Leslie Kershaw

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

EXIT QUESTION: ever wonder what scares a retired Lt. General & Commander of Marine Cyber Force? - China’s embedded “into as much of America’s critical infrastructure” as possible - New, persistent approach to maintain access - Significant operational capabilities - Waiting for the opportune time I’ve been saying this for a long time. The wake up call on this is that we see now China is shifting from this intellectual property grab to a more persistent approach. Meaning embed yourself into as much of America's critical infrastructure as you can. And by critical infrastructure, we're talking water, energy, power, telecom. Embed yourself. Keep checking to make sure that the accesses that you stole are still good. So you might see some repeat kind of visits to some of these infrastructures. And that signals to us that they are waiting to use these capabilities and these cyber accesses at a more opportune time. Maybe as they are thinking about making a move on Taiwan. Maybe when the U.S. wants to do something in support of Israel. So it becomes more of an operational capability for them—if they're successful in maintaining these kind of clandestine accesses. 🚨 And that's what's changed. And that's what should scare us a little bit.

28

2 Comments

Yesterday, I had the pleasure of attending #CMMCDay. There were a lot of great discussions kicked off by Matthew Travis, The Cyber AB. I took a few key points from the discussion throughout the day. 1. False Claims Act - This will continue to be the primary compliance review for the DoD. Why not 'deputize' those within the DIB to police themselves. With the payouts being received from false claims act, it appears that it will be an effective tool for the DoD. 2. Rulemaking Timeline - The DoD continues to adjudicate public comments on the #CMMC Program rule (CFR 32) and all indications are that it will be released by fall 2024. This rule will make CMMC affective and allow certifications to begin outside the Joint Surveillance Assessment (JSVA) Program. CFR 48 that will mandate CMMC be included in contracts is expected to be delayed until later in 2025. Therefore, the DoD will essentially provide a grace period from Fall 2024 to mid/late 2025 for organizations to get certified prior to mandating it in contracts. 3. Not Just Technology - CMMC is a verification and validation program. Organizations must demonstrate that they are implementing the CMMC Requirements to a third-party assessor; while some controls (e.g., encryption, malicious code scanning) can be performed using technology, other controls (e.g., background screening, training, security assessments) require people to perform. 4. 100% Ready - There was a lot of discussion on the activities within the JSVA. These assessments provide insight into what organizations can expect during a CMMC assessment. One of the key themes coming from these assessments is if you aren't 100% convinced your organization is ready for an assessment - then you’re not ready! If you couldn’t attend and want to learn more about these and other topics, send me a note. I'd be happy to share additional insights. If you were able to attend, what key points did you take away from the event?

14

DoD Weapon System Production and Sustainment at Risk: National Security Implications of Port Disruptions The recent U.S. port strike resolution may seem like a temporary reprieve, but it highlights significant vulnerabilities for the Department of Defense (DoD) supply chain—particularly in the context of weapon system production and sustainment. As labor costs rise and U.S. ports struggle with automation adoption, increased shipping fees and delays could severely impact the delivery of critical components needed for military platforms, from aircraft to precision-guided munitions. In a time of rising tensions with near-peer adversaries like China, these disruptions pose a real national security risk. The U.S. is already facing a $19 billion backlog in weapon transfers, including to key allies like Taiwan, and studies have shown that the U.S. could run out of long-range precision munitions in less than a week in the event of a major conflict. Supply chain vulnerabilities like these will only be exacerbated by rising costs and port inefficiencies. Furthermore, reliance on alternative foreign ports, particularly those in Mexico, where China has significant influence and investments, could introduce additional risks. Supply chain visibility in these ports is less robust, increasing the potential for foreign adversaries to exploit weaknesses in the defense industrial base. The DoD has already acknowledged its limited visibility into the lower tiers of its supply chain. This is a critical oversight that needs urgent attention, especially when many critical materials and electronic components are sourced from regions vulnerable to adversary control. The inability to track these vulnerabilities across the supply chain means delays and disruptions could cascade, undermining weapon system production and sustainment. To mitigate these risks, the DoD must accelerate its supply chain risk management efforts, modernize its industrial base, and reduce reliance on foreign ports by investing in domestic production capabilities. The development of “ever-warm” production lines for critical materials, as well as increased automation at U.S. ports, are key strategies that can enhance resilience and ensure the U.S. is prepared for any conflict scenario. Now more than ever, a robust, resilient, and secure supply chain is essential to maintaining military readiness and safeguarding national security. Govini #SupplyChainRisk #SupplyChainRiskManagenent #NationalSecurity #DoDLogistics #DefenseLogistics #WeaponSustainment #DefenseIndustrialBase #DefenseReadiness

4

13 Comments

🌟 Proud Partnership! NetCentrics is thrilled to partner with the Air National Guard to enable ANG’s cloud missions and cloud threat hunts and enhance security! Washington Air National Guard and Maryland National Guard are the first to receive these new capabilities.   Our innovative solution Wraith® seamlessly integrates with existing cloud and on-premise architectures, reducing overall costs and training duration ─ while supporting readiness and agility of Cyber Protection Teams (CPTs).    This collaboration not only strengthens ANG’s cyber defense capabilities but also sets a new standard for the Department of Defense.   Together, the ANG and NetCentrics are making strides in securing critical mission assets and workloads across multi-cloud environments.    Read the press release: https://lnkd.in/eirq3V8f #Partnership #CyberDefense #CloudSecurity #DoD #ANG

20

1 Comment

LMI leverages considerable experience across DoD in optimizing and updating internal controls and remediating audit findings to work with organizations. In keeping with the principles of LMI’s performance optimization line of business, our teams of subject matter experts optimize key controls for consistent, compliant, and effective operations. 👉 Have a question or concern related to your organization’s property tracking processes and related internal controls? Learn more about LMI’s steps for optimizing property tracking and connect with LMI subject matter experts today: https://hubs.ly/Q02Pdfhf0 // #PeoplePoweringPossible #Defense #Audit //

11

1 Comment

DoD Contractors: FCI vs CUI We discuss CMMC Compliance requirements, implementing NIST 800-171 110 controls to meet CMMC Level 1 and prepare for CMMC Level 2 assessment.

2

1 Comment

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4

New Security Clearance Questionnaire, Better Customer Focus Critical for NBIS in 2025 DCSA Director David Cattler and NBIS Program Manager Rob Schadey provided further context to why technology is a critical focus of America's largest security agency, and what to expect from the NBIS program as we move into 2025. https://lnkd.in/grJtayAu

6

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

9

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

9

Happy to see after a long twisting process, this is moving forward. Most entities CMMC applies to have started or are starting their compliance journey to ensure they meet the requirements outlined here. If you are struggling with how complex this process is or simply do not have the resources to complete it quickly, reach out to advisor that can help. #cmmc #governance #compliance

8

The Defense Department is actively working on plans to build cybersecurity requirements for the defense industrial base into defense contracts as part of its Cybersecurity Maturity Model Certification https://ow.ly/EA4V50TNGPJ #DoD #cybersecurity

1

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

A few things to digest here: 1. Thank you Robert Metzger for volunteering all of your time to help make things happen. 2. A tax rebate or reduction is only available AFTER the fact, so that's not going to help much at all. Small businesses live or die on cash flow. 3. Any kind of loan - with interest - doesn't help the business, it just puts it further in debt. 4. Even if a business goes through with all of this, there is NO GUARANTEE they will ever win or renew a DiB contract. Ideas: Why not just have the government front the cost, and then deduct it from the payment? This would incentivize the government and prime contractors to use many different sub-contractors. Why not just use DIBCAC assessors to do the third party attestations? There is no training necessary.

5

1 Comment

🚨 DFARS 252.204-7021 (the CMMC clause) is currently at the Office of Management and Budget (OMB) 🚨 The abstract states, "DoD is amending an interim rule to implement the CMMC framework 2.0 in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides the Department with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain." Once approved, the rule will be sent to the Federal Register for publication 👀 You can see the rule here: https://lnkd.in/eyP5dqre Shoutout to Eric Crusius for breaking this news! #cmmc #dod #cybersecurity

35