimated construction cost to 10%. It is applicable to Army, Navy, and Air Force projects (references in 10 U.S.C. 7540,8612, and 9540). The new 10% limit replaces the 6% fee limitation on contract modifications for work not initially included in the contract and redesign, and applies only to that portion of the contract (or modification) price attributable to the preparation of designs, plans, drawings, and specifications. If a contract or modification also includes other services, the part of the price attributable to the other services is not subject to the fee limitation. (Personally, I've been waiting since the early 1990's for this percentage to change (and yes, I've been doing this THAT long). This makes it easier for small AE businesses to participate in the Federal space. So, YEA!) Permalink: https://lnkd.in/g7vF95R6 (2) PROPOSED RULE Comments due 9/27/2024 -- DFARS Case 2023-D007 Task Order and Delivery Order Contracting for Architectural and Engineering Services. This rules proposes a corresponding change to DFARS Subpart 216.5, Indefinite-Delivery Contracts, to require DoD Contracting Officers (KOs) to use qualification-based selections when awarding task orders and delivery orders for AE services that was previously implemented procedurally under FAR Subparts 16.500, 16.505, and 36.6 procedures in 2005 under the final rule for FAR Case 2004-001 Improvements in Contracting for Architect-Engineer Services. This proposed rule adds DoD-specific statutory guidance (10 U.S.C. 3406(h)(2)) to DFARS directing KOs not to request additional info regarding qualifications unless necessary to determine qualifications for a particular task order or delivery order under a multiple-award contract. There should be little to no impact from this proposed rule since there are no procedural changes, new clauses or provisions, and no new applicability in terms of thresholds or types of contracts. Permalink: https://lnkd.in/gwh2_38J

5

An interesting summary from Holland and Knight on the new #CMMC rule 32CFR170 which went final last Friday. I found their final paragraph particularly interesting... "The above is just the tip of the iceberg when thinking about the intricacies of the CMMC program and the implications for the DIB (including contractors far down the supply chain). Companies in the DOD supply chain would be wise to not delay further and ensure they are properly certified." At 470 pages the assessment community (C3PAO's and CCA's) are still getting their minds wrapped around the many aspects including significant changes that will impact how we assess Organizations Seeking Assessment (OSAs). The fundamental point though that DIB companies "would be wise to not delay further" is of course spot on. As Jacob Horne, Robert Metzger and others have been saying for a while, the time is past to get moving on having a cybersecurity program that supports CMMC compliance. There is a LOT of detail and nuance in a document with a word count 80% the New Testament. That said the fundamentals remain. First have a Program. This is not going to be something solved by either writing policies in a long weekend nor by buying a single tool. The #1 aspect of this or any program are the people executing it. These are activities that will need to be done now and into the future as long as an organization has a DoD contract or subcontract. The first thing to do for any program is pick the leader. Who will do this? Who will direct the work and make sure it stays on track? Do it in house, hire contractors, buy tools, whatever needs to be done... Who is the leader of your CMMC Program?

64

15 Comments