Bart Gasiorowski, MBA

This is a fantastic resource and a well done document. There is a new CMMC FAQ. One question in the new FAQ stuck out to me: "Q4. Can Department contractors implement NIST SP 800-171 Revision 3? A4. Yes. Companies can implement Revision 3 but must use the Department’s Organization-Defined Parameters (ODPs) defined in the April 2025 memorandum, “Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3” found here: https://lnkd.in/eN5pnTzB. Because CMMC Assessments will be conducted against Revision 2 until the class deviation memo (Q3 of this section) is withdrawn or otherwise superseded, DIB companies must ensure any identified gaps between Revision 2 and Revision 3 are addressed." We won't know exactly when the class deviation will removed and CMMC will be on 800-171 Rev 3, but if you want to get a headstart you are permitted to implement Rev 3 if you use the DoD's Organizationally Defined Parameters (ODPs). I will note that the ODPs are subject to change during the rulemaking process. #cmmc

8

When envisioning cybersecurity futures, consider these core variables: * Attack Surface: Is it expanding or shrinking? * Attacker Effectiveness: Are threats becoming more successful? * Defender Effectiveness: Are defenses keeping pace with evolving threats? These variables, explored in my upcoming book, Cybersecurity Futures Playbook, offer a framework for strategic planning. How could these concepts be applied in your work? #Cybersecurity #FutureofCybersecurity #ThreatIntelligence #CybersecurityStrategy

1

The Keystone Pro Cybersecurity Vendor Assessment app has also now finished being upgraded. 😃 The calculation engines, validation modules, shared utility libraries, real-time scoring algorithms, and conditional logic processors...all improved. And there's more. The system now analyzes eight distinct risk categories simultaneously, scoring vendors across 20+ individual factors, such as: ➡️ Data Sensitivity Layer: Distinguishes PHI (HIPAA), PCI (PCI DSS 4.0), biometric data (GDPR Article 9, BIPA), and PII with regulatory-weighted exposure ➡️ Geographic Complexity Matrix: Evaluates GDPR international transfer requirements, CCPA large-scale processing thresholds, multi-jurisdictional compliance burden ➡️ Processing Scale Analysis: Maps to GDPR and CCPA triggers for Data Protection Impact Assessments ➡️ Access Level Taxonomy: Categorizes vendor system access from none to administrative privileges per ISO 27036-1 supplier relationship standards ➡️ Operational Criticality Assessment: Evaluates business impact if vendor fails (mission failure vs. inconvenience) and Recovery Time Objectives And more. The methodology isn't claiming absolute "correctness." It's defensible because it's transparent, repeatable, and standards-aligned. This app will be featured as part of my presentation this coming Thursday at the 2026 Midwest Data Privacy and Cybersecurity Summit. Interested in seeing a demo? DM me.

1

One of the things commonly overlooked in Cybersecurity is the proper disposal of physical devices and paper. Don't let your proprietary or confidential information leak when it could have been easily prevented.

6