The legislative path for CMMC won’t become clear until requirements enter DFARS at some point in 2020 or maybe early 2021. Until then the programme continues through its planning to develop training materials, assessor guides and accreditation processes. Whether or not you believe it will happen or it will not, what is clear is that …
Research of ransomware attacks in the US identified 966 US government agencies, educational establishments and healthcare providers were impacted by ransomware in 2019. The figures for the year to date (April) for 2020 is showing a much reduced number for the public sector. The report obviously attributes this to COVID-19. With many services now off-line …
CMMC is being driven forward by the US DoD as the standard for Cyber Security oversight and assurance across it’s Defence Industry Base (DIB). With between 300,000 and 350,000 companies in the supply chain, ranging from SMEs up to large corporates will be impacted by the programme. 5 levels of maturity certification have been defined …
Christopher Wray, the head of the FBI targets China as being the biggest threat to US information and intellectual property. In a no holes barred speech and direct reference to the targeted use of cyber by China for the theft of US IP and an example of the overt use of geopolitical cyber. A reason …
Governments need to show stronger leadership for cyber regulation. “The government needs to get involved… there will be more regulation of the tech sector”, Bill Gates, co-founder of Microsoft, said in October 2019 to the Bloomberg news agency. A bit earlier, Facebook founder and CEO Mark Zuckerberg publicly voiced the same idea. The regulatory road in the tech space will be …
The Lazarus group have been identified as the primary candidate for targeting European and Middle East aerospace and military businesses. Targeting employees through LinkedIn, for espionage. The attacks are well thought through and orchestrated (you’d expect as much if you’re targeting the employees of aerospace and military companies), and what better platform to use for …
I don’t foresee the biggest challenge for CMMC being defining the rules, guidance and certification. The biggest challenge as with all cyber security programmes, will be implementation and finding cyber experts. There are simply not enough experienced resources in the market place. DFARS has been specific in its requirements for NIST 800 – 171 r2 …
A recent US report (2020) from the Solarium Commission highlights a number of federal issues for cyber security in the US. Should government take the lead in cyber security risk modelling and certification? Cyber attacks have resulted in significant losses of IP, data theft and the consequential financial damages associated with ransomware, as one threat …
The CMMC programme is taking shape for US DoD procurement and its implementation across the Defence Industry Base (DIB). If and when CMMC gets embedded in to the release of DFARS (defence procurement regulation) it will formalise cyber security requirements on defence suppliers. The MOU released by the US DoD clarifies the responsibilities of the …