Bill Sieglein

This is a fantastic resource and a well done document. There is a new CMMC FAQ. One question in the new FAQ stuck out to me: "Q4. Can Department contractors implement NIST SP 800-171 Revision 3? A4. Yes. Companies can implement Revision 3 but must use the Department’s Organization-Defined Parameters (ODPs) defined in the April 2025 memorandum, “Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3” found here: https://lnkd.in/eN5pnTzB. Because CMMC Assessments will be conducted against Revision 2 until the class deviation memo (Q3 of this section) is withdrawn or otherwise superseded, DIB companies must ensure any identified gaps between Revision 2 and Revision 3 are addressed." We won't know exactly when the class deviation will removed and CMMC will be on 800-171 Rev 3, but if you want to get a headstart you are permitted to implement Rev 3 if you use the DoD's Organizationally Defined Parameters (ODPs). I will note that the ODPs are subject to change during the rulemaking process. #cmmc

8

Policies matter - but only if they align with daily operations and are backed up by records. Without that alignment, even the most detailed documents don't hold up in an audit. Do your policies reflect what your people actually do day to day? Download the CMMC Desktop Reference Guide. It gives you a simple way to compare what's written against what's happening. It's the fastest way to see if you're aligned or if you're carrying risk into your audit. https://lnkd.in/gTP5PTKg #CMMC #audit #compliance #securedata

1

Those of us in the CMMC Ecosystem are anxiously awaiting the publication of the final version of the United States Department of Defense's updates to DFARS 252.204-7021! When that happens, it will set in motion the long-awaited Cybersecurity Maturity Model Certification ("CMMC") Program. Once the CMMC Program is "live", 200,000+ companies will need to demonstrate their compliance with appropriate CMMC requirements before they can be awarded a DoD contract (or subcontract). This will create a HUGE demand for CMMC-related services. People holding the CMMC Certified Professional ("CCP") certification have undergone extensive training and have passed a difficult and comprehensive examination to validate that they understand the CMMC program's requirements. Aside from CMMC Certified Assessors ("CCAs"), CCPs are some of the best-qualified persons to be helping defense contractors meet their CMMC requirements. There are currently only about 1,000 people worldwide who have earned CCP certifications. When the CMMC Program takes effect, we will need a LOT more CCPs to help meet market demand. From internal employees to external consultants, CCPs play mission-critical roles in the CMMC Ecosystem and in helping their organizations stay competitive in a rapidly changing business climate. Are you ready to take your career to new heights by becoming a CCP? If so, be sure to register for Ascend Cyber's October 2025 CCP course! We might even have a guest appearance by Matthew Titcombe! For more details and to register, visit https://lnkd.in/eEt_UT48

14

Exploitation timelines are increasingly measured in days rather than weeks. Our latest report from Rapid7 Labs correlates vulnerability publication data, confirmed exploitation trends, frontline MDR incident response telemetry, and dark web, cybercrime, and nation-state intelligence to provide a unified view of how exposure evolves into compromise. One of the biggest standouts: how rapidly AI is being integrated into attacker playbooks, accelerating the operationalization of exposure. Many of the incidents we investigate still originate from known, unaddressed exposure. In those cases, attackers don’t need sophistication - they need opportunity. As remediation windows shrink, reducing that opportunity becomes essential to limiting compromise. You can download the 2026 Global Threat Landscape report here: https://r-7.co/4bQOAtq #infosec #cybersecurity

37

1 Comment

CMMC 2.0 is mostly about sustaining compliance across daily data workflows. In “The Executive’s Guide to Sustaining CMMC Compliance Across Data Workflows,” Danielle Barbour from Kiteworks highlights why compliance erosion happens after certification, and how leaders can prevent it. 3 key facts: 🔹 Legal exposure is real. Non-compliance tied to DFARS 252.204-7012 can trigger penalties under the False Claims Act, with enforcement driven by the U.S. Department of Justice. 🔹 CMMC Level 2 = 110 practices aligned to NIST 800-171. The Department of Defense requires ongoing assessments. 🔹 Most compliance fails in workflows. File sharing, email, APIs, and third parties often drift outside documented scope, creating hidden risk. The takeaway: Treat CMMC as a continuous operating model, govern how data moves, automate evidence, and validate controls between audits. ⬇️To learn more, read the full guide here⬇️ #ad #Kiteworks #Compliance #Workflows

12

2 Comments

Is there a gap between your vulnerability management policy and your team's actions? Our latest article on enhancing Remediation Policies and SLAs might be the key. By aligning your practices with industry benchmarks, you not only create accountability but also shape your remediation efforts to be consistent and timely. Discover how to define critical components and benchmark your SLAs to stay ahead of the curve in security. #CyberSecurity #ITbestPractices #RiskManagement #CloudSecurity #VulnerabilityManagement #SLA #EnterpriseSecurity #DataProtection https://lnkd.in/eNUe8z2w

1