Don C. Weber

If you’re interested in OT cybersecurity, this webinar will walk you through the recently released "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators". You’ll learn the steps to building and maintaining a robust asset inventory, because if you don’t know what you have, you can’t protect it. #otsecurity #securebydesign #cybersecurity

6

Public certificates are transitioning from multi-purpose root hierarchies to single-purpose ones. Jason Soroko and I discuss why on the Root Causes Podcast. Audio: https://lnkd.in/gfdFiNvE Video: https://lnkd.in/gWzA9f8k

12

A foreign threat actor infiltrated the Kansas City National Security Campus (KCNSC), a key manufacturing site within the National Nuclear Security Administration (NNSA), exploiting unpatched Microsoft SharePoint vulnerabilities, according to a source involved in an August incident response at the facility. The breach targeted a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons under the NNSA, a semi-autonomous agency within the Department of Energy (DOE) that oversees the design, production, and maintenance of the nation’s nuclear weapons. Honeywell Federal Manufacturing & Technologies (FM&T) manages the Kansas City campus under contract to the NNSA. https://lnkd.in/giNSG9P5

22

1 Comment

Cyber attacks suck, but it's interesting to see what Texas has done to help manage the risk through Texas Municipal League Intergovernmental Risk Pool (TMLIRP), which offers cyber liability coverage and incident response support as part of its member services. https://lnkd.in/enXYpzV6

1

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

#CMS continues to fine-tune the #ARCAMPE. This time with some extra guidance on audit log capacity and retention. Coalfire keeps an eye on the changing landscape of compliance in the world of #ACA and #Medicaid 10-year retention seems a long time when compared to #HIPAA (not #HIPPA) requirements (6 years). How are you handling the increase in audit log storage required for compliance? https://lnkd.in/ejgZ4hYE

3

Recent DFARS cybersecurity clause changes have caused confusion across the govcon community. Some articles suggest that contractors no longer need to complete self-assessments or report scores in SPRS. That is not entirely accurate. While the NIST SP 800 171 Basic Self-Assessment requirement was removed from one DFARS clause, self-assessment requirements still exist under CMMC Level 1 for contractors handling Federal Contract Information. Our latest article explains what actually changed, what did not change, and what government contractors should review in their policies, contracts, and subcontract flowdowns. Read the full analysis to understand the compliance implications and what your team should verify next. https://hubs.la/Q046DP7C0 Author: Lynne Nalley #GovCon #CMMC #NIST #Compliance #Cybersecurity

8

1 Comment

Here is a mapping between the NDIA slide listing DOD requirements for SWFT and OMB M-22-18 materials needed for a SCRM risk assessment identified in the DOD FY 25-26 Software Modernization Plan following NIST and CISA guidance https::/ cisa.gov/sag NOTE: Changes at Energy Central have resulted in some broken links. The new Location of the OMB M-22-18 preparation advice is now located here: https://lnkd.in/eiKxgGWH The example attestation and artifact materials referred to in the article below are still available here: https://lnkd.in/eJwBEjBx

10

NIST has released the Final Public Draft of SP 800-172r3 for public comment. This update raises the bar for protecting CUI on nonfederal systems tied to high-value assets and critical programs. Key takeaway? Many of these enhanced security controls form the foundation for CMMC Level 3 compliance—making them essential for federal contractors. Stay informed and prepare for what’s next: review the draft and understand how these changes could impact your cybersecurity programs. TL;DR? Talk to Idenhaus Consulting, experts in CMMC. https://hubs.ly/Q03Wt84W0

1

DFARS 7012 requires contractors to implement NIST SP 800-171 to protect Covered Defense Information (CDI). DFARS 7019/7020 requires contractors to perform a basic assurance self-assessment and submit a score to SPRS that is within 3 years of contract award. DFARS 7021 specifies the CMMC level required to be awarded a DoD contract. CMMC levels require either self-assessment or third-party assessment. When making the determination of the level required for a contract, there is a memo that outlines the process that must be followed by the DoD program manager to obtain a waiver to "CMMC assessment requirements" for that contract. "Program Managers and requiring activities should identify information security requirements for the types of information most likely to be associated with the planned contract effort. When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the SAE, CAE, or DAE may approve requests to waive inclusion of CMMC assessment requirements. SAEs and CAEs must carefully weigh the risk of potential loss of CUI associated with mission critical capabilities before granting a waiver." Level 1 - "There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements." Level 2 - "In rare circumstances. such as when seeking competition from non-traditional DoD sources. waivers may be warranted for CMMC Level 2 third-party assessment requirements. Such waivers are not appropriate for contracts requiring performance by a cleared defense contractor. Approved waivers on a class basis must include a planned expiration date and guidance for requiring CMMC certification in subsequent solicitations." Level 3 - "In rare circumstances, waivers may be warranted for CMMC Level 3 third-party assessment requirements: such waivers, however, are not appropriate for contracts or work statements requiring access to both unclassified and classified DoD information." Full memo on the process found here, starting on page 6: https://lnkd.in/eeBCW53n #cmmc #dib #dfars

58

12 Comments

In my new article published by ICIT, Executing the RMF as an Engineering Discipline, not a Paperwork Exercise, I discuss how the Risk Management Framework must function as part of engineering, not as a compliance process. RMF was created to align design, implementation, and operations so that control performance is demonstrated through verified system behavior rather than documentation. The article explains how integrating RMF into development pipelines, architecture decisions, and operational telemetry allows authorization decisions to reflect real conditions in production. When security is designed, tested, and monitored as part of engineering, the framework delivers what it was meant to provide. Systems maintain authorization by demonstrating continued security in operation. Read the full article on ICIT: https://lnkd.in/eup93tvi #cybersecurity #technology

19

Navigating NIST 800-171 Compliance: A Guide for SMBs As cyber risks increase, it's crucial for Small and Medium-sized Businesses (SMBs) in the Defense Industrial Base (DIB) to protect sensitive information. Safeguarding Controlled Unclassified Information (CUI) is essential for their survival. Understanding NIST 800-171 and CMMC Compliance: NIST Special Publication 800-171 provides the framework for protecting this information, while the Cybersecurity Maturity Model Certification (CMMC) 2.0 builds upon it. For SMBs in the DIB, compliance isn't just a regulatory requirement—it's a strategic necessity for accessing Department of Defense (DoD) contracts and ensuring long-term business viability. Adhering to NIST SP 800-171 is a contractual obligation for organizations that handle CUI. https://lnkd.in/eshRftvJ

12

2 Comments

As concern rises over CISA Stakeholder Engagement Division’s ability to share information with the industry, Tenable CSO Bob Huber tells Axios, “The communications functions that this division provides are a nonnegotiable national security mechanism.” http://ow.ly/jgnL106oSol

9

CMMC compliance isn't a checkbox exercise—it's a strategic imperative for every DoD contractor. Many organizations delay action, waiting for final deadlines or clearer guidance. But NIST SP 800-171 requirements have been contractually mandated for years. Waiting only increases your risk exposure. At TXAZ Consulting Services, we provide a phased, engineering-led approach: • Conduct comprehensive readiness assessments to identify gaps. • Develop tailored remediation plans that align with your operational realities. • Implement technical controls and continuous monitoring solutions. • Prepare you thoroughly for certification audits with mock assessments and evidence documentation. Our certified cybersecurity experts bring decades of DoD and industry experience to ensure your compliance efforts are defensible and sustainable. Start reducing risk today. Don't wait for shifting timelines—build a compliance roadmap that protects your contracts and your reputation. How far along is your company on its CMMC path? #CMMCCompliance #CybersecurityServices #DoDContractors #CUIProtection #CyberAwareness

4

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments