Gib Sorebo

The National Institute of Standards and Technology (NIST) recently released its first major update of the popular and well-respected Cybersecurity Framework (CSF). NIST CSF 2.0 broadens its reach, sharpens its focus on #governance and #supplychain risks, and introduces new tools to empower your #cybersecurity strategy. Stay ahead of threats with #TeamCAI here: https://lnkd.in/edtHeTF7 [VD: Video with text and B-roll footage scroll through-out, highlighting the updates surrounding The National Institute of Standards and Technology's update of their Cybersecurity Framework. The video highlights the main points such as the new focus areas, new tools and guidelines, implementation examples, and then ends with a call-to-action to read the full article on CAI's website.]

2

The National Institute of Standards and Technology (NIST) recently released its first major update of the popular and well-respected Cybersecurity Framework (CSF). NIST CSF 2.0 broadens its reach, sharpens its focus on #governance and #supplychain risks, and introduces new tools to empower your #cybersecurity strategy. Stay ahead of threats with #TeamCAI here: https://lnkd.in/gEsUzmkj [VD: Video with text and B-roll footage scroll through-out, highlighting the updates surrounding The National Institute of Standards and Technology's update of their Cybersecurity Framework. The video highlights the main points such as the new focus areas, new tools and guidelines, implementation examples, and then ends with a call-to-action to read the full article on CAI's website.]

10

The National Institute of Standards and Technology (NIST) recently released its first major update of the popular and well-respected Cybersecurity Framework (CSF). NIST CSF 2.0 broadens its reach, sharpens its focus on #governance and #supplychain risks, and introduces new tools to empower your #cybersecurity strategy. Stay ahead of threats with #TeamCAI here: https://lnkd.in/eHnXPQSn [VD: Video with text and B-roll footage scroll through-out, highlighting the updates surrounding The National Institute of Standards and Technology's update of their Cybersecurity Framework. The video highlights the main points such as the new focus areas, new tools and guidelines, implementation examples, and then ends with a call-to-action to read the full article on CAI's website.]

5

The National Institute of Standards and Technology (NIST) recently released its first major update of the popular and well-respected Cybersecurity Framework (CSF). NIST CSF 2.0 broadens its reach, sharpens its focus on #governance and #supplychain risks, and introduces new tools to empower your #cybersecurity strategy. Stay ahead of threats with #TeamCAI here: https://lnkd.in/debweb5v [VD: Video with text and B-roll footage scroll through-out, highlighting the updates surrounding The National Institute of Standards and Technology's update of their Cybersecurity Framework. The video highlights the main points such as the new focus areas, new tools and guidelines, implementation examples, and then ends with a call-to-action to read the full article on CAI's website.]

1

A new GAO report identifies significant concerns with the implementation of SBA’s unified certification platform. GAO writes: “GAO's analyses of SBA's efforts show that leading practices for risk management, cybersecurity, and schedule and cost estimation have not been fully implemented. Accordingly, SBA faces an increased risk of additional delays as it completes remaining work and may face challenges with addressing system issues that arise.” #SBA #govcon #governmentcontracting #federalcontracting

30

1 Comment

The Department of Justice's Civil Cyber-Fraud Initiative underscores the critical importance of robust cybersecurity measures for government contractors and grant recipients. This initiative leverages the False Claims Act to hold entities accountable for failing to meet required cybersecurity standards, emphasizing that non-compliance can lead to significant legal and financial repercussions. At Triton Technologies, we understand the complexities of federal cybersecurity requirements and are dedicated to helping businesses navigate these challenges. Our expertise ensures that your organization not only meets but exceeds compliance standards, safeguarding your operations and reputation. Don't leave your compliance to chance. Reach out to us today to fortify your cybersecurity posture and stay ahead of regulatory demands. Learn more: https://tcc.onl/2Dr89v

1

1 Comment

Many of my clients ask about Federal Guidance and Governance for Critical Infrastructure. This paper by Danielle J. captures the issue in very pragmatic fashion. It answers the "Why" standards cant be as firm as others like PCI, HIPPA, and CIP. My Fav quote: "This reactionary impulse makes prioritization difficult across sectors, entities, and their critical functions". We focus our whole team on 'Prioritization' and guiding practical ways to reduce risk. Regarding the Titanic metaphor, there was room on the door. https://lnkd.in/g8vCdyqH

19

2 Comments

Comments filed by The Coalition for Government Procurement, on DoD's Proposed 48 C.F.R CMMC "Contract" Rule, are the subject of an Inside Cybersecurity article published on Nov. 1, 2024, and authored by Sara Friedman. As explained in the article (available below, no paywall): "The Coalition says the proposed rule is 'unclear' on how the 'correct' CMMC maturity level is to be determined. 'This leaves DIB partners in the dark on decisions that could affect greatly the time available, or even the feasibility, of meeting CMMC security requirements,' the filing says." The filing says, 'DoD also should consider changing the rule to enable COs to make inquiries of contractors, and have consultations, before the CO sets the CMMC level. Because a CO may set a CMMC level that does not reflect the actual possession or use of information by a supplier, or the level or risk involved, it is advisable for the CO to be authorized to conduct fact-finding as needed before the CMMC level is set.'" “'We therefore would recommend that DoD clearly outline and publish the methodology for determining CMMC levels, making further changes as outlined above. Consultation with potentially affected suppliers could improve the outcome,' the Coalition says. The Coalition comments also addressed the important subject of waiver authority for CMMC implementation. Further from the article: "The filing says, 'The Coalition recognizes that full articulation of waiver authority, process, and guidelines could require a separate rulemaking beyond the pending 32 CFR and 48 CFR rules. The Coalition strongly urges that DoD’s CMMC leadership to include near-term waiver provisions and start on rulemaking for broader purposes. In the prospective waiver rules, we urge DoD to incorporate risk assessment and outcome comparison into the waiver decisions.'" I contributed to the drafting of the Coalition comments. https://lnkd.in/gFYaBtsH

29

3 Comments

The National Institute of Standards and Technology (NIST) recently released its first major update of the popular and well-respected Cybersecurity Framework (CSF). NIST CSF 2.0 broadens its reach, sharpens its focus on #governance and #supplychain risks, and introduces new tools to empower your #cybersecurity strategy. Stay ahead of threats with #TeamCAI here: https://lnkd.in/e2cxVcNT [VD: Video with text and B-roll footage scroll through-out, highlighting the updates surrounding The National Institute of Standards and Technology's update of their Cybersecurity Framework. The video highlights the main points such as the new focus areas, new tools and guidelines, implementation examples, and then ends with a call-to-action to read the full article on CAI's website.]

13

What makes a mature third-party risk program? Does SBOM fit into it? How involved should legal/procurement be in that? What are we monitoring? I have opinions, but they're always evolving. I'm personally interested in learning the nuances of how organizations, big and small, do it, what's working and what isn't, how things differ across sectors, etc. I'm biased, but I believe BSIMM did that for software security. I think a similar sort of maturity assessment for TPRM/SCRM programs delivers similar insights, especially when delivered at scale. So what do you think? #cybersecurity #ciso #tprm #scrm #sbom

17

2 Comments

Today, I attended a CISA Sector Risk Management Agency (SRMA) meeting to discuss next steps to implement NSM-22 and the ONCD implementation plan. Here are my takeaways ( I work with two SRMA's): - The US Government is working aggressively to address cyber and physical risk - NSM-22 Goals are driving goals and objectives; a major deliverable is due in Aug.2024 - The immediate focus is on Risk Identification, followed closely by Risk Mitigation - Cybersecurity harmonization will be a key driver across all 16 critical infrastructure sectors - Software, supply chain risk is a top concern - Physical and cyber risks are in scope, both man made and natural, including human error - Expect to see FAR changes in part 40 - cybersecurity that align with NSM-22 - All critical infrastructure sector SRMA's are aiming in the same direction, some are moving faster than others. Buckle up if you work with critical infrastructure.

6

[GovWhitePapers] Putting Teeth into AI Risk Management: Lessons from Cybersecurity Procurement Rules and Practices Similar to cybersecurity, procurement rules will be used to enforce AI development best practices for federal suppliers. This report offers recommendations for implementing AI risk management procurement rules. Publisher: Center for Security and Emerging Technology https://ow.ly/t5wB50S11j9 #GovCon #SmallBusiness #Accounting #GovernmentContracting #GovernmentContractor #FederalContracting #FederalGovernment #AI #GenAI

2

For years, security experts have warned of the risks of government overreliance on a single technology vendor. Today, we’re sharing three recommendations for how governments can address the vulnerabilities outlined by the U.S. #CSRB #3 is my personal favorite #cybersecurity

2

#Cybersecurity is a top 5 enterprise-wide risk, and is a key priority for industry executives, Board members and regulators. My colleagues, Brian Levine and Megan Turner, are taking part in the The Institute of Internal Auditors Inc. 2024 Cybersecurity Virtual Conference on Oct. 30 where they'll discuss the risks and implications associated with cybersecurity. Register here:

27

1 Comment