Casey Hillman

DoD Contractors: FCI vs CUI We discuss CMMC Compliance requirements, implementing NIST 800-171 110 controls to meet CMMC Level 1 and prepare for CMMC Level 2 assessment.

2

1 Comment

📢 Attention Defense Contracting Community: 📢 Attention John M. Tenaglia, Principal Director, Defense Pricing and Contracting In light of the recently released MEMORANDUM FOR COMMAND, titled "Class Deviation—Safeguarding Covered Defense Information and Cyber Incident Reporting," it's crucial to reconsider certain aspects of the CMMC 2.0 program. Referencing the initial implementation of DFARS clause 252.204-7012: "(ii)(A) The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017." In this context, the clauses clearly state that THIRD-PARTY Assessments or Certifications of Compliance are NOT recognized by the DoD, nor does the DoD certify that a contractor is compliant with the NIST SP 800-171 security requirements. Implementing these clauses would render the proposed CMMC 2.0 program obsolete and could potentially save $4 billion. Additionally, using NIST SP 800-171 Rev 3 as the standard would allow the Defense Industrial Base (DIB) to submit Organization Defined Parameters (ODP) to meet evolving cybersecurity requirements, ensuring continual security and compliance. Let's align policy with practical, cost-effective cybersecurity measures for our defense contractors.....IMHO K #Cybersecurity #CMMC #DefenseContracting #NISTSP800171#$4B

4

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4

The Department of Defense (DoD) is proposing changes to the Defense Federal Acquisition Regulation Supplement (DFARS) to implement updates from the National Defense Authorization Acts (NDAAs) for FY 2018, 2021, and 2022. These changes aim to refine requirements for contractors to submit cost or pricing data. Key updates include: 1. Higher Threshold for Certified Cost or Pricing Data: The threshold is raised to $2 million, reducing paperwork for smaller contracts while maintaining certification requirements for larger ones. 2. New Requirements for Non-Certified Data: Contracting officers can request "data other than certified cost or pricing data" to verify price reasonableness, making organized and transparent pricing documentation essential. 3. Application to Commercial Products and Services: The rules now apply to commercial items, including off-the-shelf products and services, requiring the same data submissions as traditional contracts. 4. Stronger Focus on Fair Pricing: Contracting officers have increased authority to scrutinize pricing data, even when certified data isn’t mandatory, emphasizing the need for clear, well-documented pricing justifications. The public comment period for this proposed rule ends on November 25, 2024, with comments accepted at Regulations.gov.

2

Check out the results of my company's FY25 Q3 earnings by reading CEO Toni Townes-Whitley's post below! Learn more about our mission deliver innovative solutions that help government agencies operate more efficiently

2

We partnered with MeriTalk to survey 100 Federal security managers with operational technology (#OT) responsibilities in #Federal civilian and Department of Defense (#DoD) organizations. Our findings explored OT #cybersecurity prioritization and preparedness, critical components and gaps in current OT strategies, and more. 📁 Download the report here: https://hubs.li/Q02xlNPZ0

33

Need to understand the new distinctions in the new DoD SRGs? We explore the latest key changes so CSPs can smoothly transition to the new mandates and stay compliant. Tap below to discover more. 📝: Christopher Lepotakis

8

1 Comment

Allan Hancock College will expand and strengthen its cybersecurity capabilities thanks to a recently awarded grant from the California Governor’s Office of Emergency Services (Cal OES). The college will receive $125,525 from the State and Local Cybersecurity Grant Program (SG Program). The funding will support critical initiatives to address cybersecurity risks, protect information systems and bolster the security and resilience of essential services at the college. https://ow.ly/UStN50UFr5L

17

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/gd4wAWM2 #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

5

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

AGC of California has two new webinars on the Department of Defense’s (DoD) latest Cybersecurity Maturity Model Certification (CMMC). This CMMC ruling will impact contractors that contract with the Army Corps or DoD throughout the country. These webinars are on-demand and pre-recorded, therefore, they are accessible at any time. Additionally, they are free for everyone to access. To view the first webinar on the Department of Defense’s Ruling on CMMC, please click here: https://bit.ly/4fO4B2e To view the second CMMC 2.0 webinar that reviews compliance, please click here: https://bit.ly/40q87eI If you have any questions, please contact Mary Alyssa Rancier at rancierm@agc-ca.org.

6

Presidio Federal and SentinelOne are working together to help federal agencies be ready at any moment to prevent cybersecurity attacks and threats. Executive Orders, like M-21-31, guide federal agencies in increasing their visibility and response capabilities before, during, and after a cybersecurity incident. 🔐🌐 “We view OMB M-21-31 as one of several of the guiding principles from a modern technology perspective around what government entities and critical infrastructure need to do,” said Michael Loefflad, SentinelOne’s senior director for federal systems engineering. 📝💡➡️ Learn what government leaders need to know about M-21-31 compliance at https://lnkd.in/gc-FFTM4 #omb  #data #ai #cybersecurity #cloud #cloudcomputing #infrastructure #itmodernization #federalit #thinkmission

6

Join Corelight Federal SE Richard Chitamitre, Carahsoft, and our DoD team tomorrow for a deeper look at how the Corelight + Splunk integration reveals deep visibility into adversarial activity, empowering incident responders and public sector threat hunters to work faster and more effectively. Register for this exclusive session today: https://lnkd.in/eSTc9MFM #Cybersecurity #ThreatHunting #IncidentResponse

12

🔐 Effective Strategies for CUI Lifecycle Management 🔐 Managing Controlled Unclassified Information (CUI) is essential for data security and compliance. Here’s our step-by-step guide: 📋 Establish Clear Policies and Procedures     - Define CUI within your organization.    - Create policies for handling, marking, storing, and transmitting CUI.    - Train employees on these policies regularly. 🔒 Implement Robust Access Controls     - Assign access based on job roles.    - Follow the least privilege principle.    - Conduct regular audits. 🛡️ Use Encryption and Secure Communications     - Encrypt CUI at rest and in transit.    - Use secure channels like VPNs and encrypted email.    - Keep tools updated. 🕵 Monitor and Audit CUI Handling ️️    - Implement logging and monitoring systems.    - Perform regular audits.    - Maintain an incident response plan. 🔐 Implement Strong Data Loss Prevention (DLP) Measures     - Deploy DLP solutions.    - Enforce policies with DLP tools.    - Continuously monitor data loss incidents. 🔄 Regularly Review and Update CUI Practices     - Review and update policies regularly.    - Stay informed about new technologies.    - Establish a feedback loop with employees. By following these strategies, organizations can effectively manage the lifecycle of Controlled Unclassified Information (CUI), ensuring its protection and compliance with relevant regulations. InterSec, is committed to helping organizations protect their sensitive information.  📧 For any assistance with CUI lifecycle management or other cybersecurity services, contact us today inquiries@intersecinc.com to learn how we can support your efforts. 👇Click the link to check our CUI Guide for DoD Contractors.👇 #CUI #DataSecurity #Compliance #CyberSecurity #Dod #InterSec #InterSecInc #department_of_defence #cui_guide #data_protection  

1