Matthieu Garin’s Post

What is Security Protection Data in the realm of CMMC/NIST 800-171? Today, we don't have a real answer. We have a couple notional examples from the proposed 32 CFR rule (configuration data, log data). It's going to be absolutely critical to have a firm definition of this category of data. Why, Caleb? Thanks for asking! The reason is quite simple: It is driving requirements, also indicated in the proposed rule. These requirements SPECIFICALLY hinge on the definition of Security Protection Data, which I'm sure will lead to the same type of discussions we've had around "I don't think my organization has CUI." "We didn't get an answer back from our Contracting Officer on what our CUI is." But here is the scary part (and I'll preface this by saying that I'm in favor of some form of regulating Service Providers): it's just been completely MADE UP! 🤯 Now why would they have to magically create this category of data? Because data/information is the extent to which the government can regulate things in industry at this point. BUT they can't make up a CUI Category without going through NARA (how inconvenient checks and balances are) and they can't regulate information that doesn't belong to them so they have AGAIN (#FedRAMP) skirted the process. In the case of the FedRAMP requirement and now with the SPD requirement (which could also mean FedRAMP for Cloud Providers they missed on their first shot) they are not actually regulating the providers through regulation, but by threatening their businesses by requiring the Service Providers' customer bases to contractually agree to use Service Providers that have implemented the requirements. As I mentioned above, I'm in favor of securing the provider base, but I'm very much against the legal shenanigans that are being played by the DoD here to loophole the actual legal process and bully the industry. And on top of that, they've not given a clear definition of the criteria that enforces the requirement, which signals to me that the thought process is: "we're going to enforce whatever requirements we want and we'll just make up the definitions on the back end to fit what we want to enforce so WE can loophole the process while ensuring industry cannot." #cmmc #dfars #cmmc2 #dfars7012 #nist800171

Attention DoD Suppliers! Did you know on Monday, December 16, the final rule for the Pentagon’s Cybersecurity Maturity Model Certification 2.0 (CMMC) initiative went into effect? The clock is ticking for companies to meet the requirements to be eligible to win Department of Defense (DoD) contracts. The final rule will require defense contractors working with controlled unclassified information (CUI) or federal contract information (FCI) to meet one of three levels of CMMC compliance, depending on the sensitivity of the info they’re handling. The impending CMMC Title 48 Proposed Rule, which would implement CMMC requirements in the Defense Federal Acquisition Regulation Supplement (DFARS), remains in the Federal rulemaking process. No mandatory CMMC contractual requirements for defense contractors can take effect until the CMMC Title 48 Final Rule is approved and becomes effective. The final rule was released for inspection in October on the Federal Register and was scheduled to go into effect on December 16. A follow-on Defense Federal Acquisition Regulation Supplement (DFARS) rule change to contractually implement the CMMC program was slated for publication in early to mid-2025. This article can provide more detail >>> https://loom.ly/6Q0DEnI Purdue MEP is hosting a FREE webinar on January 29 to review the CMMC program final rule, the expected implementation timeline, and resources to support adoption. Click here for more information and to register for the webinar >>> https://loom.ly/t-BleLw Do you need help assessing how this rule affects your organization? Reach out to Purdue MEP at [email protected].

Facts like what Jacob is describing here just further concern me about this CMMC implementation and the impact, especially on small businesses.

NIST's support materials are fantastic, don't get me wrong, but their proclivity to reference other NIST documents is exhausting. If you're a chronic reader like me, you also struggle with chasing those references all the way down the rabbit hole and wonder where the hours went. Do you have a strategy for NIST knowledge containment? Drop it in the comments. #NIST #resources #infosec

I found keeping track of your ROC assessments difficult enough in v3.2.1. With the PCI DSS v4.0 level 1 assessments being longer and far more involved, I would recommend using technology to help you manage this progress tracking effectively. https://lnkd.in/eT5uC9gJ #pcidss #pcidssv4 #worksmarternotharder

NIST CSF 2.0 applicability is now beyond critical infrastructure, making it applicable to any business or organization. #nist #csf #gama #business #organization https://lnkd.in/edn_GaX5

Confidence in credential service providers is a complex thing to measure, and it’s emphatically not just about the tech. Kantara Initiative has a crucial ecosystem role in contributing to this confidence. #identityassurance

NIST SP 800-171r2 represents 𝗹𝗲𝘀𝘀 𝘁𝗵𝗮𝗻 𝟭/𝟰 of FedRAMP Moderate r5. It's not as simple as comparing the total number of both control sets. At first glance there are 110 requirements in SP 800-171r2 while FedRAMP moderate has 323 controls from SP 800-53r5. In this case 110/323 doesn't equal 34% because most SP 800-171r2 requirements only include portions of the SP 800-53 controls from which they are derived. It's more accurate to compare the total number of determination statements in SP 800-171A and SP 800-53A verification procedures for the controls sets. - 𝗦𝗣 𝟴𝟬𝟬-𝟭𝟳𝟭𝗔: 320 determination statements - 𝗙𝗲𝗱𝗥𝗔𝗠𝗣 𝗠𝗼𝗱 𝗿𝟱: 1,374 determination statements Thus: 𝟯𝟮𝟬/𝟭𝟯𝟳𝟰 = 𝟮𝟯% The idea that FedRAMP moderate and SP 800-171r2 are anywhere close to each other is incorrect so don't fall for fast-talking marketing shell games. When you hear government officials mix up these two baselines in such a way as to imply that they will be able to either magically extend government-subsidized cloud enclaves that only meet 23% of their own requirements or establish some sort of "reciprocity" between the two, call them out and tell them I sent you. For everyone who voted that SP 800-171r2 represents 63% of the FedRAMP moderate r5 baseline, see me after class.

https://lnkd.in/eaDg4UM2 Certified #CMMC Practitioner Tip: AC.L1-3.1.20 - Managing the movement of Controlled Unclassified Information (#CUI) in relation to External Service Providers (#ESPs) and Cloud Service Providers (#CSPs) is a critical aspect often missed by Organizations Seeking Certification (#OSCs). It's essential to consider these providers if they have access to Federal Contract Information (#FCI) or CUI on their own systems or those of the OSCs. To regulate the flow of CUI in line with sanctioned authorizations, the following tools are instrumental: • Azure Rights Management (Azure RMS) • Microsoft 365 Data Loss Prevention (DLP) • Microsoft Information Protection • Microsoft 365 Defender • Azure Virtual Networks • Azure Firewall • Azure Network Security Groups (NSG) • Azure Conditional Access Policies Give us a call if you need a hand - #GessoSolutionsInternational

https://lnkd.in/g62uTgK To play today, HIPAA, PCI, and FedRAMP certifications for contact centers are not an option. NACSMA resources like this and other topics are at the link above! #PCI-DSS #ACA #HIPAA #becomeamember #NACSMA #contactcenters #callcenters