Call us now:
NIST 171 is relatively straight forward to align to other control frameworks and will have to align to other standards if the SEC cyber proposal move ahead. Public Prime defense contractors will be required to implement cybersecurity risk management and cybersecurity programs. Risk management frameworks such as NIST SP 800-37r2 (FISMA RMF) and associated cybersecurity framework such as the NIST CSF, ISO 27001 or other standards that mitigate the risk. CSF profiles are supported by CISA and CISA has written a CSF implementation guide for the DIB. CSF profiles allow for control tailoring against business and mission objective (tailoring). Also DFARs only focuses only and CUI data and FAR on FAR data, the SEC cares about risk management and hence all data types.
The alignment of controls already exists for both defence companies and Federal Agencies, it just requires the DoD to develop the approach. Federal agencies, including the DoD already comply with NST SP 800-37, that recommends the use of NIST SP 800-53 and CSF profiles for risk mitigation.
A bigger concern for defence companies is likely to be the SEC proposal. It requires cyber risk management, governance, incident reporting and importantly board attestation of cyber compliance. Supply chain cyber is a material risk. Also the DoJ is taking an active interest in cyber and compliance regulatory enforcement, that the DIB is no doubt considering.
Thoughts Ted Dziekanowski
#cybersecurity #cyberriskmanagement #regulation #securitiesandexchangecommission
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6980564368891461633