Gary Tabach

CMMC Compliance for Defense Contractors: How Cyber Ballet Can Help You Get Ready The Department of Defense's CMMC program is now in Phase 1 implementation. Learn what defense contractors need to know about the three-tier certification model and how Cyber Ballet's training programs can help you achieve compliance. #TechTraining #FutureOfWork #DigitalTransformation

2

Great piece from Col Pete Roongsang. I guarantee many SC practitioners are already leveraging commercial AI and LLM models to streamline administrative tasks and improve data gathering, but we are currently operating in a fragmented environment. To truly realize AI's potential for the SC enterprise, we need a standardized, official system. Such a platform must provide robust data protections and utilize Retrieval-Augmented Generation (RAG) to access the breadth of authoritative, internal data that remains inaccessible to public models. (also, an excellent point mid article that RAND studies would be an excellent source to include in such a system 😉) #SecurityCooperation #DigitalTransformation #FAO #DSCA #DSCU

5

1 Comment

Our new Defense Tech Monthly is out. It highlights the challenges we face on the battlefield today — and the innovations that are being built to overcome them. Thanks to Viktoriia Honcharuk, Head of Defense Tech at Snake Island Institute and her team for putting this record together and making these challenges visible to the world. Why is Ukraine the place where defense technologies evolve so fast? Because we are fighting for survival. If we don’t learn how to counter Shaheds, we die and lose this war. We’ve found interceptors to stop them. Now it’s a matter of scaling — until we reach the point where every Shahed can be neutralized. And one day, we will intercept all of them — not just with interceptors alone. The new challenge is the Shahed-238 — a jet-powered version, where current electronic warfare is much less effective. Ukrainian engineers are back at the chessboard, developing solutions. Whether it will be a new type of spoofing, lasers, or layered defenses — time will tell. But the lesson is clear: support innovation in Ukraine. Because these innovations may be the key to defending the Western world in future confrontations with China.

7

CMMC Is Now in DFARS – What This Means for Industry The Program Office drives the CMMC Level based on the classification of the DATA. As a contracting officer, I want to ensure our industry partners clearly understand what just happened. On September 10, 2025, DoD issued the final rule for DFARS Case 2019-D041: Assessing Contractor Implementation of Cybersecurity Requirements. This rule formally incorporates CMMC 2.0 into the DFARS, effective November 10, 2025. For anyone doing business with DoD—and specifically with SOCOM—this is no longer “in development.” CMMC is now law in regulation. What this means for contractors: • CMMC Level will be dictated by the data. If your contract involves Federal Contract Information (FCI), expect a Level 1 requirement. If you handle Controlled Unclassified Information (CUI), a Level 2 or higher requirement will apply. • No award without compliance. Before contract award, option exercise, or performance extension, your CMMC status must be current in the Supplier Performance Risk System (SPRS). • Annual affirmation is required. A senior company official will have to certify compliance each year. • Flow down matters. Subcontractors handling FCI or CUI must meet the same requirements. What you should be doing now: • Conduct a NIST SP 800-171 self-assessment and post your score in SPRS. • Identify what CMMC level your systems must meet based on the sensitivity of the data you handle. • Begin remediation of gaps now—waiting until solicitation release will be too late. • If Level 2 certification is anticipated, engage with an authorized C3PAO for third-party assessment. • Talk to your subcontractors—your compliance is only as strong as your supply chain. Cybersecurity is now a baseline requirement for doing business with SOCOM. Just as we assess cost, schedule, and performance, we will also assess your ability to protect mission data. This is where acquisition and industry must work together: protecting our nation’s information is just as critical as delivering equipment and services on time. https://lnkd.in/ensCS98D #DFARS #CMMC #Cybersecurity #SOCOM #Acquisition #Contracting

51

3 Comments

Earlier this month at #DEFCON33, U.S. Coast Guard LCDR Miltenberger and LCDR Fredericksen presented “From Shanghai to the Shore The Silent Threat in Global Shipping,” which explored the vulnerabilities of ship-to-shore (STS) cranes manufactured in China, and the risk they pose to the Marine Transportation System (MTS). This risk is just one of the driving factors behind @Booz Allen Hamilton’s collaboration with the @McCrary Institute for Cyber and Infrastructure Security on the report “Anchored in Zero Trust: Taking Action to Create Resilient U.S. Port Infrastructure.” Applying Zero Trust concepts to Operational Technology (OT) systems can help ensure the U.S. proactively defends critical infrastructure and better secures its national security and economic interests. Read the report, Anchored in Zero Trust at https://lnkd.in/ejkT7SgK or check out the Anchored in Zero Trust ‘Fast Facts’ at https://lnkd.in/eBEaxUu6. DEFCON slides: https://lnkd.in/e3Bj3UKz   #Maritime #Ports #CriticalInfrastructure #Cyber #ZeroTrust #OT #NationalSecurity Booz Allen Hamilton McCrary Institute for Cyber & Critical Infrastructure Security #USCoastGuard

29

1 Comment