Sum IT Up: CMMC News Roundup

Register for CS2 | Boston here: https://cs2.cloud/boston If you thought the publication of one major DoD cyber rule at the end of 2023 caused a lot of issues how about FIVE potential rules and two NIST revisions in 2024? This week we outline the seven rules to watch for in 2024. Listener discount code: SUMITUPBOSTON Episode Links: [Webinar] The Top 10 Questions From the CMMC Rule: https://www.summ...

Register for CS2 | Boston: https://cs2.cloud/boston This week we're joined by Alex Canizares to catch up on enforcement trends under the False Claims Act. As a former DOJ trial attorney, Alex walks us through the finer details of FCA cases and what it means for CMMC, defense contractors, and the road ahead. Episode Links: Alex Canizares: https://www.linkedin.com/in/alexandercanizares/ Perkins Coie...

The Supreme Court is set to upend decades of administrative law doctrine and it will have huge impacts on the cyber regulation landscape. In this episode we sit down with Jim Dempsey, a lecturer at the UC Berkeley Law School and a senior policy advisor at the Stanford Cyber Policy Center, to understand what SCOTUS is up to and what the heck is has to do with CMMC? Episode Links: Cyber Law Fundamen...

With five rulemaking efforts, multiple NIST revisions, and everything else going on in the DoD cyber regulation space it's hard to keep up with what's happening. In this episode we try and predict what's coming around the corner in 2024. Episode Links: Register for CS2 Boston: https://cs2.cloud/boston DoD IG Report Episode: https://youtu.be/_3GLX6ele_E?si=KKhtgbjsxiLXWVJd Stephanie Siegmann: https...

The DoD has released yet another strategy document that claims to have the answer for expanding the defense supply chain while also increasing cybersecurity requirements. Maybe this time it will be different? This week we dive into the National Defense Industrial Strategy to see if there is anything to learn about the DoD's position on the impacts of CMMC. Episode Links: Register for CS2 Boston: h...

FedRAMP moderate “equivalency” has been a thing since 2016, but DoD never really defined the term until January 2024. “The memo” has defense suppliers and the people behind their cloud apps in panic mode. In this episode we dive into what the memo says, potential reasons why, and whether equivalency will still be a thing in the future at all. Episode Links: DFARS 7012: http...

Register for the upcoming webinar; CMMC Published: A Comprehensive Overview of the Proposed CMMC Rule: https://www.summit7.us/webinars/proposed-cmmc-rule Thinking about submitting comments on the CMMC proposed rule? Not sure where to start? In this episode we go over the “commenter's checklist” from regulations.gov to help you evaluate the quality of your public comments on federal rul...

Register for the upcoming webinar; CMMC Published: A Comprehensive Overview of the Proposed CMMC Rule: https://www.summit7.us/webinars/proposed-cmmc-rule The 2023 CMMC rule was published the Friday before Christmas and most people haven’t fully digested all 234 pages yet. In this episode Jason and Jacob cover the rule at 30,000 feet so you can hit the ground running in 2024. Episode Links: ..... C...

Summit 7 CMMC Solutions: https://www.summit7.us/cmmc-level-solution-sets The DoD Inspector General released a special report comparing their contractor cyber assessment findings with their findings during DOJ false claims act investigations. No surprise, the same cybersecurity issues pop up again and again. Will this add fuel the CMMC fire? Episode Links: The IG Report: https://www.dodig.mil/repor...

There are two different CMMC rules. One rule pertains to the CMMC program while the other pertains to the CMMC contract clause. The Fall 2023 Unified Agenda is out and it provides all the details about why there are two rules and what it means for defense contractors. Episode Links: Unified Agenda: https://www.reginfo.gov/public/do/eAgendaMain . 32 CFR CMMC: https://www.reginfo.gov/public/do/eAgen...

It's Christmas time so we put together our wishlist of what we'd like to see in the upcoming CMMC rule. . For CMMC resources, solutions & more visit: https://www.summit7.us/cmmc-level-solution-sets

The November Cyber AB Town Hall was recapped the CMMC ecosystem highlights from 2023. Assessor numbers have increased, but will there be enough assessment capacity to meet demand? Episode links: Cyber AB Town Halls: https://cyberab.org/News-Events/Town-halls/Details/november-town-hall . Natty Stratty Discussion: https://youtu.be/QvaLdx_wb1U?si=pgIabPLZJpGGVDS-

OIRA's review of the CMMC rule is nearly complete and we expect the CMMC proposed rule to be published sometime between Thanksgiving and mid-December. On top of that, DoD has initiated rulemaking to revise DFARS clause 252.204-7012. In this episode we dive into the rulemaking feast.

The great and powerful Dr. Ron Ross returns to walk us through the latest drafts of NIST SP 800-171 and SP 800-171A: what they are, why they are, where they're going, and what's in store for federal contractors handling controlled unclassified information (CUI). Episode Links: . NIST Controls Deep Dive w/ Ron Ross (May 2023): https://youtu.be/vAPFmga_NtI?si=kfmdKyXaHiTCpFiq . 171r3 (Final Draft) -...

The final draft of NIST SP 800-171 revision 3 and the initial draft of SP 800-171A are out. There are simultaneously more and fewer requirements. ODPs have gone away, but not really. Problematic assumptions were reversed only to be repeated. Up is down; left is right; and the final revisions are expected in a few short months. Today we dive into the first 7 things you need to know. Episode Links:...

The final draft of NIST SP 800-171 revision 3 and the initial draft of SP 800-171A are due to be published soon. In this episode we dive into seven questions at the front of our minds before the big day. . Episode Links: . SP 800-171r3: https://csrc.nist.gov/pubs/sp/800/171/r3/ipd . Protecting CUI Project: https://csrc.nist.gov/projects/protecting-controlled-unclassified-information

Get any good candy for Halloween? The CMMC rule got a 30-day extension for the pre-publication review by the Office of Information and Regulatory Affairs (OIRA). The Cyber AB got notice that the DoD Inspector General is auditing the accreditation process for C3PAOs. In this episode we discuss why both of these things aren't as big of a deal as they might seem. Episode Links: Cyber AB Town Halls: h...

The regulatory review of the CMMC rule is coming to an end. That means we should see a published CMMC rule in the next few weeks. In this episode Jason and Jacob dive into 7 things you need to know to hit the ground running when the public comment window opens. Episode Links: CMMC rulemaking entry: https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202304&RIN=0790-AL49

The government recently released a new federal acquisition regulation that requires NIST SP 800-53 controls for federal information systems operated by contractors. Buried inside that rule are several cost estimates for implementing and maintaining SP 800-53. Meanwhile, the government has never published cost estimates for NIST SP 800-171 even though it is derived directly from SP 800-53. In this...

In this episode we dive into best practices for submitting comments on the next drafts of NIST SP 800-171r3 and SP 800-171A. We also go deep on the contours of NIST SP 800-172. Happy 1 year anniversary to the show!

Register for CS2 | Denver: https://cs2.cloud/ The biggest debate around CMMC: whether the rule should be “interim final” or “proposed”. On average it takes around a year longer for proposed rules to go into effect. This begs the question: if the 2020 CMMC rule was interim final, why wouldn't the 2023 CMMC rule be interim final as well? Has the national security justificatio...

It can be easy to lose perspective on the critical role that the CMMC program plays in the larger national defense strategy of the United States – especially if you don't work in the Pentagon. On top of that, the DoD is in full radio silence until the end of the public comment period on the upcoming CMMC rule. However, if you dig deep enough into DoD's strategy documents you'll quickly find...

Register for CS2 | Denver: https://cs2.cloud/ If you google DFARS 7021 you'll see that the CMMC contract clause has an “effective date” that isn't very old. Recently this has caused a folks to think that something has changed with CMMC before the rulemaking process has finished. In this episode we dive into what's going on with “effective date” disparities, the rulemaking p...

Register for CS2 | Denver: https://cs2.cloud/ The 2023 Federal Cybersecurity Vulnerability Reduction Act directs the government to change cybersecurity requirements for contractors. How will changes to federal acquisition regulations affect defense contractors? How many more vulnerability controls does NIST have on-deck that could be included? This week Jason and Jacob dive into what's coming arou...

The Cyber AB Town Hall for August 2023 was full of encouraging numbers. The number of people certified in various CMMC ecosystem roles continues to increase. Successful Joint Surveillance Assessments are also up and a recent Reddit post contained fascinating details about the the cost and complexity of a real-world CMMC assessment. Episode Links: https://old.reddit.com/r/CMMC/comments/15zawp6/miss...