Scott Hooper

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

🚨 You've Been Breached...Now What? 🚨 In our latest IJIS Institute Podcast, we dive deep into how to effectively respond to a cyber incident. Using the NIST Cybersecurity Framework (CSF), we cover essential controls to have in place for taking action during a cyber event. Stay tuned until the end, where Jeramy Cooper-Leavitt and I share practical tips you can implement today! Don't miss out on this crucial episode! #CyberSecurity #NISTCSF #CyberIncidentResponse #IJISPodcast #PracticalTips

7

💡 Have you considered becoming a CMMC Certified Professional (CCP)? 👉 The requirements can be difficult to navigate, and don't always provide future CCPs with a clear picture of exactly what is required to become certified 👉 Hopefully this can help someone interested in pursuing the CCP better understand the costs associated with this pursuit ❓ If you have questions about whether becoming a CCP is the right path for you, or if it would provide value to you or your organization, please reach out #CMMC #CCP #cui #dod

16

5 Comments

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

ISC2's CISSP: Is the Certification Broken? David Malachow interviews Ira Winkler on the Professional CISO Show, discussing Ira's open letter to ISC2 and its implications for CISSP certification. A must-watch for cybersecurity professionals! #ProfessionalCISO ['#ProfessionalCISO', '#Cybersecurity', '#CISSP', '#InfoSec', '#ISC2', '#CybersecurityPodcast', '#InformationSecurity', '#DataSecurity', '#ITSecurity', '#CyberRisk']

17

Highly likely that these will be included in the CMEP IP (AML) going forward...

2

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

For those in the Defense Industrial Base (DIB) and those who supply the DIB, you better already have a plan to be compliant with the upgrading of CMMC to v2 and ITAR Compliance. Check out this Guide for Defense Contractors Sponsored Post. Discover more: https://lnkd.in/gg9sA78b #cybersecurity #compliance #CMMC #ITAR #blog

7

1 Comment

https://lnkd.in/gQ-kvMFK Maximizing Your Cybersecurity Skills with SANS Training Discover how SANS training can enhance your cybersecurity expertise in just weeks. Gain valuable knowledge from industry experts through digestible content and comprehensive resources. Don't miss out on this opportunity to upskill and obtain prestigious certifications. #CybersecurityTraining #SANSCertifications #IndustryExperts #UpskillYourself #CybersecuritySkills #ProfessionalDevelopment #ComprehensiveResources #CybersecurityExpertise #SANSInstitute #OnlineTraining

1

Prepare for CMMC Success The CMMC framework is a critical component of national security. As a CMMC Certified Assessor (CCA), you'll be equipped to guide organizations in meeting NIST 800-171 and cybersecurity maturity requirements. Register today with ecfirst and become a trusted expert in CMMC compliance. #CMMC #NIST #Cybersecurity

4

ECS selected #Axonius to support DHS's CDM program. Axonius will provide comprehensive #Cybersecurity asset visibility and vulnerability management, enabling efficient risk management: https://dy.si/m5nFJ

2

It's here - CRQ Training! If you're a CISO, risk analyst or assessor interested in quantifying cyber risk don't miss this CRQ Mastery Workshop. Learn basic and advanced method. Hands-on exercises. Full toolkit and risk models. ISC2 and ISACA Chapters save and additional 20% for their members. 20 CPEs. More info and registration https://lnkd.in/ecVj8V5N #ISC2, #ISACA, #Training, CyberRiskQuantification, #CISO, #Cybersecurity

5

What does CMMC entail? CMMC serves as a validation of a contractor's cybersecurity posture. Mandatory for all DoD contractors and subcontractors handling CUI, CMMC compliance mandates adherence to NIST SP 800-171 controls, verified through third-party certification. Achieving CMMC compliance is not only crucial for securing contracts with the DoD but also for demonstrating your commitment to safeguarding sensitive data. https://cmmc.smeinc.net/ #IYKYK #CMMC #DoD #Cybersecurity #SMEInc

1

🚨 DFARS 252.204-7021 (the CMMC clause) is currently at the Office of Management and Budget (OMB) 🚨 The abstract states, "DoD is amending an interim rule to implement the CMMC framework 2.0 in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides the Department with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain." Once approved, the rule will be sent to the Federal Register for publication 👀 You can see the rule here: https://lnkd.in/eyP5dqre Shoutout to Eric Crusius for breaking this news! #cmmc #dod #cybersecurity

35