If you haven't caught a Cyber AB Town Hall lately, then you're missing out on valuable information. This week we give our take on the AB's rulemaking timeline, what the FY25 NDAA says about CMMC, the upcoming DoD IG report on the Cyber AB, and more!

Cyber AB Town Halls: https://cyberab.org/News-Events/Town-Halls

Secure the DIB replay: https://www.summit7.us/securethedib

Register for Secure the DIB: Summer Camp for FREE here: https://www.securethedib.us/

You're not crazy. According to a new inspector general report the federal CUI Program has been in hibernation for the last few years. But the story goes much deeper than run-of-the-mill findings. Desperately overworked civil servants, stubbornly non-compliant federal agencies, the lofty heights of the National Security Council, and even rumors of a new CUI executive order. This story might seem a world away from the day-to-day concerns of defense contractors, but what happens on top of the mountain inevitably rolls downhill.

ISOO IG Report: https://naraoig.oversight.gov/reports/audit/audit-naras-information-security-oversight-office

History of CMMC (2010 – 2020): https://youtu.be/jbY2irZ1ePg?si=bGiInfLCpr-WFvcF

Register for Secure the DIB: Summer Camp for FREE here: https://www.securethedib.us/

Summer is coming to a close and that means it's time for our annual Secure the DIB Summer Camp webinar. Summit 7's Daniel Akridge joins the show this week to share what he's seeing and hearing from defense contractors regarding market dynamics, what the primes are up to, and how companies are dealing with the cost of compliance.

Episode Links:

DIB Summer Camp: https://www.summit7.us/securethedib

Big Dan: https://www.linkedin.com/in/danielakridge/

Register for Secure the DIB: Summer Camp for FREE here: https://www.securethedib.us/

The DoD's Center for Manufacturing Cybersecurity has released a report documenting the level of confidence that defense contractors have in their cybersecurity posture. The conclusion? There is a systemic cybersecurity overconfidence problem in the DIB.

Episode Links:

DIB Summer Camp: https://www.summit7.us/securethedib

MxD Report: https://www.mxdusa.org/cyber/cyberreport/

Register for Secure the DIB: Summer Camp for FREE here: https://www.securethedib.us/

The 32 CFR CMMC final rule has officially left the DoD and is currently undergoing final regulatory review. This is the last step before publication in the Federal Register. Based on what we know, CMMC should be a reality before the end of 2024.

Episode Links: Proposed Rule Webinar: https://www.summit7.us/webinars/proposed-cmmc-rule

Now that SP 800-171 revision 3 is official, organizationally defined parameters (ODPs) are officially a part of our the rest of our lives. Like most things in SP 800-171 there are great details in SP 800-53 that help explain what's going on. In this episode we take a deep dive in requirement 3.1.8 through the lens of ODPs.

Episode Links:

SP 800-53: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

FedRAMP baselines: https://www.fedramp.gov/baselines/

The good news about NIST SP 800-171 revision 2 being the standard for the next few years is it's a smaller standard compared to revision 3. However, there are some confusing aspects to NIST SP 800-171 revision 2 that defense contractors can't afford to overlook. The most important? NFO Controls.

Episode Links:

NIST SP 800-171r2: https://csrc.nist.gov/pubs/sp/800/171/r3/final

DFARS 7012 Class Deviation: https://youtu.be/voziZRAMvv4?si=yPaUuHLnHIQsfGQu

Policy and Procedure Deep Dive: https://youtu.be/TXsKdH3hC6E?si=GoAlpEuMqQWAsOzr

NIST has released four introductory training courses for the 800 series of special publications that make up the basis for the NIST Risk Management Framework. Each 60 minute course does a great job covering SP 800-37, 53, 53A, and 53B. If you need a leg up on the knowledge that forms the basis of CMMC training, you should check out the courses.

NIST Training Courses:

NIST CPRT: https://csrc.nist.gov/Projects/risk-management/rmf-courses

Although CMMC assessments are difficult, CMMC certifications are achievable (assuming you have passed through the “assessment feasibility determination” prior to the actual assessment. For many companies, failing CMMC assessments won't be their biggest problem – it will be qualifying for the assessment in the first place.

Episode Links:

CMMC Cap (PDF): https://cyberab.org/Portals/0/Documents/Process-Documents/CMMC-Assessment-Process-CAP-v1.0.pdf

CMMC Fuzzy Math (2021): https://youtu.be/843K3hkLquk?si=aDuiomqVxSSwnExI

NIST Policy Controls: https://youtu.be/TXsKdH3hC6E?si=24svcK18w20DbLP_

This week we dive into the details of NIST policy and procedure controls. Love it or hate it, SP 800-171 requires policies and procedures regardless of revision. Luckily, it's easy to know what a good template looks like because policies have been outlined in NIST SP 800-53 for 20 years.

Episode Links:

NIST SP 800-53: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

NIST SP 800-53A: https://csrc.nist.gov/pubs/sp/800/53/a/r5/final