John "Lt" Sciandra vCISO, CISSP, CMMC Lead CCA/Instructor

Working on a CMMCaudit .org blog about brand new defense contractors that realize they need a #CMMC Level 2 certification to start bidding. And of course, there is no spare money to be found. What are the most efficient options for them? The good news is that these companies don't have much infrastructure. Meaning that they are probably operating from a few personal laptops, with no investment in a larger IT network. They've avoided 'technical debt' - having an existing mission-critical network that never had cybersecurity as a priority (very expensive to upgrade). My initial response is summed up as... - The cost of having a NIST SP 800-171 compliant network can be viewed similarly to renting a facility or buying machinery. Just a capital requirement to win work. I do understand that CMMC certification costs could easily double the first year cost of an defense contractor that offers skilled FTEs or tech work. I'm not trying to minimize how hard this is. But lots of businesses need to get investment before they start; CMMC is just another ?$60-$100k?. It should be a huge market advantage to be certified in 2025. - I can think of a dozen vendors that have built CMMC Level 2 compliant solutions. Reaching out to those companies, rather than trying to reinvent the wheel yourself, will likely cost you 15-50% of what it would cost to in-house your compliance. For example, my (completely unscientific) estimate is that it costs $300k-800k to architect and maintain a functional small business network from scratch (almost entirely labor costs, year 1-2). In comparison: from what I've heard; CMMC-oriented Managed Services Providers will build a functional small network for you for about $70k and maintain it for ~60k a year. I also know of one vendor that offers a CMMC Level 2 virtual enclave for about $3-4k per month. Kieri Solutions - Authorized C3PAO (my company) offers a Reference Architecture (full build instructions, engineering support support, and training/instructions to maintain Level 2 compliance) for a bit less than $15k. Optionally, we can build it for you and do all the compliance actions necessary to be ready for certification. But you need to supply a smart system administrator to be responsible for the network long-term. Not for every company. My ask: If you are a vendor offering CMMC Level 2 compliant networks as a solution, please comment with your brand and give a price-range for a small network (10 users, no special technology) for year 1+2. I will delete replies that do not include a price range! If you aren't a vendor, but have some tips for how to get a certifiable network built for cheap, please also respond! I plan to summarize your offerings and ideas in a post on CMMCAudit .ORG. Here are some people you should follow (that I hope will reply): Andy Sauer Ryan Heidorn Ben Gerenstein, Glenda R. Snodgrass, CCP/CCA Bobby Guerra

105

28 Comments

CMMC - Clean-up in Isle 7, There is a consistent mess in Isle 7. Only if you have had an actual CCA perform a Mock Assessment will an OSC/OSA (Organization Seeking Certification / OSA - Organization Seeking Assessment) know what an assessment requires. (14 policies; 8 plans, 320 Assessment Objectives, 280 Artifacts) You think you are ready for your final Assessment by a C3PAO for CMMC Compliance? You're not! The CMMC Certification Process: 1. You have gone thru your Self-Assessment. (With Expert guidance) 2. Created and entered your score into the SPRS system. 3. You did a "Readiness" Project which kicked out a Gap Analysis and a POA&M. 4. You have a central library (GRC Service? Spreadsheets?) of artifacts as evidence of compliance. All assembled over many months by different contributors. (Guaranteed there is a lack of conformity.) 5. You remediated and documented everything from the POA&M. 6. Your Policies, Procedures and Evidence documents are all ready, and in order? 7. You think you are in a ready state for an Assessor to breeze through all the evidence and certify you. You schedule a C3PAO for your Assessment. 8. The Assessor will review, find issues for remediation ie: gaps. 9. Back to remediation 10. Reschedule the final Assessment 11. Rinse repeat until you are fully compliant. WHAT IF WE COULD SHORTEN THIS PROCESS AND SAVE TIME ($) AND EFFORT? DoD estimates CMMC paperwork burden at 525 hours https://lnkd.in/g48JBDEb Insert step 7.1 - Run a Mock Assessment by a CCA using an AI Based Documentation review Service that produces a POA&M that addresses the integrity of your Artifacts and Evidence in less than a week. Insert step 7.2 Remediate from POA&M items. Insert step 7.3 Re-run the Service for final readiness status. WHY? - To confirm your readiness. - To present a more palatable set of documentation to the C3PAO and accelerate Certification. - To Save countless manhours in the journey to certification. - To help streamline steps 8, 9, 10, and 11 above. NOTE: The Service will generate an immediate ROI. Improve your chances of 1st time certification by working with Gailey Solutions. Get actionable results in days, not weeks. Call Gailey Solutions for CMMC help and guidance. NOTE: We White Label this Service to Partners in the CMMC Community to help you guide your clients thru the Process.

1

This ensures that any Ohio-class sub can destroy up to 192 targets, as each missile can carry up to eight warheads, depending on the yield.

1

https://lnkd.in/ePufpVtQ "The guidelines emphasize a range of steps, including understanding the dependencies of AI vendors that operators might be working with and inventorying AI use cases. They also encourage critical infrastructure owners to create procedures for reporting AI security risks and continually testing AI systems for vulnerabilities." Cybersecurity and Infrastructure Security Agency #AI #ArtificialIntelligence #Cybersecurity

1

Those who are following CMMC have (probably? hopefully?) heard of the DoD Procurement Toolbox and its FAQs regarding cybersecurity. If not, here is a link to the Toolbox: https://lnkd.in/eM9i3pj5 DoD published an update to the FAQs yesterday for the first time in about 4 years. There are some interesting changes, and it is also interesting to see what has not been updated. I am especially intrigued by the United States Department of Defense’s answers to Q15 and Q16. Given all the work with #CMMC and the much anticipated new rules, I would have expected them to update the answers to mention that the assessments are coming. Below is a direct link to the PDF. Thanks to Robert Metzger and Joe Scholefield, CCP for finding and posting this. https://lnkd.in/exEGfxDx

11

The final 32 CFR #CMMC rule defines Not Applicable as such: Sec 170.24 "(3) Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope."* I get the point the authors were attempting to make, but they should have deleted "within the CMMC Assessment Scope." Publicly accessible system components have no business existing within the CMMC Assessment Scope, and as such should be Out Of Scope assets, incapable of P/S/T #CUI. Determining whether there are publicly accessible system components WITHIN the CMMC Assessment Scope is the whole point of 3.13.5 - therefore, as worded, SC.L2-3.13.5 is absolutely APPLICABLE. The focus of 3.13.5 should have been on the existence of connections to or communications through publicly accessible system components. It appears NIST agrees. In #NIST SP 800-171 rev3, 03.13.05 has been withdrawn and incorporated into 03.13.01 Boundary Protection. So, this 32 CFR 170 definition will need to be re-written anyway. DoD lost it's example within. That's ok. They have plenty of time. What do you think? *This is also in the CMMC 2.13 Level 2 Assessment Guide, p. 10

3

Here I take on the question of what DoD contractors should expect will happen to the present and pending #CMMC cybersecurity rules by reason of the Supreme Court's Loper Bright decision and repeal of the "Chevron doctrine." 1.    Loper Bright does not eliminate the significance of agency rationale in a court’s decision should an agency regulation be challenged. What has changed is that federal courts will no longer be required to follow any “permissible” agency interpretation. Now, courts will determine whether a challenged agency rule is within the scope of underlying statutory authority, and whether an agency’s interpretation is the “best” when a court has applied traditional tools for statutory interpretation. 2.    Cybersecurity types know that much explanation accompanied the Dec. 26, 2023, CMMC Proposed Rule. One possible explanation is that rule drafters may have deliberately provided elaborate explanation, to assist a reviewing court conclude that the agency’s regulations reflect “reasoned decision-making” within the statutory boundaries. 3.     The majority in Loper Bright recognizes that courts may seek aid from the interpretations of those responsible for implementing particular statutes. We can expect federal courts to credit well-reasoned actions of statutory implementation and application. The bottom won’t fall out from present and pending rulemaking. Moreover, agency General Counsels known for some years of the erosion of Chevron. Many pending rules likely were prepared with such a contingency in mind. 4.    DoD's cyber regulations are imposed not by operation of an overarching statute but by contract clauses, e.g., DFARS 252.204-7012, which companies accept when taking certain DoD contracts. FAR rulemaking (inclusive of the DFARS) is not governed by the Administrative Procedures Act (APA). Chevron decided that interpretative deference to federal agencies violated Section 706 of the APA. It is not clear (to me) that any DoD contractor may bring an APA challenge to CMMC rules that builds on the Loper Bright repudiation of Chevron. 5.    An objection to the CMMC rules may be subject exclusively to jurisdiction under the Contract Disputes Act or the Tucker Act, as objections to CMMC duties would arise by reason of DoD contract terms. The Court of Federal Claims may have exclusive jurisdiction. In a 2021 decision, a federal district court found: where a plaintiff's claim is "concerned solely with rights created within the contractual relationship and has nothing to do with duties arising independently of the contract[,] the claim is founded upon a contract with the United States and is therefore within the Tucker Act and subject to its restrictions on relief." This is a complex subject. I welcome different views. However, I think there is no significant risk that the Loper Bright decision will put CMMC DFARS rulemaking at risk of successful APA challenge. (Personal opinion.) Brian Levine Chris Hughes

77

26 Comments

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 Comment

Social engineering is a low-complexity TTP used by many, not just Scattered Spider. Permiso has been alerting about Scattered Spider's TTPs because it can be used by other threat actors and victims of Scattered Spider had all the security controls (CSPM, EDR, CASB, CNAPP, SIEM) but still were compromised. All victims missed early response/ containment opportunities at IdP and SaaS layers, could have caught 3 days earlier on average, a significant window given a 3-5 day operational period. By the time an alert fires in your SIEM, if it does, the blast radius is large and damage is done. DM me to discuss common gaps in threat visibility, detection, response, and containment across IdP, IaaS, PaaS, SaaS, and CI-CD that enable social engineering and other cloud TTPs to be successful, and strategies to close these gaps. We know Scattered Spider's cloud attacks, our P0 Labs Team put out a report last year detailing the cloud attacks they responded to.

3

Most U.S. government security clearances do not require a polygraph examination, but there are two notable exceptions: all jobs at U.S. Intelligence Community agencies (of which the FBI is one) and certain compartmented programs at other agencies.

3

It's CMMC o'clock. Do you know where your controls are? If you thought you could keep kicking the old CMMC can down the road for another few months or years before having to really deal with it, think again. The timeline for having the CMMC certification requirements in federal contracts has just been accelerated. (Thank you Jacob Horne for spotting the OIRA announcement!) Do you know if your environment could pass CMMC tomorrow? A month from now? Do you know where the gaps are and how to mitigate them? Remember, those indefinite POAMs that never close are a thing of the past now. As the old camping joke goes, I don't need to outrun the bear, I just need to outrun you. Your competitors have been publicly downplaying their CMMC concerns while quietly working to shore up their controls ahead of the deadline. What have you been doing? The real worry isn't just "getting past" the CMMC certification so you don't lose your contracts or a chance to bid on new business. It's thinking you got past the requirements just to find out later you were wrong. In the realm of federal contracts that's called a "false claim," as in the False Claims Act - a criminal offense. It's not just about getting past CMMC. It's about getting there with integrity and credibility. If you're still relying to manually populated spreadsheets or legacy GRC platforms acting as repositories for manually collected artifacts, that compliance confidence you need becomes rather hard to achieve. True end-to-end compliance automation that drastically reduces your reliance on manual evidence collection and subjective interpretation of control posture is the answer. What's the question? Why haven't you implemented compliance automation in your environment? Why indeed. Learn more at https://lnkd.in/ezSb5rGv #cmmc #compliance #cybersecurity #govcon #security #automation

1

The US Army issued an RFI to offer a cloud-based service that could be used by SMBs. https://lnkd.in/eXB8Gre6 This is very disappointing, and for a lot of reasons. Why? Well, let’s look at what the Army has asked for. In the main “sources sought” document (https://lnkd.in/eJzTYsQ7), the Army says that it wants to offer a cloud-based system for contractors to handle CUI. It then goes on to say that the system needs to meet CMMC Level 2 requirements. There are a few problems with that. First, assuming for the moment that this was considered a “contractor information system”, then under DFARS 252.204-7012, since it is a cloud-based system, it must meet FedRAMP Moderate equivalency requirements, not “just” CMMC Level 2. How can DoD expect contractors to understand what they are supposed to do when DoD itself cannot consistently apply its own regulations? Or is this a case of DoD applying more stringent requirements on the rest of the market than on “its own” service offering? Even if, for the sake of argument, the CMMC-related language was correct (e.g., if DoD is about to adopt the CMMC Information Institute’s recommendation to shift DFARS -7012 to require CMMC compliance rather than FedRAMP), there is still the issue of CMMC Level 3. Requiring only CMMC Level 2 compliance for DoD’s cloud service means they are putting more stringent requirements on the rest of the market than on its own service offering. That is anti-competitive. And then there’s the even bigger issue. Since the cloud service would be operated on behalf of DoD, that would make it a federal information system. As such, it is subject to NIST SP 800-53/FedRAMP requirements, not CMMC. FedRAMP isn’t even discussed in the RFI. Again, how can DoD ask contractors to understand its regulations when they clearly can’t? Like I said…this is very disappointing. For a lot of reasons. I hope the Office of the Under Secretary of Defense for Acquisition & Sustainment and Office of the DoD Chief Information Officer will reach out to the US Army to get this sorted out. If they need help, there are many of us who would be happy to help them get this right. #CMMC #Cyber #FedRAMP #NIST #NIST800171

43

17 Comments

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9

As CruiseCon is not a typical #cybersecurity event, Casey Yarbrough and I recorded the below video to answer the most common questions and just describe the event. The subjects we cover include: * Why I came up with CruiseCon * How are we bringing the type of event that is typically reserved to Fortune 200 CISOs to the rest of the cybersecurity profession * The opportunities to engage and network with people at all levels * A day by day breakdown of the agenda * How to justify the event to management, if necessary * What to expect from the ship and the event As I also mentioned the entire cost to attend CruiseCon (depending upon the cabin chosen) is less than the cost of registration fees for the other major industry events. Please review the video and reach out with any questions.

38

15 Comments

The proposed rule would also require the disclosure of cyber incidents to CISA and physical security concerns to TSA. The Transportation Security Administration is seeking public comment on proposed requirements for surface transportation and pipeline companies to implement cyber risk management programs, the agency said Wednesday. The public comment period ends on Feb. 5, 2025. The proposed rule calls for certain pipeline, passenger and freight rail operators and rail system companies with high-risk profiles to develop comprehensive cyber risk management programs. Pipeline, rail and certain bus transportation or transit systems would be required to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency. The sectors would report any physical security risk concerns to TSA. #criticalinfrastructurecyberrisk #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

1 Comment

What do you do if another Federal agency requires the use of NIST SP 800-171 Revision 3 while DoD remains stuck on Revision 2? This session will be great with NIST SP 800-172 Revision 3 now out as an Initial Public Draft, the use of NIST SP 800-171 Revision 3 is popping up more, especially as other Federal agencies ramp up their CUI programs. With the breadth that NeoSystems LLC brings across the #DIB and other Federal sectors, Stuart Itkin is in birds eye view to explain DoD's approach to the updates on NIST SP 800-171 and what to do just in case you have to meet both. CUI-CON 2025: - WHEN: 27-28 February 2025 - WHERE: Tampa Bay Airport Marriott, Tampa Florida ( https://lnkd.in/eTidFAMm) - REGISTRATION LINK: https://cvent.me/1Azdko - REGISTRATION FEE: $349 until 31 December and $399 thereafter =============================================== Peak InfoSec Homepage: https://peakinfosec.com As the CMMC Churns Episodes: https://lnkd.in/eVGYGs3g Contact Peak InfoSec for Support: https://lnkd.in/e8sM_2Z3 Email: [email protected] =============================================== #cuicon #cmmc #cmmc2 #32cfrpart2002 #32cfrpart170 #infosec #informationsecurity #compliance #cybersecurity #cui #fci #cmmcab #thecyberab #nist800171 #defenseindustry #defensecontractors #defensecontracting #grc #manufacturing #dfars #manufacturingindustry #dib #satellite #satellitecommunications #satellitesystems #managedserviceprovider #msp #managedsecurityservices #mssp #DoD #GovCon #governmentcontracting #SmallBusiness #contracts #contractors 

13

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57