Michael Young CISM CISA

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

The state of Rhode Island publicly released the results of a third-party analysis of the 2024 RIBridges cyberattack and data breach at a press conference with Rhode Island Governor Dan McKee and Chief Digital Officer Brian Tardiff. Cybersecurity company CrowdStrike conducted the analysis, which revealed the five-month timeline of the breach and a more accurate number of impacted individuals -- approximately 644,401 people. RIBridges is a system run by Deloitte that the state of Rhode Island uses to administer important social services benefits like health insurance, food stamps and the Child Care Assistance Program. As previously reported, Deloitte informed the state of a potential security threat to RIBridges on Dec. 5, 2024, stating that there was a high probability that a cyberthreat actor had obtained files containing sensitive information. The Brain Cipher cyberthreat group later took responsibility for the hack. The state took RIBridges temporarily offline and later sent notification letters to nearly 650,000 individuals. The newly released third-party analysis provided clarity on how the cyberthreat actor gained access to the RIBridges environment and how it performed data access, staging and exfiltration activities on 28 RIBridges systems. Reviewing post-incident analyses of healthcare data breaches can help defenders bolster security efforts. https://lnkd.in/gBJR5kBh

7

CISA and ACSC have issued new guidance on acquiring, deploying, and managing SIEM and SOAR platforms. Follow the link below to learn more! https://lnkd.in/eynnybeU

3

Thanks to Mariam Baksh at Inside AI Policy for reporting out on Alliance for Trust in AI view on NIST’s “zero draft” on AI testing standards (TEVV). A few high level points: 📈 Standards should be flexible to accommodate the wide number of actors working on AI, from non-profit and academic labs to startups and massiv enterprises. 🔨 There must be acknowledgment of the clearly defined roles between developers, deployers, integrators and end users. 📚We should align to existing standards and not throw ok progress already made through efforts like the NIST AI RMF or sector specific guidance in health, finance and OT. ✅Standards should be practical and context dependent. Too many efforts to build policy around AI focus on the technology as absolute. Check out their breakdown and other great reporting on the #AI #policy space.

3

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

CISA just released updated guidance for its Software Bill of Materials (SBOM) Minimum Elements, and they're looking for public comment! ✍️ This is a great opportunity to help shape the future of cybersecurity. An SBOM is a critical tool for identifying vulnerabilities and managing risks in software. Key Details: What: Updated guidance on SBOM Minimum Elements. Why: To reflect advancements in tooling and implementation since 2021. What's new: Refined data fields, automation support, and operational practices. How to contribute: Provide your feedback via the Federal Register or CISA's anonymous survey by October 3, 2025. https://lnkd.in/d58ts98t Sharing your expertise can help make SBOMs more scalable, interoperable, and comprehensive for everyone. Let's contribute to a more secure digital world! 🌎 #cybersecurity #CISA #SBOM #infosec #riskmanagement

1

For those of you navigating CRA & RED-DA compliance… this one’s worth a read. For many years product security compliance was treated like a checklist exercise something to rush through right before launch. CRA and RED-DA changed that. Today, compliance isn’t optional, and treating it as a one-off task is a recipe for delays, lost trust, and missed opportunities. My colleague David Nosibor shares how the PSCOPE Maturity Framework can flip the script turning regulatory compliance into a continuous operational capability that drives performance, scalability, and trust. Instead of chasing PDFs and scrambling for evidence, PSCOPE builds shared language, measurement, and maturity across governance, automation, supply chain, and monitoring. I strongly believe that this is exactly the kind of shift our ecosystem needs. https://lnkd.in/eBudy-wk #CyberSecurity #CRA #RED #Compliance #ProductSecurity #PSCOPE #ContinuousCompliance #CyberResilience #IoT #Regulations #CyberPass

20

1 Comment

In a recent #ISACA blog authored by Richard Beck, he shares how aligning with ISO 42001 will help unlock your AI strategy to enable growth. Read more: https://lnkd.in/gihejx3N

1

Shawn Murphy and Jeff Cassidy, CISSP explain how threat hunting fits into the “Left of Bang” strategy and mindset, a driving principle of WEI’s deep cybersecurity practice. @CyberTrust Massachusetts 💡 Listen to the full #podcast episode here: https://lnkd.in/eYGXQfmz

4