Tammy Bogart

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4

DoD Contractors: FCI vs CUI We discuss CMMC Compliance requirements, implementing NIST 800-171 110 controls to meet CMMC Level 1 and prepare for CMMC Level 2 assessment.

2

1 Comment

Check up our upcoming #webinars! 📆 Wednesday, July 24, 2024 – 1:00pm ET 🌐 A Summary of Changes of the DoD/DOE ELAP QSM Version 6.0 and PJLA Transition Requirements 👉 Click to register: https://lnkd.in/gq_95E2Y Join PJLA for an informative webinar detailing the latest updates in the Department of Defense (DoD) and Department of Energy (DOE) Environmental Laboratory #Accreditation Program (ELAP) Quality Systems Manual (QSM) Version 6.0. This session will cover essential changes and the necessary steps for transitioning to the new requirements. Don’t miss this opportunity to stay ahead of the curve and ensure your laboratory’s #compliance. Key Takeaways: ▪ Overview of the major changes in QSM Version 6.0 ▪ Understanding the impact of these changes on your laboratory operations ▪ Detailed transition requirements and timelines from PJLA 📆 Wednesday, August 14, 2024 – 1:00pm ET 🌐 ISO/IEC 17025:2017 Section 7.4 “Handling of Test or #Calibration Items” & 7.11 “Control of Data and Information Management” 👉 Click here to register: https://lnkd.in/gyww9usk When items come into the #laboratory ISO/IEC 17025:2017 has specific requirements which we will investigate such as identification, storage, and deviations from specified conditions. Control of data is within the ISO/IEC 17025 Standard. In today’s computer age, information management is much more prevalent in laboratory operation including software utilization and information management system being maintained off site. This webinar will investigate the requirements specified in Section 7.11 of the 2017 Standard.

2

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/dhj2iTT9 #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

3

Learn to Win’s training software reaches DoD Impact Level 6, thanks to Second Front Systems. Read more: https://lnkd.in/ePspR3Bw #ImpactLevel6 #Technology

30

The U.S. Department of Defense (DoD) recently released its new cybersecurity strategy for the Defense Industrial Base (DIB), which is comprised of more than 100,000 defense contractors and subcontractors. The Strategy outlines four key strategic goals aimed at improving the digital security of the DIB. Those four goals include: (i) bolstering interagency collaboration and developing regulations that will further govern the cybersecurity responsibilities of contractors and subcontractors; (ii) enhancing the cybersecurity posture of the DIB; (iii) preserving the resiliency of critical DIB capabilities in a cyber-contested environment; and (iv) improving cybersecurity collaboration between DoD and the DIB. Notably, the Cybersecurity Maturity Model Certification 2.0 program looms large throughout DoD's DIB Strategy and is expected to play a significant role in ensuring the DIB community complies with DoD regulations governing information and data security. In the article below, Beth Burgin Waller and Patrick Austin, members of the WRVB Cybersecurity & Data Privacy practice team, collaborated with Tony Mazzeo and Jerry Miles, members of the WRVB Government Contracts practice team, to summarize DoD's new DIB Cybersecurity Strategy. https://bit.ly/4aRhWon

5

The Cybersecurity Maturity Model Certification (CMMC) rule established to verify that contractors have implemented required security controls to protect federal contract information (FCI) and controlled unclassified information (CUI). Learn requirements and next steps. https://lnkd.in/g_sTgAKy. Thanks for your insight, Jason Oksenhendler, CISM, CAP, CCSK and Devin Osterhout. #Cybersecurity #CMMC

3

More to read! DoD has updated the #CMMC documentation stack. Scoping Guidance(s), Assessment Guide(s), and more. Much to consider.

25

2 Comments

The DoD’s Cybersecurity Maturity Model Certification (CMMC) final rule is a game-changer for the defense industrial base. Aerospace and defense attorney Shawn Cheadle shares his insights on the rule’s key elements, evolution, and phased implementation here: https://ow.ly/huaX50TQXpT #ALawFirmShapingTheFuture #ShermanHowardInsight #CybersecurityStandards #DoD #ComplianceJourney

2

DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement contractual requirements related to the Cybersecurity Maturity Model Certification (CMMC) 2.0 Program. Read the proposed rule here: https://hubs.li/Q02Lt0VR0 #CMMC #CMMC2.0

10

A 2010 executive order aimed to secure "Controlled Unclassified Information" (CUI). A 2023 audit found DoD issues with mislabeled documents, outdated systems, and poor training, with nearly 50% lacking proper CUI tags 😱 Here's what went wrong and how it can be fixed: https://loom.ly/rvaZ2ZM #CUI #CyberSecurity #DoDAudit #InfoSecurity #Compliance

2

🚨 #STIGs are standards from the DoD that capture the #cybersecurity requirements for #software #applications. Join our webinar to learn what a STIG guide is, how to approach it, and why continuous #cyber readiness is critical. More 👉 https://lnkd.in/eDSSnMYN

3

𝗣𝗦𝗔: 𝗽𝘂𝗯𝗹𝗶𝗰 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀 𝗼𝗻 𝘁𝗵𝗲 𝗖𝗜𝗥𝗖𝗜𝗔 𝗽𝗿𝗼𝗽𝗼𝘀𝗲𝗱 𝗿𝘂𝗹𝗲 𝗮𝗿𝗲 𝗱𝘂𝗲 𝘁𝗼𝗱𝗮𝘆. CISA recently published a proposed rule to implement the requirements in the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA). The rule will duplicate and expand cyber incident reporting requirements for defense contractors thanks to the Defense Industrial Base being a critical infrastructure sector and DoD cyber regs not exempting small businesses. That is unless DoD and CISA come together in a bureaucratic drum circle and/or couples therapy and reach an agreement that would allow defense contractors to only report incidents once. Friendly reminder: - The proposed rule asks for public comment on 𝟳𝟯 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝗽𝗼𝗹𝗶𝗰𝘆 𝗰𝗼𝗻𝘀𝗶𝗱𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀 across 17 broad categories (link in comments) - 𝗡𝗲𝗮𝗿𝗹𝘆 𝗮 𝗾𝘂𝗮𝗿𝘁𝗲𝗿 (𝟮𝟯%) of affected entities are in the Defense Industrial Base (more than any other affected sector) - 𝟭𝟳% 𝗼𝗳 𝗮𝗹𝗹 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗮𝗿𝗲 𝗗𝗜𝗕 𝘀𝗺𝗮𝗹𝗹 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀𝗲𝘀 (more than any other affected sector) And yet CISA didn't ask for specific comments on that topic. My advice is to remind them about that. See the comments for additional resources.

69

11 Comments

We will likely see the long-awaited FAR on CUI this month. Here is a history on the NIST documents which are used to create security for CUI.

14

🔎 Finalized 💻 The Department of Defense (DoD) finalized revisions to the eligibility criteria for the Defense Industrial Base (DIB) Cybersecurity (CS) Program on March 12, 2024. The new rule went into effect on April 11, 2024. The revisions include: Removing the requirement for cleared defense contractors: The program is now open to all defense contractors who own or operate unclassified information systems that process, store, or transmit covered defense information. Removing the requirement for a medium assurance certificate: Participants no longer need to secure a medium assurance certificate. Making technical corrections and changes to definitions: The rule also includes technical corrections and changes to definitions for readability. ⚠️ Get in Touch with Us 🔗 www.cmmccompliance.us #DoD #cibersecurity #contractors #information

2

Want the latest on CMMC compliance updates? J Bryant Vásquez is your guy. he is one of the most well-rounded cyber pros in the state with knowledge that applies to every sector of the manufacturing industry. #defense #aerospace #manufacturing #cybersecurity #cmmc #compliance

8