Scott Edwards

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/dNvErjXS #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

2

1 Comment

Yesterday, I had the pleasure of attending #CMMCDay. There were a lot of great discussions kicked off by Matthew Travis, The Cyber AB. I took a few key points from the discussion throughout the day. 1. False Claims Act - This will continue to be the primary compliance review for the DoD. Why not 'deputize' those within the DIB to police themselves. With the payouts being received from false claims act, it appears that it will be an effective tool for the DoD. 2. Rulemaking Timeline - The DoD continues to adjudicate public comments on the #CMMC Program rule (CFR 32) and all indications are that it will be released by fall 2024. This rule will make CMMC affective and allow certifications to begin outside the Joint Surveillance Assessment (JSVA) Program. CFR 48 that will mandate CMMC be included in contracts is expected to be delayed until later in 2025. Therefore, the DoD will essentially provide a grace period from Fall 2024 to mid/late 2025 for organizations to get certified prior to mandating it in contracts. 3. Not Just Technology - CMMC is a verification and validation program. Organizations must demonstrate that they are implementing the CMMC Requirements to a third-party assessor; while some controls (e.g., encryption, malicious code scanning) can be performed using technology, other controls (e.g., background screening, training, security assessments) require people to perform. 4. 100% Ready - There was a lot of discussion on the activities within the JSVA. These assessments provide insight into what organizations can expect during a CMMC assessment. One of the key themes coming from these assessments is if you aren't 100% convinced your organization is ready for an assessment - then you’re not ready! If you couldn’t attend and want to learn more about these and other topics, send me a note. I'd be happy to share additional insights. If you were able to attend, what key points did you take away from the event?

14

Update on the #CMMC timeline!  During the April The Cyber AB Town hall, Matthew Travis pointed out that CFR 48, the procurement side of the rule, was returned to the DoD and not accepted for release for public comment. The rule was originally expected out for public comment in March 2024; however since it was returned to the DoD on Apr 8 the timeline is unclear. Matt speculated that it could be a simple clerical error that could be quickly addressed enabling the rule to be released for public comment in May 2024. Public comments for CFR 32, the CMMC Program rule, are being adjudicated by the DoD. CFR 32 is still expected to be released in fall of 2024. This rule establishes the CMMC Program and authorizes assessments to begin. Therefore, it is likely that assessments can begin prior to being mandated in contracts. This will give the DoD additional fuel for including CMMC in more contracts once CFR 48 is finalized since organization will have plenty of time to get ready. Will your organization be ready for an CMMC assessment in time to beat the rush to ensure you can bid on contracts when CFR 48 is finalized?

31

3 Comments

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/dYX76H8s #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

2

Dave DiEugenio, PMP, CISM, ITIL on supporting a dispersed group of Marine Corps Recruiting recruiters - "Network availability, security and reliability is as important as electricity and heat." Our panel on simplifying software management with Richard Grabowski, Dave DiEugenio and John Schneider just wrapped at Adapt 2024! #AxoniusFederal #FederalCybersecurity #FederalIT #DefenseTech #Adapt2024 #AxoniusAdapt2024

19

4 Comments

The US DoD announced the CMMC 2.0 roll out is on track for the start of 2025 - are you ready? Last week at the Potomac Officers Club’s 2024 Cyber Summit, DoD Deputy Chief Information Officer for Cybersecurity and Senior Information Security Officer David McKeown congratulated the ‘tremendous perseverance’ of the architects enabling and enforcing the revised three-tiered incoming compliance program. If you're a contractor or subcontractor within the US DIB supply chain, affirmative compliance is required by Oct. 1st 2026. However, McKeown's announcement that the DoD is on track to officially start rolling out and including CMMC 2.0 in contract paperwork in the first quarter of 2025 calendar year, is an important reminder to prioritise action. Cocoon Data's KBOSS for Workspace is launching just in time to streamline your path to CMMC 2.0. Paired with Google's Assured Control Plus and when appropriately configured, the KBOSS Add-on secures assured workloads to meet CMMC 2.0 and ITAR requirements, setting a new standard for classified collaboration. It's time to get on track, be future-ready with KBOSS. #DoD #CMMC #Cybersecurity #KBOSS #DIB

18

When it comes to #CMMC readiness, nothing beats a solid Mock Assessment. Here's a quick refresher on why Coalfire Federal's CMMC Mock Assessments are the game-changer you need: ☑️Uncover Hidden Weaknesses ☑️Empower Your Team ☑️Save Time and Money Choose from two flexible options: 🔶Mock Assessment: This comprehensive evaluation covers ALL CMMC practice areas, giving you a complete picture of your cybersecurity posture. 🔷Mock Lite Assessment: Looking for a targeted approach? Choose this option to focus on the FOUR critical control domains that concern you the most. Practice is key to a winning strategy. Get the upper hand on CMMC certification with Coalfire Federal's Mock Assessments. Learn more: https://hubs.la/Q02wmyzd0 #CMMC #cybersecurity #defenseindustrialbase #mockassessments #DoD #CUI Coalfire

9

🚨 DFARS 252.204-7021 (the CMMC clause) is currently at the Office of Management and Budget (OMB) 🚨 The abstract states, "DoD is amending an interim rule to implement the CMMC framework 2.0 in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides the Department with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain." Once approved, the rule will be sent to the Federal Register for publication 👀 You can see the rule here: https://lnkd.in/eyP5dqre Shoutout to Eric Crusius for breaking this news! #cmmc #dod #cybersecurity

35

Coming up this week -- STILL TIME TO REGISTER -- learn about #CMMC #cybersecurity compliance for DoD contractors & subcontractors, 4/18 at 2p: https://lnkd.in/edsTrBup

1

🔐 Effective Strategies for CUI Lifecycle Management 🔐 Managing Controlled Unclassified Information (CUI) is essential for data security and compliance. Here’s our step-by-step guide: 📋 Establish Clear Policies and Procedures     - Define CUI within your organization.    - Create policies for handling, marking, storing, and transmitting CUI.    - Train employees on these policies regularly. 🔒 Implement Robust Access Controls     - Assign access based on job roles.    - Follow the least privilege principle.    - Conduct regular audits. 🛡️ Use Encryption and Secure Communications     - Encrypt CUI at rest and in transit.    - Use secure channels like VPNs and encrypted email.    - Keep tools updated. 🕵 Monitor and Audit CUI Handling ️️    - Implement logging and monitoring systems.    - Perform regular audits.    - Maintain an incident response plan. 🔐 Implement Strong Data Loss Prevention (DLP) Measures     - Deploy DLP solutions.    - Enforce policies with DLP tools.    - Continuously monitor data loss incidents. 🔄 Regularly Review and Update CUI Practices     - Review and update policies regularly.    - Stay informed about new technologies.    - Establish a feedback loop with employees. By following these strategies, organizations can effectively manage the lifecycle of Controlled Unclassified Information (CUI), ensuring its protection and compliance with relevant regulations. InterSec, is committed to helping organizations protect their sensitive information.  📧 For any assistance with CUI lifecycle management or other cybersecurity services, contact us today inquiries@intersecinc.com to learn how we can support your efforts. 👇Click the link to check our CUI Guide for DoD Contractors.👇 #CUI #DataSecurity #Compliance #CyberSecurity #Dod #InterSec #InterSecInc #department_of_defence #cui_guide #data_protection  

1

Exciting morning in Defense Contractor land! The #CMMC Final Rule has moved to its last phase before publication. All the comments were responded to... Even the angry ones... (Golly geez I hope some of those errors in the proposed rule got fixed, since I and Kieri Solutions - Authorized C3PAO will be helping enforce it! 😬) Well done Stacy Bostjanick, Buddy Dees, and the DoD CIO team for keeping your cool during those late nights. 𝐖𝐡𝐚𝐭 𝐜𝐚𝐧 𝐰𝐞 𝐞𝐱𝐩𝐞𝐜𝐭 𝐧𝐞𝐱𝐭? Disclaimer: Below projections are best guesses, with help from the esteemed Jacob Horne (follow him!). The CMMC final rule (32 CFR) should be published in the Federal Register around Sept-Oct this year. Then we get 60 days to freak out before it "goes into effect". Somewhere around this time, CMMC eMASS (the database that holds the certification statuses of each company) should come online and C3PAOs like my company will start using it. Between News Years and March 2025, I think we assessors will be allowed to start doing CMMC assessments and certifications at full speed. I'm sure the DoD's intent is for it to be closer to New Years, but we will still need some prerequisites (eMASS, Cyber-AB procedures, a CMMC "certificate" template) to be figured out. The DFARS clause (48 CFR) that adds a certification requirement for contract award will go into effect a bit later - maybe March 2025? It will start with self-attestations for CMMC, then 6 months later new and renewing contracts will start requiring actual certifications for most programs (especially ITAR and Controlled Technical Information programs). If your company has over $30m in defense contract revenue, here is your call to action - get into our queue for Gap Analysis or Assessment. You can afford the cost to make sure you're ready to go when contracts start including CMMC requirements. If you have subcontractors that are vital to your operations, talk to them. You will be responsible for ensuring that your entire CUI supply chain is certified. 𝐇𝐚𝐬 𝐭𝐡𝐢𝐬 𝐟𝐢𝐧𝐚𝐥𝐥𝐲 𝐜𝐨𝐧𝐯𝐢𝐧𝐜𝐞𝐝 𝐲𝐨𝐮𝐫 𝐥𝐞𝐚𝐝𝐞𝐫𝐬𝐡𝐢𝐩 𝐭𝐡𝐚𝐭 𝐂𝐌𝐌𝐂 𝐢𝐬 𝐫𝐞𝐚𝐥? If you're scrambling at this late hour, let me suggest a few solutions: At Kieri, we have a CMMC compliance program (the KCD) that tells you exactly what you need to do, how to do it, and when, to get and stay compliant. If your current network can't pass assessment, check out our Reference Architecture (the KRA), which can be built and assessment ready in about 4-6 months, either by your team or ours. We specialize in helping IT teams be responsible for their own compliance. Kieri Solutions - Authorized C3PAO website: https://kieri.com

238

13 Comments

On December 26, 2023, the Department of Defense ("DoD") issued the long-awaited proposed rule for the Cybersecurity Maturity Model Certification ("CMMC") program. There are 3 different levels of compliance and contractors will be required to either conduct a self-assessment or undergo a third-party assessment (the latter referred to as a certification assessment) to demonstrate compliance with their applicable CMMC Level

1

Your Partner in Defense 🛡️ Discover how SecureStrux provides cutting-edge DoD cybersecurity services to protect our nation's most sensitive information. From compliance assessments and advanced engineering solutions to staff augmentation, we've got you covered. Ensure your organization's security and compliance today. ⬇️ #cybersecurity #cyberdefense #SecureStrux

7

📝Full Defense Strategy: https://hubs.ly/Q02tb2pl0 The Pentagon has introduced its inaugural strategy to advance cybersecurity within the defense industry. Announced by David McKeown, the Deputy Chief Information Officer for Cybersecurity, the initiative underscores collaboration with the U.S. defense industrial base to combat ongoing cyber threats. The strategy outlines key goals to enhance cybersecurity governance, boost defense base resilience, and improve collaborative efforts against cyber adversaries. Officials emphasize the necessity of protecting critical information and the U.S. warfighting advantage through a fortified cybersecurity posture. The approach includes evaluating compliance with cybersecurity standards, enhancing threat intelligence sharing, and developing robust responses to cyber incidents. This strategy aligns with the National Defense Strategy and aims to secure critical defense production and information integrity against malicious cyber activities. The release of this cybersecurity framework is part of broader efforts to modernize and secure the U.S. defense industrial base, ensuring it meets the challenges of a complex national security landscape.

3

The DoD has unveiled the Fulcrum Advanced Strategic Plan, a comprehensive roadmap designed to drive growth, innovation, and operational excellence. What are your thoughts about the new DOD Strategy? We found a highlight about changes in Software Supply Chain Security Section - 1.3.6 Building Supply Chain Security Ensuring the supply chain is secured provides flexibility to accelerate the acquisition of national security systems while reducing the risk of injecting unnecessary system vulnerabilities. The document also highlights the Key Lines of Effort: 1️⃣ Provide Joint Warfighting IT Capabilities: Enhance strategic dominance with advanced, secure, and interoperable IT systems. This includes leveraging AI and machine learning to outpace adversaries and ensure superior operational capabilities. 2️⃣ Modernize Information Networks and Compute: Transition to a data-centric Zero Trust security model, optimizing the DoDIN foundation for performance and resilience. This effort aims to integrate scalable, secure IT infrastructure that adapts to modern threats. 3️⃣ Optimize IT Governance: Streamline IT governance processes to enhance efficiency and mission alignment. This involves overhauling governance tools, improving data quality, consolidating legacy systems, and accelerating IT acquisition with DevSecOps practices. 4️⃣ Cultivate a Premier Digital Workforce: Build and maintain a highly skilled digital workforce ready to deploy emerging technologies. Focus areas include continuous learning, competitive compensation, and fostering collaborative partnerships with industry and academia. #cybersecurity #dod #compliance #fulcrum

2

Many agencies struggle with software management – Marine Corps Recruiting Command CIO Dave DiEugenio, PMP, CISM, ITIL shares that the agency “had multiple tools with multiple presentations of information, and a limited number of folks with the skillset and understanding to be able to reconcile that.” Learn more about how MCRC is tackling the software management challenge and hear from Richard G., deputy program manager of CDM at Cybersecurity and Infrastructure Security Agency, on how CISA is encouraging agencies to maintain comprehensive enterprise software inventories to help with proactive risk mitigation. https://axoni.us/4dSuJco

31

1 Comment

Potentially big news for veteran-owned small businesses in the current House draft of the 2025 National Defense Authorization Act. The bill would: (1) require DOD to establish a VOSB prime contracting goal no less than the governmentwide SDVOSB goal (currently 5 percent) and (2) authorize DOD to use VOSB set-asides and sole source contracts to reach this goal. Currently, VA is the only agency with authority to issue VOSB set-aside and sole source contracts (as opposed to SDVOSB). This is still a draft and has a long way to go before it potentially becomes law, but it’s certainly something I will be keeping an eye on. #govcon #governmentcontracting #federalcontracting #VOSB #veteranowned

33

10 Comments