Call us now:
The UK Government has £880k (excluding VAT) to spend on proposals to help reduce cyber risk across defense.
I have a proposal for the MoD to manage cyber risk.
1. Oversight and implement DFARS 252.204-7012. The DoD cybersecurity standard that U.S defense contractors and subcontractors have been required to comply since 2017. Requiring the implementation of the NIST SP 800-171. The DoD is looking to implement DFARS 252.204-7021 (CMMC), requiring an independent audit of NIST compliance. At risk losing a DoD Contract (no CMMC certificate, no contract).
2. Implement an equivalent to FISMA. The DoD is required to comply with FISMA under DoDi 8510.01. FISMA requires the DoD to assess all risks on a defense weapon system before an Authorizing Officer(AO) signs and Authorization to Operate (ATO). This includes cyber risk.
The Securities and Exchanges Commissions cyber rule is effective this week. U.S prime contractors that are SEC market registrants are required to comply to the rule, demonstrating adequate material cyber risk management. The SEC adheres to FISMA, one considers FISMA an adequate cyber risk compliance framework.
Advantages
1. My proposal is off the shelf, all regulations and standards are written and U.S and EU cyber regulations require adherence to cyber risk frameworks and standards.
2. The SEC final rule is here and will effect U.S defense contractors and their suppliers, that includes UK defence contractors.
3. DFARS has been a requirement since 2017. CMMC looks to be formalized in FAR regulation in Q4 2023. Requiring UK covered contractors to undergo a CMMC audit, lose a contract or the MoD prove reciprocity of cyber standards.
4. Canada is implementing its version of CMMC, to support its industry win DoD contracts. Australia and New Zealand support NIST cyber standards. The UK?
5. It harmonizes cyber risk management with our allies. The U.S spends a lot of money on cyber that UK industry relies. We face the same threats. The cyber frameworks and standard are not unreasonable and being regulated.
6. I received a U.S Presidential Volunteer Service award for my work on the CMMC program, sounds exciting but demonstrates the effort we put into the CMMC. I’ve been involved in cyber and risk for a few years and have written and published a few papers on how to manage cybersecurity and cyber risk.
Ted Dziekanowski thoughts?
#cybersecurity #cyberriskmanagement #cyberregulation #defense
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7105629051381268481