If you’ve taken the time to look through the DFARS Interim Rule…
All 80+ (potentially) confusing pages of it...
You might have some questions about how it applies to your business.
Luckily, Scott Armstrong, Sr. Director, Cyber Risk, Analytics, and Insights at Exostar, has answers.
In this episode, he and I discuss everything DIB firms need to know about the CMMC Interim Rule
What we talked about: - “Legalese to English” translations of the three new regulations - Best practices on how to score your self-assessment - How and when the DoD will start adding “CMMC language” to contracts - How the interim rule will impact new contracts and contract modifications/extensions - Why the interim rule will accelerate CMMC Level 3 compliance across the DIB - How Exostar can help your organization prepare for compliance

To hear this episode and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

SaaS is a great business to be in.    But whether you’re a startup or a mature company…    Your product is only as good as your security.    Today’s guest, Ryan Buckley, has advised SaaS firms for a number of years. He joins me to discuss how to address SaaS security and keep your product — and reputation — secure.    What we talked about:   - Why code repositories are an issue   - Why product security is as important as infrastructure security   - Senior leadership’s role in security.

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

The internet of things is taking off.    IoT is bringing new innovations across the board…   But it’s also bringing a new set of vulnerabilities.    If you’re looking to make sure you’re secure in the world of IoT, I can’t think of anybody better to talk to than Aaron Guzman, Co Chair of the IoT Working Group, and John Yeoh, Global Vice President of Research, at Cloud Security Alliance.   So, in the latest episode of the Virtual CISO Podcast, I do exactly that.    We discuss (among MANY other things):   - What CSA is and the guidance they offer developers and IoT consumers   - The work they are doing in IoT   - What implications 5G has for their work

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

ISO 27001, CMMC, NIST 800-53…   Keeping track of the myriad security guidelines can be tricky.   Especially when you don’t know the “why” behind them.    To help clear things up, in this episode, I speak with the preeminent expert on NIST guidelines, Dr. Ron Ross, Fellow at National Institute of Standards and Technology, and learn not just what the guidelines are — but how and why they came to be that way.    Ron and I discuss:   - The “Why” behind NIST guidance   - How certification standards like ISO 27001 relate to NIST 800-53 and map to each other   - How NIST balances policy and technical-level considerations   To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

Preparing to achieve CMMC compliance may seem daunting.   Especially in 6 challenging components.    But we’re going to make them easy.     In the latest The Virtual CISO Podcast episode, the tables are turned and I’m the one being interviewed. I explain these 6 problem areas and offer ways you can solve them.    To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

Though 2020 has felt decades-long already…     We still haven’t had to deal with the long-term effects of the pandemic.   But we will. The question is: Can your security?    If you’re not sure, today’s guest will surely boost your confidence.    Reg Harnish, Founder and CEO at Slingshot Cyberventures and Founder at GreyCastle Security, joins the show to walk us through the threats and opportunities a post-pandemic world presents.    We discuss:   - How the pandemic is impacting security   - The threats companies face now and in the future   - Finding opportunities post-COVID-19 world

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

CMMC is coming...   But that doesn’t mean 800-171 compliance is out the window.    In this episode, I catch up with John Ellis, Director of the Software Division at DCMA.   We discuss:   - How DCMA is conducting assessments   - Why 800-171 compliance doesn’t just go away until CMMC   - Why CMMC is so needed   To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

Not too long ago, DevOps seemed like a fringe buzzword…   Now, it’s front-and-center.   So, what is DevOps and why should you care?   To answer, I invited Jon Bass, Co-Founder & CTO at Sym, onto the show. Jon’s expertise in the field makes him a perfect tour guide for the exciting — and often misunderstood — world of DevOps.    Jon explains:   - How DevOps moved from the fringe to the mainstream   - How agile comes into the picture   - What SecDevOps is and why it’s used   To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

When ISO 27001 is optimized for speed, it’s an amazingly effective and efficient way to manage security and compliance.   Today’s guest is one of our most seasoned ISO experts in both client-facing and training roles.    In this episode, I interview Rich Stever, IT Security Auditor at Pivot Point Security, about key artifacts for optimizing your ISMS.   What we talked about: - Key artifacts of the ISMS, including security management policy - Objectives during your ISMS refresh - Privacy, ISO 27701 extensions, and all about the Information Security Management Committee - Poe Dameron (yes, the Star Wars pilot)   To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.

If your organization is in the DIB, CMMC compliance is a big deal.   It’s probably the biggest thing to happen to information security in history.    And you need to prepare. Your business could depend on it.    That’s why for this episode, I sat down with Chris Lank, Founder and CEO at Ivis, a company offering a solution for monitoring any compliance, not just CMMC, year-round.   Chris goes over the ins-and-outs of the changes CMMC will bring for your business — especially for smaller DIB organizations — and how to prepare.   What we talked about:   - Why CMMC is necessary   - What your organization needs to start doing right now to prepare   - How tools like Ivis’ can make the compliance process a whole lot easier   To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.   If you don’t use Apple Podcasts, you can find all our episodes here.