Register for our upcoming CS2 Replay here: https://www.summit7.us/webinars/exploring-the-real-world-security-value-of-cmmc

According to a very scientific LinkedIn poll, 61% of respondents think that DFARS clause 252.204-7012 incident reporting requirements should expand to match CIRCIA reporting requirements. While this move would make things more efficient for defense contractors, we're pretty sure folks are underestimating exactly how detailed a proposed CIRCIA incident report will be.

Episode Links:

CIRCIA Primer: https://youtu.be/ngYSaO5fg5Y?si=RSg4sWRRWuyrCr9S

Register for our upcoming CS2 Replay here: https://www.summit7.us/webinars/exploring-the-real-world-security-value-of-cmmc

Q2 2024 is upon us so this week we are updating the rulemaking calendar based on what we know about DFARS, CMMC, the FAR, and NIST revisions. If the Summer doldrums push things into the Fall then we could be in for a relentless holiday season.

Episode links:

CS2 Replay: https://www.summit7.us/webinars/exploring-the-real-world-security-value-of-cmmc

Q1 Rulemaking Calendar: https://youtu.be/IgebrVfrgWs?si=3mf5n2l1ODIlCUPt

Defense contractors have had cyber incident reporting obligations under DFARS clause 252.204-7012 for many years. Recently, however, CISA issued a 457-page proposed rule implementing the 2022 Cyber Incident Reporting for Critical Infrastructure Act. Unless CISA and DoD can reach an agreement, DIB contractors will have duplicative incident reporting obligations for two different agencies.

Episode Links:

CIRCIA Proposed Rule: https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-critical-infrastructure-act-circia-reporting-requirements

Congressional Research Service Report (PDF): https://crsreports.congress.gov/product/pdf/R/R48025

How to submit effective comments: https://youtu.be/1T_62cYiUA4?si=sp91i_cXFGiyD7JW

At long last the DIB Cybersecurity Strategy has officially been released and it's ... not great. One thing is clear: CMMC is a key part of the DoD's strategy and there are many DoD resources specifically designed to help contractors deal with it. Instead, the DoD is focused on coordination, communication, and threat intelligence sharing.

Episode Links:

DIB Cyber Strategy: https://www.defense.gov/News/Releases/Release/Article/3723439/dod-releases-defense-industrial-base-cybersecurity-strategy/

GCC: https://www.cisa.gov/resources-tools/groups/government-coordinating-councils

SCC: https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/defense-industrial-base-sector/sector-charters-and-membership

CIPAC: https://www.cisa.gov/resources-tools/resources/cipac-2022-charter

NSA Enduring Security Framework: https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/Enduring-Security-Framework/

Register for CS2 | Boston here: https://cs2.cloud/boston

Even before the CMMC proposed rule looped managed service providers into CMMC certification, defense contractors needed to be aware of how long it takes their MSP to get ready to support their assessment. This week we preview a talk from CS2 Boston focusing on the rocky road for MSPs featuring Ryan Bonner and Daniel Akridge.

Podcast listeners use code SUMITUPBOSTON for a discount on registration

Episode Links:

Summit 7 Webinar: https://www.summit7.us/webinars/can-my-msp-do-cmmc

Daniel: https://www.linkedin.com/in/danielakridge/

Defcert: https://defcert.com/

Ryan: https://www.linkedin.com/in/rybonner/

GAO on lead times: https://www.linkedin.com/posts/jacob-evan-horne_gao-defense-contract-lead-times-activity-7174430584172138498-oSfY

Register for CS2 | Boston here: https://cs2.cloud/boston

After nearly two years of silence and almost a decade of waiting the FAR CUI rule is one step closer to reality. In this episode we dive into what the FAR CUI rule is and what it means for federal contractors outside of the defense industrial base.

Podcast listeners use code SUMITUPBOSTON for a discount on CS2 registration!

Register for CS2 | Boston here: https://cs2.cloud/boston

On March 11th, the DoD issued a final rule expanding eligibility for the DIB Cybersecurity Program to non-cleared defense contractors and their managed service providers. This week we dive into the features of the rule, how it lines up with CMMC, and why the DoD final expanded the program after 12 years.

Podcast listeners use the code SUMITUPBOSTON for a discount on registration!

The DIB CS Final Rule: https://www.federalregister.gov/documents/2024/03/12/2024-04752/department-of-defense-dod-defense-industrial-base-dib-cybersecurity-cs-activities

DCISE: https://www.dc3.mil/Missions/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/

The 2020 Cyberspace Solarium Commission Report: https://www.solarium.gov/report

The 2023 Cyberspace Solarium Implementation Report: https://cybersolarium.org/annual-assessment/2023-annual-report-on-implementation/

Register for CS2 | Boston here: https://cs2.cloud/boston

NIST has released their summary of public comments received on the final drafts of SP 800-171 revision 3 and SP 800-171A revision 3. Jason and Jacob dive into when to expect the final revisions and what to expect in the revised requirements.

Podcast listeners get a discount on CS2 registration, just use the code: SUMITUPBOSTON

Episode Links:

NIST CUI Project Page: https://csrc.nist.gov/projects/protecting-controlled-unclassified-information

171r3 Blog: https://www.summit7.us/blog/nist-800-171-rev3-final-draft

ORC Control Poll: https://www.linkedin.com/posts/jacob-evan-horne_supply-chain-security-pop-quiz-nist-control-activity-7168287222444576769-7iw_

Register for CS2 | Boston here: https://cs2.cloud/boston

The public comment period on the CMMC proposed rule has closed so what happens next? In this episode we wade through the red tape in store over the next 12 months.

Podcast listeners use code SUMITUPBOSTON for a discount on registration

Episode Links: CS2 Boston: https://cs2.cloud/boston

“Midnight Rulemaking”: https://www.gao.gov/products/gao-23-105510

DoD's Rule Overview: https://youtu.be/DqRf0DiVBVI?si=2kTZcX45zD5ZPsnp

We Are the World: https://youtu.be/cYfe8RYcz-w

Register for CS2 | Boston here: https://cs2.cloud/boston

It's almost Springtime and that means it's almost time for another CS2 conference. CS2 Boston will be the 13th event in the series and, as always, there's an all-star lineup covering every nook and cranny of DFARS, NIST, and CMMC.

Podcast listeners get 20% off registration with the code SUMITUPBOSTON

Episode Links:

CS2 Boston: https://cs2.cloud/boston

DoD video overview: https://youtu.be/DqRf0DiVBVI?si=rDYWHsAHr6jwPPVm