Sean Paul

On October 15, 2024, DOD published the final CMMC 2.0 Program rule. DOD’s final rule outlines the mechanisms that DOD will use to prescribe cybersecurity standards for safeguarding FCI or CUI, and to confirm that covered defense contractors and subcontractors have implemented the security requirements before award of covered contracts and maintain those safeguards during contract performance. The final rule details the tiered model of cybersecurity requirements DOD will use based on the type of information stored on a contractor’s information system and the requirements for certifications and assessments based on the contract’s assigned CMMC level. https://lnkd.in/eGQYiR-2 #CMMC #GovCon #Cybersecurity

2

Defense Acquisition University (DAU) has two upcoming webinars you’ll want to add to your calendars. The first will be a primer on Supply Chain Risk Management (SCRM) happening on Dec. 12, and the second will cover basic cyber hygiene on Dec. 16. To register for the Dec. 12 SCRM webinar, visit https://buff.ly/41q3Clr For the Dec. 16 cyber hygiene webinar, visit https://buff.ly/4ifeJnf #CyberSecurity #SupplyChainRiskManagement #GovernmentContractor #GovernmentContracting #NAPEX #APEXAccelerators

18

🔐 Effective Strategies for CUI Lifecycle Management 🔐 Managing Controlled Unclassified Information (CUI) is essential for data security and compliance. Here’s our step-by-step guide: 📋 Establish Clear Policies and Procedures     - Define CUI within your organization.    - Create policies for handling, marking, storing, and transmitting CUI.    - Train employees on these policies regularly. 🔒 Implement Robust Access Controls     - Assign access based on job roles.    - Follow the least privilege principle.    - Conduct regular audits. 🛡️ Use Encryption and Secure Communications     - Encrypt CUI at rest and in transit.    - Use secure channels like VPNs and encrypted email.    - Keep tools updated. 🕵 Monitor and Audit CUI Handling ️️    - Implement logging and monitoring systems.    - Perform regular audits.    - Maintain an incident response plan. 🔐 Implement Strong Data Loss Prevention (DLP) Measures     - Deploy DLP solutions.    - Enforce policies with DLP tools.    - Continuously monitor data loss incidents. 🔄 Regularly Review and Update CUI Practices     - Review and update policies regularly.    - Stay informed about new technologies.    - Establish a feedback loop with employees. By following these strategies, organizations can effectively manage the lifecycle of Controlled Unclassified Information (CUI), ensuring its protection and compliance with relevant regulations. InterSec, is committed to helping organizations protect their sensitive information.  📧 For any assistance with CUI lifecycle management or other cybersecurity services, contact us today [email protected] to learn how we can support your efforts. 👇Click the link to check our CUI Guide for DoD Contractors.👇 #CUI #DataSecurity #Compliance #CyberSecurity #Dod #InterSec #InterSecInc #department_of_defence #cui_guide #data_protection  

1

Bad news for the many DoD defence industry commercial contractors requiring FedRAMP to support their CMMC 2.0 program. Luckily for you, Zafepass Prevent & Protect can fix this. Reach out to Zafehouze - making IT, OT and IoT 'Zafe' and lets have a chat about, probably the only platform providing ‘controlled protected digital environments’ - see Zafepass as a security dome - a shield you wrap around you environment. Nothing else needed. You can’t steal what is not there and as you own the ‘neighborhood’ you control your environment - as well as CUI data. More [email protected]

7

1 Comment

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

8

🚨 Important Update for Defense Contractors and anyone related to the DIB: The DFARS 7021 clause, covering the Cybersecurity Maturity Model Certification (CMMC) requirements, has just cleared a significant hurdle. The Office of Information and Regulatory Affairs (OIRA) has completed its review, and the rule is now on its way to the Federal Register for publication. Once published, there will be a 60-day public comment period before the rule can be finalized and put into effect. Keep an eye out for the Federal Register publication—it's coming soon! We can expect 7021 to show up in contracts late Q2 next year. #Cybersecurity #CMMC #DFARS #DefenseIndustry #Compliance 

8

🚨Attention DoD contractors 🚨 CMMC assessments have started. ⬇️ On 16 December, certified third-party assessment organizations (C3PAOs) officially began assessing DoD contractors for CMMC. If you handle CUI, you need to: 1️⃣ Prove CUI security no matter if you have 20 or 20,000 employees. 2️⃣ Prioritize CUI compliance before other CMMC Level 2 requirements. 3️⃣ Balance CUI security with productivity. For more information, check out our latest blog: https://lnkd.in/e5WCrz8m

10

🚨 Attention DoD Contractors 🚨 The Cybersecurity Maturity Model Certification (CMMC) Final Rule is here! Set to take effect on December 16, 2024, this rule is designed to secure our national defense supply chain. Are you ready? #CMMC #Cybersecurity #DoDCompliance

1

🛡️ 𝗔𝘁𝘁𝗲𝗻𝘁𝗶𝗼𝗻 𝗗𝗲𝗳𝗲𝗻𝘀𝗲 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝗼𝗿𝘀, 𝗖𝗜𝗦𝗢𝘀, 𝗮𝗻𝗱 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗢𝗳𝗳𝗶𝗰𝗲𝗿𝘀! 🛡️ Are you prepared to meet the DoD's 72-hour cyber incident reporting requirement? Our latest video unpacks critical DFARS compliance information: ✅ The legal mandate under DFARS 252.204-7012 ✅ Why cyber incident reporting goes beyond NIST SP 800-171 ✅ The crucial role of the medium assurance certificate In the high-stakes world of defense contracting, ignorance isn't just costly - it's non-compliant. Watch now and ensure your organization is ready to respond within the critical 72-hour window! ⏰💼🔒 #DFARSCompliance #CyberIncidentReporting #DefenseContracting #NationalSecurity

🚨 DFARS 252.204-7021 (the CMMC clause) is currently at the Office of Management and Budget (OMB) 🚨 The abstract states, "DoD is amending an interim rule to implement the CMMC framework 2.0 in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides the Department with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain." Once approved, the rule will be sent to the Federal Register for publication 👀 You can see the rule here: https://lnkd.in/eyP5dqre Shoutout to Eric Crusius for breaking this news! #cmmc #dod #cybersecurity

34

The standards defense contractors must adhere to maintain cyber compliance and protect Controlled Unclassified Information (CUI) are a living thing, constantly changing to suit the changing needs of the defense industry and the shifting cyber landscape. Yesterday, the National Institute of Standards and Technology (NIST) published two revised standards for protecting CUI in nonfederal systems and organizations and assessing security requirements for CUI: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations: https://bit.ly/3yisbEm Assessing Security Requirements for Controlled Unclassified Information: https://bit.ly/4bGfwJw These updated standards are likely to affect how organizations across the defense industry supply chain, including contractors, maintain cyber compliance and remain competitive in the industry. Reach out to your cyber compliance specialists to make sure you're prepared to adjust your CUI handling processes and procedures. https://bit.ly/3ixz6lf #cmmccompliance #secureinfrastructure #cybersecurity #cmmc #NIST800171 #CyberAB #caskgov

6

CMMC asset categories are not mutually exclusive. 🔹CUI Assets may provide security capabilities (through native hardening), making them a Security Protection Asset (SPA). 🔹Some SPAs might need to process CUI to do their jobs (SSL proxies, SASE, DLP, etc.). 🔹Other SPAs 𝘤𝘰𝘶𝘭𝘥 handle CUI, making them a CRMA. If you want to reduce the 800-171 burden for security tools, make it so they 𝙘𝙖𝙣𝙣𝙤𝙩 store, process, or transmit CUI. File encryption, ZTNA tunnels, and router-on-a-stick deployments can eliminate CUI access by security tools, reducing scope, cost, and complexity.

148

30 Comments

Navigating the Final CMMC Rule: Simplifying Compliance for Federal Contractors: The Pentagon has recently fine-tuned the final Cybersecurity Maturity Model Certification (CMMC) program rule, and while no groundbreaking changes were introduced, these adjustments aim to streamline compliance for federal contractors. Key highlights from the final rule include: - Clarity for Cloud Service Providers: The updated definitions clarify that cloud service providers handling Controlled Unclassified Information (CUI) must achieve FedRAMP Moderate authorization, while those not dealing with CUI can be assessed as part of the contractor’s overall evaluation. - Enduring Exceptions and Temporary Deficiencies: The rule introduces concepts like “enduring exceptions” for situations where full compliance isn’t feasible and “temporary deficiencies” for issues in the remediation process. These concessions recognize the challenges contractors face in maintaining cybersecurity standards. - Phased Implementation: The DoD is finalizing a proposed acquisition rule that will incorporate CMMC requirements into defense contracting processes, with a three-year phased rollout plan. Industry groups have raised concerns about the potential challenges in execution, underscoring the importance of clarity and support from the DoD. As organizations navigate these evolving compliance requirements, it’s crucial to develop tailored strategies that meet the new CMMC standards while enhancing overall security posture. For more details, read the full article here: https://lnkd.in/eprqyaEq #CMMC #Cybersecurity #FederalContracting #DoD #Compliance #FederalAgencies #Innovation

6

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4