Ahmed Bajwa MBA, CISSP

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

💡 Have you considered becoming a CMMC Certified Professional (CCP)? 👉 The requirements can be difficult to navigate, and don't always provide future CCPs with a clear picture of exactly what is required to become certified 👉 Hopefully this can help someone interested in pursuing the CCP better understand the costs associated with this pursuit ❓ If you have questions about whether becoming a CCP is the right path for you, or if it would provide value to you or your organization, please reach out #CMMC #CCP #cui #dod

16

5 Comments

Our #massdatagov recently commented on the Cybersecurity and Infrastructure Security Agency #CIRCIA #cybersecurity reporting requirements NPRM including suggestions around reporting requirements for incidents at third party organizations #security #MHDCregulatory Read our comment here: https://ow.ly/JRRW50SiqLG

3

🚨 DFARS 252.204-7021 (the CMMC clause) is currently at the Office of Management and Budget (OMB) 🚨 The abstract states, "DoD is amending an interim rule to implement the CMMC framework 2.0 in order to protect against the theft of intellectual property and sensitive information from the Defense Industrial Base (DIB) sector. The CMMC framework, as defined in Title 32 of the Code of Federal Regulations (CFR), assesses compliance with applicable information security requirements. This rule provides the Department with assurances that a DIB contractor can adequately protect sensitive unclassified information at a level commensurate with the risk, accounting for information flow down to its subcontractors in a multi-tier supply chain." Once approved, the rule will be sent to the Federal Register for publication 👀 You can see the rule here: https://lnkd.in/eyP5dqre Shoutout to Eric Crusius for breaking this news! #cmmc #dod #cybersecurity

35

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

12

I found an interesting piece of information that may shed some light on the upcoming CMMC final rule regarding C3PAO data collection and retention: - The CMMC proposed rule states, "(10) Unless disposition is otherwise authorized by the CMMC PMO, m̳a̳i̳n̳t̳a̳i̳n̳ ̳a̳l̳l̳ ̳a̳s̳s̳e̳s̳s̳m̳e̳n̳t̳ ̳r̳e̳l̳a̳t̳e̳d̳ ̳r̳e̳c̳o̳r̳d̳s̳ ̳f̳o̳r̳ ̳a̳ ̳p̳e̳r̳i̳o̳d̳ ̳o̳f̳ ̳s̳i̳x̳ ̳(̳6̳)̳ ̳y̳e̳a̳r̳s̳.̳ ̳S̳u̳c̳h̳ ̳r̳e̳c̳o̳r̳d̳s̳ ̳i̳n̳c̳l̳u̳d̳e̳ ̳𝒂𝒏𝒚 ̳m̳a̳t̳e̳r̳i̳a̳l̳s̳ ̳p̳r̳o̳v̳i̳d̳e̳d̳ ̳b̳y̳ ̳O̳S̳C̳, generated by the C3PAO in the course of an assessment, any working papers generated from Level 2 Certification Assessments; and materials relating to monitoring, education, training, technical knowledge, skills, experience, and authorization of all personnel involved in inspection activities; contractual agreements with OSCs; and organizations for whom consulting services were provided." However, in the '𝘚𝘶𝘣𝘮𝘪𝘴𝘴𝘪𝘰𝘯 𝘧𝘰𝘳 𝘖𝘔𝘉 𝘙𝘦𝘷𝘪𝘦𝘸; 𝘊𝘰𝘮𝘮𝘦𝘯𝘵 𝘙𝘦𝘲𝘶𝘦𝘴𝘵' document, it states, "T̳h̳e̳ ̳o̳r̳g̳a̳n̳i̳z̳a̳t̳i̳o̳n̳a̳l̳ ̳a̳r̳t̳i̳f̳a̳c̳t̳s̳ ̳a̳r̳e̳ ̳p̳r̳o̳p̳r̳i̳e̳t̳a̳r̳y̳ ̳t̳o̳ ̳t̳h̳e̳ ̳O̳S̳C̳ ̳a̳n̳d̳ ̳𝒘𝒊𝒍𝒍 𝒏𝒐𝒕 ̳b̳e̳ ̳r̳e̳t̳a̳i̳n̳e̳d̳ ̳b̳y̳ ̳t̳h̳e̳ ̳a̳s̳s̳e̳s̳s̳m̳e̳n̳t̳ ̳t̳e̳a̳m̳ ̳u̳n̳l̳e̳s̳s̳ ̳e̳x̳p̳r̳e̳s̳s̳l̳y̳ ̳p̳e̳r̳m̳i̳t̳t̳e̳d̳ ̳b̳y̳ ̳t̳h̳e̳ ̳O̳S̳C̳. To preserve the integrity of the artifacts reviewed, the OSC creates a hash of assessment evidence (to include a list of the artifact names, the return values of the hashing algorithm, and the hashing algorithm used) and retains the artifact information for six years." It's clear that there will be changes coming in the CMMC final rule. Thoughts?

26

19 Comments

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/gd4wAWM2 #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

5

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published Thursday a cybersecurity advisory (CSA) based on its ‘SilentShield’ #redteam assessment conducted against a federal civilian executive branch (FCEB) organization in early 2023. The CSA aims to aid executives, leaders, and #network defenders across various organizations in enhancing their #cybersecurity measures. It provides insights into refining #detection, response, and hunting capabilities to mitigate risks of exploitation and compromise by advanced persistent threat (APT) actors. The #SilentShield advisory identified four key lessons across the 16 findings from its SilentShield red team assessment. The agency highlighted that the assessed organization lacked robust controls to prevent and detect malicious activities. Specifically, the organization’s perimeter network needed to be more adequately separated from its internal network, failing to limit outbound traffic effectively. https://lnkd.in/g83ktXhF

4

The Department of Defense (DoD) recently published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to incorporate contractual requirements pertaining to the proposed Cybersecurity Maturity Model Certification (CMMC) 2.0 program. The new proposed rule is a significant development in the path toward finalizing the CMMC 2.0 program. Based on its current trajectory, the likelihood of a finalized CMMC 2.0 going into effect in 2025 is quite high. Beth Burgin Waller and Patrick Austin, members of the Woods Rogers Cybersecurity & Data Privacy practice group, provide an overview of the key provisions contained in the proposed DFARS rule. #WoodsRogers #cybersecurity #DOD https://bit.ly/3XghgFi

4

Need to know more about 32 CFR CMMC Final Rule?👀 ✅Checkout Jacob Horne and all the comments in this post! #cmmc #infosec #NIST #DFARS

1

SAIC's CloudScend™ empowers agencies to accelerate #CloudMigration by securely migrating workloads faster, maximizing value while minimizing risks. This IDC MarketScape report recognizes this solution, check it out to learn more.

1

In observance of National Critical Infrastructure Security and Resilience Month, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of the Director of National Intelligence, released guidance to assist #criticalinfrastructure owners and operators to detect and mitigate efforts by foreign intelligence entities to disrupt U.S. critical infrastructure. As a nation, continued #cyber and physical threats to critical infrastructure Americans rely on daily are being observed. U.S. adversaries and their foreign intelligence entities understand the importance of the critical infrastructure sectors and how degrading them could hinder the national response to events. “U.S. adversaries and their foreign intelligence entities (FIEs) a understand the importance of these sectors and how degrading them could hinder our national response in the event of crisis or war, given that harm to these sectors could cause panic, erode confidence in the government, and complicate leadership decision-making,” the agencies identified in a document titled ‘Safeguarding Our Critical Infrastructure: Vigilance Makes a Difference.’ #Threatlandscape #Cyberattacks #Cyberthreats #Adversarialattacks https://lnkd.in/gpZKTxAe

26

1 Comment

An effective #cybersecurity strategy requires many moving parts, skills and stakeholders to come together to deliver it. Grant Hughes, CISSP, CCSP shares his guidance for defining a strategy based on his first-had experience: https://ow.ly/OEFc50SwooT

7

DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement contractual requirements related to the Cybersecurity Maturity Model Certification (CMMC) 2.0 Program. Read the proposed rule here: https://hubs.li/Q02Lt0VR0 #CMMC #CMMC2.0

10

Highlights: "The proposed DFARS rule confirms that DoD will require organizations to submit their self-assessment or certification at the time of contract award." "The rule also lays out a three-year-long “phased rollout” of the CMMC requirements. By the end of the three-year rollout, DoD estimates... 65% of applicable contracts will require a “level one” self-assessment..." "...contractors that are selling commercial-off-the-shelf items only won’t be implicated in this rule or contractors that do fairly mundane tasks, such as mowing the lawn in front of a defense installation." Read the proposed rule here: https://lnkd.in/dnpwiStQ https://lnkd.in/ecX4Mu8x

2