Edward Rhyne

The Department of Defense released a 400-page document, "Zero Trust Overlays," which details one overlay for each of the seven pillars in the DoD Zero Trust Strategy, plus an overlay for the enablers. Learn more about this new guidance. https://bit.ly/4cb3XKU

13

DOD issues class deviation, effective immediately, for its safeguarding covered defense information #cyber rule under DFARS 252.204-7012. This deviation amends the #defense regulation to specifically require compliance with NIST SP 800-171 rev. 2 until the deviation is rescinded. Because the pre-deviation language required compliance with the version of NIST SP 800-171 "in effect at the time the solicitation is issued," the deviation provides needed clarity as contractors not only prepare for DOD's upcoming #CMMC rule but also to avoid a compliance headache when NIST publishes rev 3 to #nist800171. #govcon

4

Senate chairman wants new White House-led panel to streamline federal cyber rules Read more on the link below. #defense #sbir #military #jointwerx #cmmc #cyber #cybersecurity @jointwerx @blackhaysgroup #GovernmentContracts #InfoSec #CyberDefense #NationalSecurity #DigitalTransformation #PublicSector #Startups #TechInnovation

1

For those who missed my presentation at CMMC Day, a summary: There are two CMMC rules on two different rulemaking timelines that will lead to one giant gap between when DoD says you need CMMC and when the market says you need CMMC. The background info: The first rule codifies the CMMC program (the three levels, POAMs, waivers, roles and responsibilities, etc.). - This rule is the "32 CFR CMMC" rule. - Once this rule is final and effective, the CMMC marketplace is live (something I call the "market roll-out"). - That means your customers and your competitors will immediately pressure you to get certified. The second rule revises the DFARS clause 252.204-7021 created by the 2020 CMMC rule to match the details of the program at 32 CFR. - This rule is the "48 CFR CMMC" rule. - Once this rule is final and effective, DoD will begin inserting CMMC level requirements pursuant to the DFARS 7021 clause in contracts in phases. - Hence the name "phased roll-out". The 32 CFR CMMC rule was published just after Christmas 2023. Normally DoD rules take ~280 business days after publication to adjudicate public comments and publish a final rule. This puts the window for a 32 CFR CMMC final rule ~Q1 2025. However, DoD and OMB are highly motivated to wrap up rulemaking before the election adds time to the miscellaneous red tape that occurs when a final rule is published. There are many reasons to believe that DoD will beat the average timeline by a few months and meet their goal (for the sake of space, comment below if you'd like to know what those reasons are). In parallel, the 48 CFR CMMC proposed rule was originally slated for Q1 2024 publication with a Q1 2025 final rule. Unfortunately, the 48 CFR rule is behind schedule and was recently sent back for revisions which could add weeks/months before the proposed rule is published. If the average timeline applies to the 48 CFR rule once published in Q4 2024, then the gap between the two rules could be upwards of a year, possibly longer. As a result, all of the chaos resulting from CMMC will set-in by Q1 2025 but DoD will be able to say "we haven't required CMMC in a single contract yet".

163

19 Comments

Update on the #CMMC timeline!  During the April The Cyber AB Town hall, Matthew Travis pointed out that CFR 48, the procurement side of the rule, was returned to the DoD and not accepted for release for public comment. The rule was originally expected out for public comment in March 2024; however since it was returned to the DoD on Apr 8 the timeline is unclear. Matt speculated that it could be a simple clerical error that could be quickly addressed enabling the rule to be released for public comment in May 2024. Public comments for CFR 32, the CMMC Program rule, are being adjudicated by the DoD. CFR 32 is still expected to be released in fall of 2024. This rule establishes the CMMC Program and authorizes assessments to begin. Therefore, it is likely that assessments can begin prior to being mandated in contracts. This will give the DoD additional fuel for including CMMC in more contracts once CFR 48 is finalized since organization will have plenty of time to get ready. Will your organization be ready for an CMMC assessment in time to beat the rush to ensure you can bid on contracts when CFR 48 is finalized?

31

3 Comments

Senior Advisor at the DoD Chief Digital and Artificial Intelligence Office and Chief Product Officer of Advana, Ashley Elizabeth Evans, and others shared insights on leveraging AI/ML and automation to bolster mission readiness in defense during FedScoop's #uipathontour. The collaborative efforts between the entire CDAO, including Advana, are aimed at harnessing the potential of data and AI/ML technologies to optimize decision-making processes and operational efficiency within the DoD and defense operations. Engaging in forward-looking dialogues with other leaders such as these is essential for advancing technology within defense operations.

127

1 Comment

Organizations globally experience the same classification issues, which are highlighted in the US DoD Inspector General report - Janusnet has the solution for the report's key recommendation: “In coordination with the Office of the DoD Chief Information Officer and DoD Component Heads, develop and implement a DoD‑wide solution for automatically populating documents and emails with the required markings based on a set of selection criteria.” Janusnet enables organizations to mark #CUI and implement the requirements of the United States Department of Defense CUI program

9

Exciting Start to the NTSC Northeast Regional Roundtable! In our inaugural session, we delved into the escalating cyber and AI challenges posed by China. Examining the implications for U.S. and allied security, the discussion dissects China's technological advancements and cyber operations. From espionage to AI deployment in military and civilian sectors, China's activities underscore a pivotal aspect of its global influence strategy. Covering a range of topics, including recent cyber incidents attributed to Chinese actors, the exploration of China's AI strategy and its global impacts, and the development of countermeasures and policies to bolster cybersecurity defenses and AI readiness among allies. Session one is aimed to equip attendees with a deeper understanding of the threats at hand, alongside collaborative strategies to enhance resilience and response capabilities. Register here: https://ow.ly/8pzH50RftIK #Cybersecurity #CISO #NTSCRegionalRoundtable #Cybersecurity #CISO #AI #SecurityCahllenges #Collaboration #NTSC #ICE #WorldWideTechnology #MicrosoftSecurity #CheckPointSoftwareTechnology #CollectiveInsights #CISA

3

As an expert in Cybersecurity I’m headlining this conference!

2

1 Comment

Expert analysis by Drew Schmitt, Practice Lead, GRIT at GuidePoint Security, on the evolution of #RaaS. With #ransomware groups adapting recruitment tactics, the cyber threat dynamic changes. Schmitt's investigation uncovers new affiliate strategies after #OperationCronos. Learn more in his interview with Help Net Security. https://okt.to/K0ecpO #CyberCrime

4

#CMMC 2.0 will allow self-assessments, instead of third-party assessments, for Level 1 and some of Level 2. #cybersecure

3

Cyber Force measure expected to resurface in House defense bill debate. Why it matters: 1. "Why it matters": A proposed bipartisan amendment by the House Armed Services Committee could usher the U.S. military into a new era of battlefronts, this time in digital space. 2. The proposal aims to capitalize on the exponential growth of cyber threats and equip U.S. defense better by creating a dedicated Cyber Force—an initiative that, if successful, would mark the military's second new branch since 2019, following the Space Force. 3. Critics argue that the initiative could detract from existing military cyber efforts, highlighting the major changes facing federal defense strategy. However, if created, the Cyber Force could address the longstanding issue of inadequately trained digital personnel across different military branches, transforming the U.S.'s cybersecurity landscape. Learn more by visiting The Record from Recorded Future News: https://lnkd.in/e7Teb9Jn

2

For the U.S. DoD looking to integrate commercial solutions into the national security architecture, Other Transaction Agreements (OTAs) have emerged as a pivotal tool in this process. OTAs offer greater flexibility and speed, enabling quicker adoption of new and innovative technologies, bypassing some of the bureaucratic hurdles that often slow down progress in defense acquisitions. We’ll talk more about this topic on LinkedIn and in our blog over the coming weeks, as government, commercial and academic institutions determine how best to work together for national security. You can read more about how Knowmadics is empowering this process: https://lnkd.in/eDbAA8CV

32

Do you find the false dichotomy between compliance and security to be loathsome, circular, and unhelpful? Are you curious about what security value you're getting for your time, money, and effort when you pursue CMMC certification? Catch the replay of my presentation at CS2 Boston on May 7th at 10am Central (it's free) I'll be answering questions live in chat so come hang out Registration link is in the comments below 👇

65

8 Comments

As of May 15, the #CMMC proposed rule entered the OMB review process. With the DoD looking to finalize CMMC 2.0 this year, the time for readiness is now! Join us for an informational webinar with #CybersecurityMaturityModelCertification compliance professionals from Systems Engineering and Coalfire Federal, a Certified Third-Party Assessment Organization (C3PAO). Gain valuable insights as our professionals discuss lessons learned by organizations that have undergone a Joint Surveillance Voluntary Assessment (JSVA). TITLE: From the Front Lines: An Assessor's View on CMMC Readiness DATE: Thursday, May 30 TIME: 2:00 PM ET Register Now => https://hubs.ly/Q02y9xSQ0 Will you avoid or fall into the most common compliance pitfalls? Join the webinar and get an exclusive view into the assessment process. #JSVA #CMMCreadiness

10

Former CYBERCOM boss Nakasone to lead Vanderbilt defense institute Read more on the link below. #defense #sbir #military #jointwerx @jointwerx @blackhaysgroup #governmentcontracts #smallbusiness #entrepreneurship #venturecapital #consulting #strategy #leanstartups #startup #growthhacking

1

Automated Continuous Assessments are the only way forward if we want to keep pace. Point in time assessments can’t provide the necessary assurance and significantly delay mission access to leading tech. It’s the same issue in Commercial and Jeff Buss makes a great point.

62

6 Comments

One of the reasons I'm excited about attending the @IPTC Photo-Metadata Conference this year is that I'm really looking forward to hearing a presentation by Neal Krawetz. Neal will be presenting a live demo of research he has gathered over the past year of how the C2PA tools (for provenance and authenticity) still have some holes in their processes. I am all about supporting missions around trust and authenticity in media - but I want to make sure I can see how to get from point A to point Z with transparency, independent governance of data and without it turning into something like digital rights management (DRM) which could lead to silos or channels of content that would only promote or allow only certain publishers to get certificates and be their own verified sources of trust. I keep wanting to use a 'right to repair' your own equipment metaphor, but what I really mean is that I want the 'right to update my own metadata' without having to go through a complex trust and authenticity system that could be hacked anyway but at the same time become the voice of authority.

1