Last week the U.S DoD issued its Defense Industry Base (DIB) cybersecurity strategy.

← Back to Blog

Last week the U.S DoD issued its Defense Industry Base (DIB) cybersecurity strategy. It makes for an interesting read and raises many questions for defense contactors and highlights the complexity of cybersecurity risk management between the DoD and DIB.

The DoD has had years in which to demonstrate its management of cybersecurity risks. From the early days of FISMA in 2002, 2014, DFARS 252.204-7012 in 2017. DFARS 252.204-7019 and 7020 in 2019, up to more recent developments with CMMC and DFARS 252.204-7021, and Zero trust. The DoD has had options to manage cybersecurity. One wonders the opportunities where the DoD can claim success in its oversight, assurance and management of cybersecurity risks. Much of what is in the recent strategy hangs off previous regulations and announcements made by the OMB, ONCD, DHS, CISA and State Department.

At a time when U.S agencies are moving quickly to regulate cyber with carrots and sticks, in line with international partners. One asks is the DoD saying anything new? There are very few definitive words used in the strategy, but subjective statements such as we will ‘evaluate’, ‘improve’, ‘leverage’.

It’s positive to see the DoD reference the use of NIST and the Cybersecurity Framework (CSF) to provide alignment with international standards. The CSF is referenced within FISMA, that the DoD has been working to implement through DoDi 8510.01 and DoDi 5000.90 for several years.

One has asked many times how the DoD will oversight the international Defense Industry Base (DIB). A DIB the DoD relies upon to create, manage and store critical weapon systems IP. A question that requires an answer as CMMC approaches, and there are not enough qualified assessors to oversight and assure compliance and international cyber standards do not offer reciprocity.

The West relies on the U.S and DoD for advanced weapon systems, and to take a lead in NATO. With cyber a credible threat to National Security one wonders if more could be done to address cybersecurity risk management, at a time when other federal Agencies are taking a robust stance?

@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Bob Dix Gerry Kennedy Rich Waite, M.Ed. George Sawyer United States Department of Defense National Defense ISAC

Veritas GRC

#cybersecurity #cyberriskmanagement #cyberinsurance #defense #defenseindustrybase

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7180854392428888064