Sasan Hamidi

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

The evolving cybersecurity landscape driven by political reshuffling and strategic reorientation could redefine the boundaries between public and private cyber defense responsibilities. For the tech community, the warning is clear: adapt quickly to maintain resilience, secure federal contracts, and safeguard critical infrastructure in an environment where political alignment may increasingly influence cybersecurity collaboration.

2

1 Comment

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana W. for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

214

19 Comments

Digital asset scams are the #1 threat again and they’re getting slicker. For the third year running, digital assets ranked as the leading threat to investors, according to an enforcement report from NASAA (the association of state securities regulators). Why RIAs should care? Scammers increasingly name-drop real custodians, advisors, or regulators to look legit. Pitches are now AI-written and paired with polished apps/sites that bypass basic “this looks fake” filters. Even when clients act independently, firms face reputational and complaint risk if your name or logo gets impersonated. 3 Highlights from the NASAA 2025 Enforcement Report) 1. State regulators ran 8,833 investigations and 1,183 enforcement actions in 2024, securing $259M+ in monetary relief and significant criminal penalties. 2. Digital-asset schemes dominated, alongside social-media investment rooms, advisor/firm impersonation, and pig-butchering (200+ new investigations). 3. Seniors remain a prime target, with 3,600+ complaints and hundreds of victims, largely tied to crypto, pig-butchering, and promissory notes. #cybersecurity #RIA #investorfraud #regulatoryupdates #AdvisorDefense https://lnkd.in/ePawYU38

5

What are the "top" ATT&CK techniques? In this brief video, I explain why the answer - at least in the context of managing risk - isn't so simple.

68

2 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

Unseen exposures cost more than you think. We routinely see delayed discovery add 3–5x remediation time and multiply breach impact — lost revenue, regulatory fines, and long investigations. With OSM’s continuous AI-driven monitoring, organizations cut escalations, gain a predictable risk posture, and simplify compliance reporting. Our analytics prioritize critical fixes, shorten response cycles, and deliver repeatable evidence for audits. Ready to turn unknowns into measured risk? Learn how: https://wix.to/oSdgdHW #Cybersecurity #RiskManagement #Compliance

2