Call us now:
There’s talk of the DoD looking at NIST CSF profiles for the DIB. The enclosed paper helps explain why the DoD should be thinking about CSF profiles, as an appropriate step forward.
FISMA is required under OMB circular A130 across Federal Government, encouraging the adoption of the Risk management Framework(RMF), and the RMF (NIST SP 800-37) enables the use of CSF profiles. The DoD is adopting the RMF through DoDi 8510.01 across all its branches using NIST SP 800-53 as its controls framework and the DoD through DFARS 252.204-7012 would like the DIB to adopt NIST SP 800-171. Sound complex, it is?
Given FISMA and the RMF are Federal wide and enable CSF profiles (OMB A130) it makes sense for the DoD to go down the road of CSF profiles. Also CSF profiles are more flexible than 171 and 53, they can address areas of strategy, risk management, business environment and can be tailored to business and mission objectives. CSF profiles are also favored by CISA, writing then for different industry sectors.
Also if the Securities and Exchange Commissions cybersecurity risk management proposal takes-off, public Prime contractors will have to implement a cybersecurity risk management program. Implementing cybersecurity controls that address the risks to their specific business environment. They will need the flexibility of a CSF to manage risk.
Ted Dziekanowski thoughts?
#csfprofiles #cybersecurity #cybersecurityriskmanagement #risk #governance #DFARS #cmmc #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6947942108276166656