Robert Hawes

Today’s San Antonio Chapter of CFMA lunch reminded me why cross-functional learning is one of the most underrated risk management tools we have. Here are the three insights that hit hardest for me: 1. Tax changes create security gaps. Rushed tech purchases to capture bonus depreciation or R&D credits often skip security vetting and that’s where exposure creeps in. 2. Construction firms face rising cyber risk. According to the Dodge Construction Network, 59% of construction firms experienced a cybersecurity threat over a two year period. The industry’s complexity makes it a prime target. 3. Finance + IT disconnect = avoidable risk. In most of the firms I talk to, finance leaders can’t list all of the cloud tools their project teams rely on. This is a blind spot attackers love. Takeaway: Your tax strategy, growth plan, and cybersecurity posture aren’t separate. They’re interconnected systems that can either reinforce or undermine each other. Huge thanks to Kathryn Hall, Bradley Frantz, Nita McBride, and the speaker for today's session Shelley Woitena for an outstanding CFMA meeting. Also wanted to thank Denice Allison for the introduction to the San Antonio crew. What’s an unexpected place you’ve learned something critical about your business?

6

1 Comment

Things Texas Takes Seriously: 1. Cowboy Hats 🤠 2. Not messing with it 🗑 3. Cybersecurity 🔒 Texas’s very own TX-RAMP Certification is becoming increasingly in-demand. Why? Well, Texas has done a few things right to make the cert stick: 1️⃣ It created an achievable standard based on the NIST SP 800-53 framework and provided clear use-cases. 2️⃣ It significantly reduced the audit burden on private companies. The Texas Department of Information Resources performs the certifying assessment – NOT an auditor. 3️⃣ It passed legislation requiring all vendors providing cloud-based services to Texas state agencies and higher education institutions to become TX-RAMP certified. It turns out that, when required by law to get certified or risk losing a big customer, vendors tend to get certified! We have helped a number of customers with TX-RAMP. But, we regularly get smaller companies asking us for help. We can't economically service them. Well, we couldn't... until now! We are announcing TX-RAMP Champ. TX-RAMP Champ allows small companies to get TX-RAMP certified with half the effort. We provide the templates needed, video to explain how to use the templates and access to our experts to help. Rob, that sounds amazing but I want to try it out without having to pay. Imaginary person, that's why we have a 45-day trial option to try out the tool. You can sign up from this link: https://lnkd.in/eFgAQfkx Don't want to sign up? We have a bunch of free resources for learning about TX-RAMP on our TX-RAMP Champ page. Of course, you could sign up for our TX-RAMP Complete and get all of the TX-RAMP resources including: - TX-RAMP Security Plan Workbook with Sample Answers for all Controls - Complete TX-RAMP Documentation Template Library - Complete Training Video Library - Access to one-on-one chats with U.S.-based TX-RAMP efforts - 2 live session reviews of TX-RAMP deliverables What do you think about a solution for helping with TX-RAMP? Do you know someone who is struggling with TX-RAMP and would like a speed boost? Tag them, please!!!

31

19 Comments

🚨Breaking: Bearing raises $4.5M oversubscribed seed round to bring physical security operations Into ServiceNow Bearing, a physical security operations software company built natively on ServiceNow, has closed an oversubscribed $4.5M seed round led by AZ-VC with continued backing from High Alpha and participation from PHX Ventures and Lightbank. The company is positioning itself as the first solution to embed physical security workflows, data, and asset management directly into ServiceNow, the platform trusted by more than 85% of the Fortune 500. This is a bet on platform consolidation over point solutions, bringing physical security into the enterprise system of record rather than leaving it fragmented across disconnected tools. With ServiceNow’s AI agents and Workflow Data Fabric now extendable into physical security, Bearing is riding the same convergence wave reshaping access control and broader physical security: whoever controls the platform controls the workflow. The investment will go toward team growth and accelerating AI-powered automation across physical security operations.​​​​​​​​​​​​​​​​ Cc: Jason Veiock

76

8 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

📝 Quarterly Audits: The 3 Checks That Separate Mature Programs From Reactive Ones Great security programs don’t wait for annual reviews — they run quarterly operational audits to stay ahead of risk. Here are the three areas every security leader should be reviewing every 90 days: 1️⃣ Access Control Hygiene How many active badges belong to former employees or contractors? Are permissions aligned with actual job roles? Are high-risk areas (data rooms, labs, loading docks) reviewed more frequently? 2️⃣ Camera & Sensor Uptime What percentage of your cameras were operational this quarter? Any blind spots created by maintenance, lighting changes, or construction? Are your logs capturing downtime accurately for compliance? 3️⃣ Incident Reporting Quality Are incidents being submitted within policy timeframes? Is categorization consistent across sites? Are corrective actions documented — and actually completed? Quarterly audits don’t just improve readiness — they improve credibility. They show leadership, insurers, and auditors that your security program isn’t just active… it’s disciplined. 👉 What’s the one thing you always catch during quarterly audits that surprises your team? #PhysicalSecurity #RiskManagement #SecurityOperations #Compliance #Leadership

3

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

Yes, OT threats are real, even if we don’t always see them publicly. Recent incidents like JLR and airport disruptions are reminders, but much more happens behind the scenes. As Rob said, those directly involved in incident response and threat intelligence see the reality every day, even if it’s not in the headlines. Now being part of the CPX, where we are working with the #CyberSecurityCouncil and partners to build the National OT SOC in the UAE. It’s about giving the nation visibility into OT threats and the ability to respond effectively and serving as a trusted advisor on OT cybersecurity. Ignoring these threats until they become visible can have real consequences. That’s why continuing to share insights, build resilience, and strengthen defenses together is so important.

40

Small disclosure. Big target. CISA flagged vulnerabilities in EVMAPA charging station management software (https://lnkd.in/gNeNuyCd). Three CVEs that could allow remote command execution and status manipulation. I keep coming back to the charging infrastructure angle. We talk about grid security like it's theoretical. But charging stations are physical assets with digital brains, sitting in parking lots and highway stops across the country. An attacker who can spoof charging station statuses creates interesting problems. Fleet managers making decisions on bad data. Drivers stranded with vehicles that won't charge. Commercial operations grinding to a halt because the charging network looks functional when it's not. The advisory doesn't specify which charging networks use EVMAPA. That gap bothers me. We're asking facility managers and fleet operators to secure infrastructure they might not even know they have. Electric vehicle adoption accelerated faster than our security frameworks could keep pace. Now we're patching vulnerabilities in systems that didn't exist five years ago but handle critical operations today. Still working through what this means for physical site security when the charging infrastructure becomes unreliable. #GreyShield #CriticalInfrastructure #OTSecurity #Security #ThreatIntel

1

DFARS 7012 requires contractors to implement NIST SP 800-171 to protect Covered Defense Information (CDI). DFARS 7019/7020 requires contractors to perform a basic assurance self-assessment and submit a score to SPRS that is within 3 years of contract award. DFARS 7021 specifies the CMMC level required to be awarded a DoD contract. CMMC levels require either self-assessment or third-party assessment. When making the determination of the level required for a contract, there is a memo that outlines the process that must be followed by the DoD program manager to obtain a waiver to "CMMC assessment requirements" for that contract. "Program Managers and requiring activities should identify information security requirements for the types of information most likely to be associated with the planned contract effort. When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the SAE, CAE, or DAE may approve requests to waive inclusion of CMMC assessment requirements. SAEs and CAEs must carefully weigh the risk of potential loss of CUI associated with mission critical capabilities before granting a waiver." Level 1 - "There are no circumstances likely to warrant approval of requests to waive CMMC Level 1 requirements." Level 2 - "In rare circumstances. such as when seeking competition from non-traditional DoD sources. waivers may be warranted for CMMC Level 2 third-party assessment requirements. Such waivers are not appropriate for contracts requiring performance by a cleared defense contractor. Approved waivers on a class basis must include a planned expiration date and guidance for requiring CMMC certification in subsequent solicitations." Level 3 - "In rare circumstances, waivers may be warranted for CMMC Level 3 third-party assessment requirements: such waivers, however, are not appropriate for contracts or work statements requiring access to both unclassified and classified DoD information." Full memo on the process found here, starting on page 6: https://lnkd.in/eeBCW53n #cmmc #dib #dfars

58

12 Comments