Rick Gordon

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive 25-01, mandating federal civilian agencies to enhance cloud security by 2025. This directive requires agencies to identify all cloud tenants by February 21, 2025, deploy CISA's automated configuration assessment tools by April 25, 2025, and implement Secure Cloud Business Applications (SCuBA) policies by June 20, 2025. These measures aim to mitigate risks from misconfigurations and weak security controls, reducing the federal government's attack surface. CISA also recommends that all organizations adopt these practices to bolster cybersecurity resilience. #ZeroTrustAdvocate

2

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

Gen. Timothy Haugh, head of US Cyber Command and the NSA, warns that China, Russia, and others are increasingly targeting companies supporting the DoD and critical infrastructure. The defense industrial base, crucial to national security, is under active threat, particularly from the People's Republic of China. Key Points: 1. Over 160,000 companies, employing 9% of the US workforce, form the defense industrial base. 2. The Volt Typhoon campaign by China has pointedly targeted critical US infrastructure. 3. AI-enabled cyber threats are a growing concern. The NSA and Cyber Command are enhancing AI-based defenses and expanding information-sharing initiatives. 4. The Pentagon's Zero-Trust Network Access will be fully implemented by the end of 2025, enhancing cyber defenses with advanced AI tools. This shift towards a zero-trust architecture and a unified data approach is crucial for future-proofing our cyber defenses. Stay vigilant, stay informed. #Cybersecurity #Defense #AI #ZeroTrust #NationalSecurity #Leadership #ShieldsUp

2

Sara Friedman, thanks for the great article! DoD's ramp up plan per the draft 32 CFR Part 170 for the number of assessed orgs isn't the throughput concern. As an authorized C3PAO, we are warning clients to expect heavy market pressure from their Primes when Peak InfoSec and other C3PAOs can start doing assessments to get CMMC Level 2 Certified ASAP. We are hearing consistently that start date will be March 2025. We are already hearing subs are told by their primes to either undergo a JSVA before the start date or be ready to get CMMC L2 Certified during Phase 1. Or, be ready to be dropped from teaming groups... We are also uncertain about if and how DoD would want authorized C3PAOs to prioritize assessments. Logically, companies competing for Phase 2+ contracts and ESPs should have priority. Everyone else gets worked as the ecosystem naturally grows to handle the demand, which I believe it will. In the meantime, we recommend all DIB companies to start their C3PAO selection process now and get on the assessment schedule.

2

🌟 Proud Partnership! NetCentrics is thrilled to partner with the Air National Guard to enable ANG’s cloud missions and cloud threat hunts and enhance security! Washington Air National Guard and Maryland National Guard are the first to receive these new capabilities.   Our innovative solution Wraith® seamlessly integrates with existing cloud and on-premise architectures, reducing overall costs and training duration ─ while supporting readiness and agility of Cyber Protection Teams (CPTs).    This collaboration not only strengthens ANG’s cyber defense capabilities but also sets a new standard for the Department of Defense.   Together, the ANG and NetCentrics are making strides in securing critical mission assets and workloads across multi-cloud environments.    Read the press release: https://lnkd.in/eirq3V8f #Partnership #CyberDefense #CloudSecurity #DoD #ANG

20

1 Comment

Ensuring Compliance: Aegis Cyber Defense Systems’ Commitment to Government and Industry Standards In today's highly regulated landscape, maintaining compliance with both governmental and industry-specific cybersecurity standards is not just a requirement—it's essential for safeguarding operations, protecting sensitive data, and avoiding costly penalties. At Aegis Cyber Defense Systems, we understand the complexity of regulatory frameworks and how vital they are to businesses, especially for government contractors, critical infrastructure sectors, and enterprises handling sensitive information. Why Compliance Matters Aegis Defender Pro not only provides cutting-edge cybersecurity solutions but also ensures that our clients meet their regulatory obligations. Our platform is designed with compliance in mind, automating security protocols that align with major regulatory requirements. Here’s how we help organizations stay compliant: Comprehensive Logging and Monitoring Our platform provides continuous logging of all network activities, ensuring that your organization can meet the audit and reporting requirements set by compliance standards. Detailed logs are essential for demonstrating adherence to regulatory guidelines and for identifying any unauthorized access attempts in real time. Real-Time Auto-Mitigation Aegis Defender Pro’s auto-mitigation feature ensures that your network is always protected against emerging threats, in line with the latest security recommendations. When a malicious IP or CIDR is identified, it is blocked across all your network’s firewalls within minutes, ensuring compliance with regulations that mandate immediate threat response. Centralized Control and Reporting Our platform provides a centralized dashboard that allows organizations to monitor their compliance status across all endpoints. Whether it’s patch management, firewall updates, or network segmentation, you can track everything in one place. This centralized control is invaluable for audits and assessments, making it easier to provide proof of compliance. Crowdsourced Security for Enhanced Compliance With every Aegis client contributing to our Master Block List, your organization benefits from a community-based defense system that not only secures your own network but also strengthens the collective defense. This proactive approach ensures that threats are identified and mitigated before they can affect compliance measures. Read more: https://lnkd.in/ePT5k8Xx

6

Baltimore, Maryland: Last week, on the fringe of the AFCEA TechNet Cyber Conference, Mike Walsh sat down with Francis Rose to chat about the DoD's Comply-To-Connect (C2C) program and how this investment made by Congress creates a net-positive wrt -- ✍ Executive Order 14028: 1️⃣ "It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order." 2️⃣ "To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, the Federal Government must take decisive steps to modernize its approach to cybersecurity." Which requires the Federal Government to invest in and secure both Information Technology (IT) and Operational Technology (OT) systems. BL: The continuous monitoring, assessment, and security of all IT, IoT, and OT endpoints are both necessary and achievable to "build secure systems in untrusted networks" #ZeroTrust. ☠ 🌀 Volt Typhoon: 1️⃣ The discovery of Chinese malicious code embedded in the telecommunications systems used by the U.S. military in Guam, home to three strategic U.S. bases, sent waves through the national security community. The Chinese Communist Party (CCP) currently uses cyberspace to achieve espionage and intellectual property theft objectives. 2️⃣ However, they aspire to use malware hidden in our critical networks to disrupt our response to a future CCP invasion of Taiwan. BL: This cannot be overstated: denying the availability of weapon systems in the garrison is as effective as destroying them on the battlefield.

32

Big update in #defense; FOCI mitigations and approvals through the Defense Counterintelligence and Security Agency (DCSA) are required for companies with contract awards $5M or more, even if all the work is UNCLASSIFIED. This article highlights the substantive changes in how the government is protecting the DIB from undue foreign influence. It also demonstrates that a lot of the details are yet to be ironed out. Here’s the main piece of advice: “DoD contractors that do not currently hold a facility clearance but do have DoD contracts in excess of $5 million should familiarize themselves with the SF-328 and establish policies and procedures to assess and comply with the FOCI Instruction and forthcoming DFARS provision.” The main issue I see is Defense Counterintelligence and Security Agency (DCSA) becoming THE BOTTLENECK for contract execution, and now not just for classified contracts, but ALL CONTRACTS OVER $5M. (Calling AI solutions to speed up FOCI approvals and Security clearance processing!). I’m curious if folks have already been affected by this- delayed contract start dates, any new terms you’re seeing?! Please share! #nationaldefense #executionmatters #onward

28

2 Comments

#CMMC community. Everyone has probably not yet noticed but the previous Glossary document has fallen off and was not updated to 2.13 version nor added to the CIO web page. Instead CMMC specific definitions are contained in 32CFR170. So they are still out there just not in a separate PDF. 32CFR170 we have found is a pain searching through to get to the definitions, and I think definitions are super important. So we have pulled together our own Glossary document and posted it. We reference where the definitions come from (we pulled some from 7012 as well) and then also added some of the NIST glossary definitions we use the most. Feel free to book mark and use as you see fit. Just a working aid. Cheers. Amira Armond Jacob Horne Carter Schoenberg Glenda R. Snodgrass, Linda Rust Ryan B. Kyle Lai Nathan Regola Kevin Wheeler

48

7 Comments

Tired of managing security testing across a scattered team? AttackIQ Mission Control centralizes control testing for faster remediation and improved ROI. 📅 Join Jose Barajas at 10 AM PT/12 PM CT/1 PM ET on July 18th to learn how AttackIQ Mission Control streamlines security operations for organizations. Discover how to seamlessly orchestrate testing across departments and locations, gain insights specific to your role with role-based dashboards, and simplify testing workflows for faster results. ➡ Register today and optimize your #SecurityOperations: https://bit.ly/3RZa5hw #LinkedInLive #Cybersecurity

13

Big day for #PQC and the evolution of #cybersecurity! QuSecure is proud of our #leadership role in advancing #crypto agility with our #quantum resilient software solution QuProtect. To assist organizations in getting started, contact QuSecure as we are offering organizations the following four opportunities: 1. For CISOs: A free road mapping session with QuSecure, the award-winning company in crypto agility with more implementations than anyone to date. 2. For Boards and Executive Team Members: A half-day briefing with Accenture and QuSecure. Learn what others are doing and how to apply what they have learned to your organization. 3. For Organizations Ready to Test Crypto Agility: A #free #POC addressing your choice of Crypto Agility across applications, networks, and routers. 4. For Anyone Looking to Learn More: QuSecure is teaming with PayPal for a webinar on “Protecting Blockchain & Crypto Against Quantum & AI” on Wednesday, August 14, at 1 pm PT/4 pm ET.

1

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

9

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

9

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

12

If you have not been following the news about the National Public Data (NPD), then you should be! Brian Krebs does a great job of breaking down what the NPD breach is about, how it happened, and how long the data been available. It is HIGHLY recommended that you contact all three credit reporting services (TransUnion, Experian, and Equifax) to freeze your credit until you need it! You may also want to do this for your dependents and other family members that may not be able to do so themselves. Also, there is a link to where you can search to see if your records, including your #SSN have been exposed. #dataprivacy #identitytheft #MaxDefense #secureyourworld

18

7 Comments

In the latest video from our series, Cynomi Co-founder and CEO, David Primor and cyber expert William Birchett from Logos Systems discuss CMMC 2.0 and its implications for defense contractors and subcontractors. CMMC 2.0 is the latest requirement for defense contractors and subcontractors. Anyone who sells to the Federal Government—from Windows to widgets to safety gear—must meet these compliance standards. As MSSPs and MSPs, you play a crucial role in helping your clients achieve CMMC 2.0 compliance. 🌐 Here are three ways you can assist: ✅ Self-Comply ✅ Assist in Self-Attestation ✅ Encourage Timely Audits For more assistance, leave us a note in the comments. We're here to help your MSSP/MSP navigate the complexities of CMMC 2.0 compliance. 🎥 Watch the full video here to find out more: https://hubs.la/Q02yZY8p0

8

Once NIST SP 800-171 and SP 800-171A are published this month, federal agencies are on the clock to start using Revision 3 (outlined in the Office of Management and Budget (OMB) Circular No. A-130, “Managing Information as a Strategic Resource.” The policy states on page I-16: “For legacy information systems, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines within one year of their respective publication dates unless otherwise directed by OMB. The one-year compliance date for revisions to NIST publications applies only to new or updated material in the publications. For information systems under development or for legacy systems undergoing significant changes, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines immediately upon deployment of the systems.” Visibility of how your sensitive data is being handled through it's lifecycle will.be essential; even when it's sitting somewhere within your supply chain. Seclore Data Centric Security is a strong part of NIST and achieving zero trust. https://lnkd.in/efiMejPG #NIST800171 #SecurityRequirements #NIST800171A #AssessmentProcedures #CUI #OMBCircularA130

7