Omer F. Hazarbuz

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

Day 52/ CISA mock question 52: In a small organization, developers may release emergency changes directly to production. Which of the following will BEST control the risk in this situation? A. Approve and document the change the next business day B. Limit developer access to production to a specific timeframe C. Obtain secondary approval before releasing to production D. Disable the compiler option in the production machine #aswinisrinath #infosec #cisastudygroup #CISAexamprep #CISA #infosecurity #informationsecurity #cybersecurity #cisacertification #CISAaspirants #dailyCISAquestion #CISAQuestionOftheday #CISAin100

9

20 Comments

CISA Requests Public Comment for Updated Guidance on Software Bill of Materials: CISA released updated guidance for the Minimum Elements for a Software Bill of Materials (SBOM) for public comment—comment period begins today and concludes on October 3, 2025. These updates build on the 2021 version of the National Telecommunications and Information Administration SBOM Minimum Elements to reflect advancements in tooling and implementation.   An SBOM serves as a vital inventory of software components, enabling organizations to identify vulnerabilities, manage dependencies, and mitigate risks. The update refines data fields, automation support, and operational practices to ensure SBOMs are scalable, interoperable, and comprehensive.   Stakeholders are encouraged to provide feedback via the Federal Register during the public comment period. This feedback will contribute to refining SBOM practices, enabling CISA to release an updated version of the minimum elements.    https://lnkd.in/gCFBiCAP

1

𝐓𝐡𝐞𝐫𝐞 𝐢𝐬 𝐧𝐨 𝐮𝐧𝐢𝐯𝐞𝐫𝐬𝐚𝐥 𝐂𝐌𝐌𝐂 𝐝𝐞𝐚𝐝𝐥𝐢𝐧𝐞. 𝐀 𝐂𝟑𝐏𝐀𝐎 𝐚𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭 𝐢𝐬 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐝 𝐨𝐧𝐥𝐲 𝐰𝐡𝐞𝐧 𝐚 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭𝐢𝐧𝐠 𝐨𝐟𝐟𝐢𝐜𝐞𝐫 𝐢𝐧𝐜𝐥𝐮𝐝𝐞𝐬 𝐢𝐭 𝐢𝐧 𝐚 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭 𝐨𝐫 𝐬𝐨𝐥𝐢𝐜𝐢𝐭𝐚𝐭𝐢𝐨𝐧. I keep seeing vendors and #C3PAOs pushing #CMMC misinformation relating to a "deadline" for obtaining a CMMC Level 2 (C3PAO) assessment. Until November 9, 2028, CMMC requirements may appear in a solicitation or contract only if the contracting officer determines that a specific CMMC level is required. Starting November 10, 2028, contracting officers may include CMMC when a contract involves contractor systems that process, store, or transmit FCI or CUI. Bottom line: CMMC obligations are contract-driven, not calendar-driven. #CMMC #FederalContracting #GovCon #CyberCompliance #DoDContracts #DefenseIndustrialBase

42

20 Comments

If you work in GRC, frameworks aren’t checklists — they’re operating models for risk. Here’s the quick guide: • NIST CSF – Structure your security program • NIST 800-53 – Deep control catalog • ISO 27001 – Build & certify an ISMS • SOC 2 – Customer assurance reporting • HIPAA – Protect regulated health data • COBIT – Align IT with executive governance • PCI-DSS – Secure cardholder data • GDPR – Operationalize data privacy How to apply them: Identify legal & contractual drivers Map overlapping controls Build one unified control matrix Test effectiveness — not paperwork Frameworks overlap. Strong GRC teams harmonize — not silo. Which one drives your workload right now? #GRC #CyberSecurity #RiskManagement #Compliance #NIST #ISO27001 #SOC2 #GDPR #Governance

76

1 Comment