Peter Phillips

Towards a “whole of government approach to cyber security” based on security by design principles in systems and services.

6

🚨 CMMC Update: Congressional Challenge Ahead! Congressman Gary Palmer has introduced a joint resolution (H.J.Res.221) aiming to nullify the DoD's Cybersecurity Maturity Model Certification (CMMC) Program under the Congressional Review Act. This move could impact the CMMC final rule set to take effect on December 16, 2024. What This Means: • 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗨𝗻𝗰𝗲𝗿𝘁𝗮𝗶𝗻𝘁𝘆: The resolution could halt or delay CMMC implementation. • 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗺𝗽𝗮𝗰𝘁: Ongoing debates about securing the defense industrial base. • 𝗦𝘁𝗮𝘆 𝗣𝗿𝗼𝗮𝗰𝘁𝗶𝘃𝗲: Flexibility and vigilance are crucial during this time. Next Steps: • 𝗦𝘁𝗮𝘆 𝗜𝗻𝗳𝗼𝗿𝗺𝗲𝗱: Monitor developments in Congress. • 𝗥𝗲𝘃𝗶𝗲𝘄 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗣𝗹𝗮𝗻𝘀: Be prepared for potential changes. Let's keep our community informed. Feel free to share this post and comment with your thoughts on how you see this potentially impacting our industry. #CMMC #Cybersecurity #GovCon #DoD #Compliance #NIST800171 #Congress #RegulatoryUpdates

9

1 Comment

The DoD’s Cybersecurity Maturity Model Certification (CMMC) final rule is a game-changer for the defense industrial base. Aerospace and defense attorney Shawn Cheadle shares his insights on the rule’s key elements, evolution, and phased implementation here: https://ow.ly/huaX50TQXpT #ALawFirmShapingTheFuture #ShermanHowardInsight #CybersecurityStandards #DoD #ComplianceJourney

2

Next week Xage Government returns to Charleston for #CDCAEasternDefenseSummit 2024 - you can find us in booth #722 sharing all things Zero Trust for mission critical operations. Swing by to meet with the team and learn more about how we secure tactical, operational, and strategic critical assets from the edge to the core to assure mission success. Learn more about the conference here: bit.ly/4g0ckLw

11

Hey, small business defense contractors: Have you read the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements Proposed Rule yet? Let me oversimplify for you: Cybersecurity and Infrastructure Security Agency is adding their name to the list of agencies that businesses across multiple sectors must report cyber incidents to - even if your business is small, and even if the business already has mandatory reporting requirements to their sector agency. Rather than remove barriers, streamline, and "harmonize," government policy continues to get more and more complicated for small business owners. The world wonders why small businesses are resource-strapped and confused about government requirements, but with each layer of new policy, it's really no wonder. ----- Comment period ends June 3, 2024: https://lnkd.in/eRgSn3fk Win-Tech submitted comments to the Federal Register, comments shared below. Check out posts by Jacob Horne, Glenda R. Snodgrass, CCP/CCA, and B. Stephanie Siegmann for analysis on the rule and what it may mean looking forward. #DIB #cybersecurity #smallbusiness

31

11 Comments

Dive into the Future of Intelligence! In an exclusive WashingtonExec feature, Acuity’s Intelligence Community (IC) Vice President KC Wilberg shares his thoughts on how the 2024-2026 IC Open Source Intelligence Strategy will influence how the IC accesses and uses data. If successfully implemented, the strategy will modernize and optimize open-source intelligence practices, likely scaling technology adoption and leading to better and quicker outcomes. https://lnkd.in/eGvNaMca #OpenSourceIntelligence #IntelligenceCommunity #FutureOfIntelligence #GameChangingInsights #DataAccessibility #CentralizedData #Innovation

33

A recent report from the DoD Inspector General has revealed that the US Navy’s E-2D Advanced Hawkeye aircraft is plagued by numerous operational deficiencies, with a total of 141 issues currently unaddressed. These deficiencies include critical problems with the aircraft's radar—a vital system for detecting and tracking both land and sea contacts—as well as maintenance issues that impact overall performance. The report indicates that approximately 45% of these deficiencies are considered critical or serious, threatening the aircraft's ability to successfully execute its missions and potentially compromising military readiness and national security. For instance, some of the identified issues involve the locking mechanism of crew seats during carrier landings and visibility obstacles on tracking displays that hinder the crew's situational awareness. The report emphasizes that these operational shortcomings have persisted despite the Navy's significant investment of $22 billion to acquire a total of 80 E-2D aircraft, of which 62 have already been fielded. In response to the IG's findings, the Navy has acknowledged the need for improvement and agreed to implement the recommendations to establish a centralized system for tracking deficiencies and develop a comprehensive corrective action plan. This proactive approach is crucial—not only to enhance the capabilities of the E-2D Advanced Hawkeye but also to ensure that military operations remain effective and that service members can perform their duties safely and efficiently. By addressing these deficiencies, the Navy aims to uphold its commitment to operational excellence and maintain the effectiveness of its airborne command and control systems, which are critical for modern military engagements. #Navy #MilitaryReadiness #E2DAdvancedHawkeye #AviationSafety #OperationalExcellence #Defense #InspectorGeneral #AviationDeficiencies #MissionSuccess #MilitaryInnovation #NationalSecurity #Aerospace #DefenseIndustry #ServiceMembers #MilitaryOperations

2

Addressing the Navy's Civilian Mariner Shortage The US Navy is grappling with a severe shortage of civilian mariners, which threatens the operational readiness of its logistics fleet. Currently, there are only 5,500 mariners employed, far below the required 10,000, putting the Navy’s global military support at significant risk. To tackle this pressing issue, the Navy is exploring several strategies: - Enhanced Compensation: Offering better pay and benefits to attract and retain skilled mariners. - Strategic Recruitment: Partnering with maritime academies to develop the next generation of maritime professionals. - Improved Working Conditions: Emphasizing work-life balance to prevent burnout among civilian mariners. The Military Sealift Command may have to sideline 17 ships to reallocate personnel and maintain operational readiness. This step is crucial to ensure that naval forces remain prepared to respond when needed. Potential Consequences - National Security Risks: Decreased logistics capabilities could undermine national defense. - Increased Burden on Current Mariners: Existing personnel may face higher pressure, leading to burnout and attrition. - Reduced Global Reach: A drop in maritime logistics could hamper the ability to engage in international trade. How can we tackle this critical shortage? Share your ideas to support our naval forces and strengthen national security! #Navy #CivilianMariners #Logistics #MilitarySealift #NationalSecurity #Maritime #Recruitment #OperationalReadiness #MilitarySupport #WorkforceDevelopment

1

An interesting summary from Holland and Knight on the new #CMMC rule 32CFR170 which went final last Friday. I found their final paragraph particularly interesting... "The above is just the tip of the iceberg when thinking about the intricacies of the CMMC program and the implications for the DIB (including contractors far down the supply chain). Companies in the DOD supply chain would be wise to not delay further and ensure they are properly certified." At 470 pages the assessment community (C3PAO's and CCA's) are still getting their minds wrapped around the many aspects including significant changes that will impact how we assess Organizations Seeking Assessment (OSAs). The fundamental point though that DIB companies "would be wise to not delay further" is of course spot on. As Jacob Horne, Robert Metzger and others have been saying for a while, the time is past to get moving on having a cybersecurity program that supports CMMC compliance. There is a LOT of detail and nuance in a document with a word count 80% the New Testament. That said the fundamentals remain. First have a Program. This is not going to be something solved by either writing policies in a long weekend nor by buying a single tool. The #1 aspect of this or any program are the people executing it. These are activities that will need to be done now and into the future as long as an organization has a DoD contract or subcontract. The first thing to do for any program is pick the leader. Who will do this? Who will direct the work and make sure it stays on track? Do it in house, hire contractors, buy tools, whatever needs to be done... Who is the leader of your CMMC Program?

64

15 Comments

Old datasets can sometimes throw a curve ball at you ⚾! ⚾I usually receive datasets that are CSV (meaning they have comma separated values). But I have received very old datasets that use other delimiters – such as pipes, dashes – and even spaces! I do not recommend 😦! ⚾Most datasets I receive have “headers”, meaning the first row of the dataset has the column names in it. But some do not – and then you have to figure this out when you are importing the data into your program! Better go get your offline documentation 😬! ⚾Believe it or not, I have seen old datasets with columns that are little 255 characters long! They often contain full sentences. These sentences unfortunately tend to include special characters that like to give import engines indigestion 🤢! Are you suffering through trying analyze old datasets – or new datasets in old formats? Register for our upcoming workshop, “Application Basics: Dealing with Legacy Systems”, get the necessary background on legacy applications, and be regarded as an expert who can analyze both old and new data formats! #R4sasUsers #DethwenchLive #healthcare #dataanalytics #rstats Wendel Cabillo Vincent Batza Amarjit Gunjal Filippos Admasu Sravan Kumar Dandu David Townes Nirali Vadodaria

3

2 Comments

This week in Defense Tech: 1️⃣ Pentagon announces new reciprocity guidance to streamline software adaptation. “We’ve heard you loud and clear on this within the DoD. I’m not going to say this is going to solve every bit of it, but it’s going to help us a bit,” Office of the DoD Chief Information Officer John Sherman said. 2️⃣ United States Department of Defense surpasses $600M in JWCC task order awards. Google, Oracle, Amazon Web Services (AWS) and Microsoft compete for task orders under the Joint Warfighting Cloud Capability enterprise cloud program. 3️⃣ The Defense Information Systems Agency has launched a new cloud service management platform called Olympus to help defense agencies develop and mature their cloud environments. 4️⃣ Switchblade 600 drones in the running for Replicator mass production. With a 24-mile range, 40 minutes of loitering endurance and the ability to fly at speeds of up to 115 miles per hour, Switchblade 600s are built to destroy armored vehicles and other targets in multi-domain military operations. 5️⃣ Embracing and incentivizing digital methods in design and manufacturing can help the U.S. match or outpace its adversaries, a new report from the Mitchell Institute for Aerospace Studies argues—and top Pentagon and industry officials say they are working to do just that. 6️⃣ The Wall Street Journal covers how America is getting ready for space warfare. Pentagon officials open up about potential threats as China’s presence in orbit grows and Russia shows interest in gear that can destroy satellites. 7️⃣ United States Space Force is getting a cloud-based, classified environment for industry collaborations. The Space Force recently extended General Dynamics Information Technology's contract to expand Project Enigma, adding more stakeholders and cloud service providers to the digital environment. 8️⃣ US Army lays out strategy for new $1B contract vehicle for modern software development. The service is seeking feedback from industry. 9️⃣ Losing hearts and minds: The desperate state of US influence operations. The United States is surrendering ground to Russia and China’s propaganda machines. That has key officials increasingly worried. 🔟 Anduril Industries is building out the Pentagon’s dream of deadly drone swarms. The US military aims to maintain its dominance by building autonomous attack drones that collaborate with humans and overwhelm defenses in swarms. 🔗 Links in comments below 👇 #DoD #DHS #defenseinnovation #defense #defensetechnology #technology #tech #nationalsecurity #jadc2 #army #navy #airforce

13

12 Comments

This isn’t the first time I’ve posted about the need to send clear demand signals to industry through on-time, predictable, and sufficient government funding, and it won’t be the last. This year, we saw some encouraging momentum in Congress – the Senate plussed up both defense and non-defense toplines, and the House made real progress toward completing all 12 appropriations bills. But once again, with just seven days left until the end of the fiscal year, we’re facing down the all-but-guaranteed likelihood of a continuing resolution (though hopefully not a government shutdown). So as Congress tries to figure out a path forward, let’s recap why a long-term continuing resolution would be bad for the aerospace and defense industry, the country, and in particular national security: ➡️ Slowing much-needed efforts to expand production capacity and modernize our nuclear arsenal ➡️ Stalling new programs that will keep our military on the cutting edge ➡️ Limiting procurement and sustainment ➡️ Hurting troop pay ➡️ Delaying key national security space launches ➡️ Jeopardizing innovative new space exploration programs like Artemis ➡️ Slowing down FAA modernization efforts enabled by the latest FAA reauthorization bill ➡️ Driving up costs across the board and wasting money on outdated programs As Chairman of the Joint Chiefs General CQ Brown Jr. wrote to Congress last week, we’re already operating from behind. We’ve lost five years of progress to continuing resolutions. And it’s even worse now, because, as General Brown wrote, we’re in the “most dynamic and challenging global security environment” he’s seen in his 40-year career. I know Congress knows this just as well as I do, but it bears repeating. So I’m hoping that Congress will see the harm of long-term and repeated continuing resolutions and get their fiscal house in order by passing full-year appropriations bills as soon as possible. A short-term CR may be necessary for now, but it shouldn’t be our default strategy. https://lnkd.in/eDxdWYRD

69

3 Comments

There is no doubt that promoting IT modernization, comprehensive and continuous process improvement, and competition for products and services across the entire life cycle inc government purpose data rights would yield enormous savings. New business models like “Government as the Lead Systems Integrator,” and engagement in military and commercial specs and STDs can promote and accelerate innovation and help ensure quality improvement for contracted services. Building leadership skills and capabilities at all levels to accelerate learning, change and transformation can embed new cultural norms which would help institutionalize these new paradigms. Lastly, given exponentially accelerating technologies and the need to sense, be agile and adaptive as well as anticipatory we can create a culture of learning (vs just doing).. "Defense contractors routinely overcharge the Pentagon by 40%—and sometimes more than 4,000%," Sanders continued. "In October, RTX (formerly Raytheon) was fined $950 million for inflating bills to the DoD, lying about labor and material costs, and paying bribes to secure foreign business. In June, Lockheed Martin was fined $70 million for overcharging the navy for aircraft parts, the latest in a long line of similar abuses.."

16/08/24 LATEST UPDATE ON CMMC To all #DefenceIndustry looking to export to the US DoD, last night’s CMMC update gives some good insights into what’s coming. Here are some highlights: 📑 A CMMC self-assessment or valid CMMC certificate (at the appropriate level) will be required at the time of contract award. With evidence of the IT environment to be provided prior to contact award. 🔒 CMMC requirements must be maintained for the life of the contract. 🇦🇺 Foreign suppliers (aussies) are not exempt from the CMMC requirements (except for below). ❌ Any contract at or below the micro-purchase threshold ($10k USD) or for “exclusively COTS items” will be exempt from CMMC. 💰 A three-year phased rollout period of CMMC to help reduce the financial impact to industry. However, CMMC requirements can be enforced at any time during the phase-in period. For more information reach out to Ben Hodge or [email protected] #AustralianDefence #CMMC #cybersecurity #supplychain Alliance South Australia Defence SA

22

To attain these ambitious goals, DISA must implement a multifaceted approach that encompasses technological innovation, strategic partnerships, and robust risk management frameworks. This includes the development of advanced software-defined networking solutions, implementation of stringent zero-trust security architectures, and integration of emerging technologies such as AI and ML for predictive threat detection and response. Additionally, DISA must prioritize interoperability and data standardization initiatives to facilitate seamless information exchange across diverse systems and platforms. Industry partners looking to support DISA in these endeavors should focus on offering cutting-edge solutions in cloud services, cybersecurity, and network resilience, leveraging CRG's extensive experience and expertise to help design solutions & deliver impactful outcomes in line with DISA's mission objectives. Harness CRG's capabilities to drive innovation, deliver mission-critical solutions, and safeguard national interests. Visit https://crgroupinc.com/ or reach out to us at [email protected] to explore how CRG can empower your organization to thrive in the dynamic landscape of defense technology. #DISA #DoD #DefenseInformationSystemsAgency #cybersecurity #cloudcomputing #ITmodernization #informationtechnology #networking #softwaredefinednetworking #zerotrust #AI #machinelearning #datastandardization #missioncritical #warfighter #nationaldefense #militarytechnology #cyberdefense #cybersecuritysolutions #cloudservices #federalgovernment #governmentcontracting #USMilitary #defensecontractors #federalcontracts #technologyinnovation #networksecurity #securecommunications #interoperability #strategicpartnerships #techindustry #digitaltransformation

3

Great news and summary here from NCEO on the final rule for allowing some ability for ESOPs to garner priority with DOD contracts. Wondering if anyone out there in this space knows or can speculate on whether this would allow companies who acquired a contract (say 8(a) or minority/women/veteran owned) to then maintain ability to win the follow-on contract if they transition to an ESOP during that different status stage? #ESOP

21