Chad H.

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

In a world where cybercriminals are leveraging AI to breach defenses, it’s time we turn the tables. Let’s empower your cybersecurity with cutting-edge AI solutions. Together, we can outsmart the threats and safeguard your digital realm.

1

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

🔒 Cybersecurity Alert: The Cybersecurity and Infrastructure Security Agency (CISA) recently shared insightful updates on Automated Indicator Sharing and alternative connection methods. Understanding the importance of these protocols is crucial in protecting sensitive data and networks. Stay informed by reading the full article here: [Automated Indicator Sharing: Other Ways to Connect](https://lnkd.in/eMz8m-BW) #Cybersecurity #CISA #DataProtection #InfoSec 🔐🔍 #CISA #IOCs #IndicatorsofCompromise #Cybersecurity

3

A recent report from the Environmental Protection Agency (EPA)’s Office of Inspector General (OIG) has revealed significant cybersecurity vulnerabilities in over 300 U.S. drinking water systems. These weaknesses threaten service disruptions, data breaches, and potential damage to critical infrastructure, affecting the safety and accessibility of water for millions of Americans. #DataBreaches #CyberAttacks #WeProtect cybersecurity.art - Art of Cyber Security https://lnkd.in/gXWedhpV

2

Absolutely spot on! Most #thirdpartyrisk programs fall into the trap of becoming checkbox exercises—collecting data without strategic action. It’s time to flip the script. Instead of simply inventorying risks, let’s reframe third-party risk management as an intelligence-driven collaboration with vendors. Imagine if, instead of static assessments, we built dynamic threat-sharing ecosystems where vendors and organizations could actively counteract emerging risks in real time. This would make TPRM an active shield for #dynamicdefense rather than a dusty file of potential vulnerabilities. Risk management should be actionable, adaptive, and deeply integrated into vendor relationships—otherwise, it’s just another cost center.

5

2 Comments

NCUA examiners have said that the ACET is no longer a requirement. They are now recommending that organizations choose an internal framework to align with such as NIST CSF 2.0, CIS, or other! They have stated the new NCUA ISE statements are for them to use as an examination tool and not for credit unions. I would recommend aligning with both an internal framework and the ISE by taking an evidence-based approach so you are prepped for your exam, and meet their requirements!

7

1 Comment

WOW, compliance geeks gone wild! 😎 What a week of juicy conversations around low-cost/low-quality audit firms, their close association with the most popular GRC automation tools, and the concern around degradation of SOC 2, ISO, etc!   IMO, regardless of added scrutiny and oversight by the AICPA (which is currently in-process for those not aware), as long as there is an open market and published minimum standards then there will always be low-cost/low-quality service providers, and there will always be consumers interested in a low cost service with minimal concern of quality; that is precisely what those consumers value. Walmart, anyone?   Whether firms choose to play in this market of bottom-feeders is up to them, and whether consumers want to engage with these providers is a risk that they choose to take. The market has become exponentially educated over the past couple years, and they will decide. We are already seeing these market forces at work.   I can say with 100% certainty that companies do not select to work with GN because our audits are easy or cheap. In our opinion, the actual SOC/ISO report reflects only 20% of the potential value of an audit relationship. Our clients select our high-touch and quality-driven experience to tap into the 80% of potential value available beyond the audit report. We purposefully elected to play in the premium market early on, and we approach and price our services accordingly.   And I know for certain there are other highly-respected firms and leaders in our industry that place a similar value on upholding the trust and value in audit services.   So, amidst these awesome (controversial) discussions, here’s my expressed appreciation for all the firms providing high-quality services, all the companies choosing to engage with high-quality firms not because it’s the easy thing to do but because it’s the right thing to do, and all the GRC pros who are holding their vendors accountable for high-quality auditing and reporting. What an amazing time for our industry!

85

18 Comments

Read this important advisory from CISA regarding Operational Technology and Industrial Control Systems vulnerabilities. #ICSsecurity #OTsecurity

13

1 Comment

This breach at #GlobeLife serves as a reminder that security isn't a one-time setup — it's a continuous process. Regular audits of access permissions and user identity management are essential. Orgs have to continuously evaluate their security posture to address vulnerabilities before they are exploited.

3

Hmmm how do I leverage the NIST CSF 2.0 www.ncsecourse.com for Compliance and Reporting "How can an organization enhance its cybersecurity governance framework according to the NIST CSF 2.0's Govern function? Include recommendations for establishing roles, responsibilities, policies, and procedures to manage cybersecurity risk effectively." #NISTCSF ICTTF - Cyber Security Community, Academy and Events

2

3 Comments

Looking for a bright side? With more companies embracing better cybersecurity tactics, cyber insurance rates are on the decline. How have you adjusted to the changing cyber landscape?

1

As a 10+ year cybersecurity professional, I've seen SOMETHINGS!! Business owners ignoring red flags, delaying critical measures, and expecting top-tier protection on a "just fix it" budget. Those days? They’re long gone!! At OQPS we're no longer chasing after businesses to convince them to prioritize their cyber security. If you don’t see the value in protecting your operations before disaster strikes, we’re not the team for you. Here’s the reality: 🛡️ Cybersecurity isn’t a reactive service; it’s a proactive investment. 💰 Top-tier protection requires commitment, not a shoestring budget. 🚨 “Just fix it” doesn’t work when your data, reputation, and future are on the line. If you’re ready to take your security seriously, we’re here to help. But if you’re waiting for a drastic incident to wake you up, we’ll still be here, but it’ll COST you ALOT more. The choice is yours: ➡️ Proactive protection that safeguards your business OR ➡️ Playing catch-up after the damage is done We’re working with clients who value their security, their customers, and their future. If that’s you, let’s talk [email protected] If not, best of luck.

7

1 Comment

320 is an important number. Why? Say your team spends just 5 minutes and 20 seconds every day going through the Level 2 CMMC Assessment Guide. You will read the whole thing 3 times in 3 months. I’ve written about this before: https://lnkd.in/dhyffJcX. And while you’re reading, take a couple of days and apply your knowledge to a tabletop exercise. Go through every single artifact or piece of evidence. Review how your team will answer questions assessors may have. That way, everybody on the team is ready. Remember, as assessors, we are looking for real muscle memory. It’s not enough to check the box or have a policy sitting in a filing cabinet somewhere. You need to demonstrate that you have been fulfilling all 320 CMMC requirements, as an integrated part of your operations. As always, we here at MNS Group are happy to answer any questions. So get reading! #DoD #CMMC #contractors #cybersecurity #assessment

50

**Critical Security Alert** Security Leaders - please check for and remove domains connected to #polyfill if it exists on any of your organizations websites. Please see write up in link for our initial analysis on the script and potential scope of exposure. #javascript #CVE #breach #CISO #Webappsec

16

2 Comments

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9