Thank you for posting Chris Hughes 💭🔐. The U.S has had FISMA for over 20 years.

← Back to Blog

Thank you for posting Chris Hughes 💭🔐. The U.S has had FISMA for over 20 years. The U.S DoD adopted Dodi 8510.01(RMF for DoD Systems) and DoDi 5000.90 (Cybersecurity for acquisition decision authorities and program manager) for risk based acquisition for several years. (https://lnkd.in/e4nHdRwS).

Here is a webinar that describes the implementation and impact of DoDi 5000.90 (https://lnkd.in/e7cV2Sd3)

As with DFARS 252.204-7012 the DoD needs to ensure that Frameworks and standards are complied to.

Why does that matter? The processes needed to manage cybersecurity are not being followed, with the resulting consequences on product quality and delivery. The consequences are not the fault of the ATO process. As you point out its implementation that is at fault. It is a problem that cybersecurity faces globally, there are plenty of frameworks and standards, it is the implementation, oversight, assurance and attestation that fails.

The challenge now for the defense industry is that civilian cyber regulations and oversight is catching up. In response to addressing the national, economic and societal challenges countries face with respect cybersecurity.

The DoD has the tools to implement DoDi 8510.01 and DoDi 5000.90 and provide, oversight, assurance and attestation.

Veritas GRC  Brian D. McCarthy Rachel V. Rose, MBA National Institute of Standards and Technology (NIST) Rich M.Ed. George Sawyer Ryan Buckner

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7174346262853353472