Jonathan Fisher, CISSP

DCMA audit issues rarely come from missed calibration. They come from how calibration is documented. Our latest article breaks down what DCMA auditors actually look for in calibration records, common documentation gaps that trigger findings, and how to stay audit-ready year-round. If you support DoD or DCMA programs, read the article: https://lnkd.in/gpp8XfBV

2

The DoD just issued its first formal RFI to overhaul the Risk Management Framework (RMF). As someone who’s worked in the trenches of RMF for years, let me be blunt: RMF has become a glorified paper drill. We spend more time wordsmithing control implementation statements than actually hardening systems. Meanwhile, our adversaries aren’t attacking our documentation; they’re exploiting real, technical vulnerabilities. If DoD is serious about modernizing RMF, here’s a hard truth: We don’t need more paperwork. We need proof our systems can survive a real-world attack. My pitch? Establish elite Red Teams that continuously stress-test DoD systems, feeding real findings into the RMF lifecycle. Combine that with automation, telemetry, and AI to validate controls in real time. Call it Live Fire RMF: adversary-informed, outcome-driven, risk-aware. RMF should be a warfighting discipline, not a documentation exercise! I’m encouraged by this RFI and ready to help shape what comes next. Let’s build a framework that defends at the speed of the mission. #RMF #CyberSecurity #DoD #AI #RedTeam #ContinuousATO #LiveFireRMF #FedCyber #RiskManagement #ZeroTrust https://lnkd.in/eGEJMjFJ

13

After CISA flagged CVE-2025-6813 as actively exploited, agencies and organizations are racing to update systems and audit stored credentials. #clearancejobs #nationalsecurity

2

HSP Adds FedRAMP Assessment and ATO Readiness Services [10/20/2025] — HSP has expanded its cybersecurity and compliance portfolio to include FedRAMP Assessment and Authorization to Operate (ATO) Readiness Services. These services encompass both legacy and cloud-native security assessments designed to evaluate and manage the ATO process, ensuring automated monitoring and enforcement of commercial security standards that meet federal information system requirements. HSP’s CISO team, each with over 20 years of quality, compliance, and cybersecurity leadership, helps organizations streamline their path to FedRAMP authorization—driving efficiency, reducing costs, and accelerating time to compliance. Our experts partner with clients to develop, document, and achieve FedRAMP milestones, managing the full lifecycle of readiness and audit activities to ensure success across federal and highly regulated commercial environments.   HSP Regulation and Standards Alignment (2025) HIPAA – including the SRA review; GDPR (UK and EU) and Transfer Impact Assessment; Australian Privacy Principles; California Consumer Privacy Rights Act (CCPA and CPRA); Cloud Controls Matrix (CCM); NIST 800-53r5, NIST 800-171, NIST 800-63; Consensus Assessment Initiative Questionnaire (CAIQ); Digital Operational Resilience Act (DORA); CAP AI Assessment (EU AI Act); Vendor Security Alliance (VSA); CIS Level 2 and STIG configuring standards; Higher Education Community Vendor Assessment (HECVAT)

4

CMMC and ITAR requirements continue to surface for companies working in or entering the defense space. Most teams aren’t resistant to compliance, and readiness isn’t about rushing. It’s about structure, clarity, and alignment across people, systems, and workflows. This carousel breaks down what we see most often, and where to start before making major changes. 

5

Defense contractors aren't the only ones who need to implement NIST cybersecurity requirements for CUI. The big question has always been whether other agencies would require proof of implementation via the CMMC program. The GSA just revised their process for assessing nonfederal systems handling controlled unclassified information and it's way closer to NIST's Risk Management Framework than CMMC. Get the full scope in this week's episode ⬇️

34

6 Comments

DFARS 252.204-7021 & CMMC 2.0: What Defense Contractors Must Know The DoD’s proposed updates to DFARS 252.204-7021 make CMMC 2.0 certification a contractual requirement for handling FCI or CUI. Key changes include: ✅ Certification or self-assessment at the required level for the entire contract period ✅ 72-hour reporting for any certification changes or security lapses ✅ Annual affirmation of continuous compliance via SPRS ✅ New solicitation provisions requiring explicit CMMC level notice before award ✅ Flow-down of CMMC obligations to subcontractors With a phased rollout beginning in 2025 and full enforcement expected by 2028, now is the time to prepare. Stay ahead: this article breaks down the clause changes and offers actionable guidance for your CMMC strategy. 👉 Read the full guide: https://hubs.ly/Q03zPBvF0

4

DFARS 7012 requires contractors to implement NIST SP 800-171 to protect Covered Defense Information (CDI). DFARS 7019/7020 requires contractors to perform a basic assurance self-assessment and submit a score to SPRS that is within 3 years of contract award. DFARS 7021 specifies the CMMC level required to be awarded a DoD contract. CMMC levels require either self-assessment or third-party assessment. When making the determination of the level required for a contract, there is a memo that outlines the process that must be followed by the DoD program manager to obtain a waiver to "CMMC assessment requirements" for that contract. "Program Managers and requiring activities should identify information security requirements for the types of information most likely to be associated with the planned contract effort. When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the SAE, CAE, or DAE may approve requests to waive inclusion of CMMC assessment requirements. SAEs and CAEs must carefully weigh the risk of potential loss of CUI associated with mission critical capabilities before granting a waiver." Level 1 - "There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements." Level 2 - "In rare circumstances. such as when seeking competition from non-traditional DoD sources. waivers may be warranted for CMMC Level 2 third-party assessment requirements. Such waivers are not appropriate for contracts requiring performance by a cleared defense contractor. Approved waivers on a class basis must include a planned expiration date and guidance for requiring CMMC certification in subsequent solicitations." Level 3 - "In rare circumstances, waivers may be warranted for CMMC Level 3 third-party assessment requirements: such waivers, however, are not appropriate for contracts or work statements requiring access to both unclassified and classified DoD information." Full memo on the process found here, starting on page 6: https://lnkd.in/eeBCW53n #cmmc #dib #dfars

58

12 Comments