Call us now:
The U.S. has plenty of cybersecurity and risk management standards, that are aligned to FISMA and OMB A-130. FISMA has been adopted by he DoD under DoDI 8510.01 with derivatives across DoD branches and NIST SP 800-30, 800-37 and 800-39 all set out processes for the assessment of risk. They are all aligned which is the problem, as it creates complexity that needs to be unwound.
The challenge is that the DoD is at a cross road, a cross road that industry sectors such as Financial Services had to deal with the implementation Basel Accords. The choice is one of implementing risk management practices using controls to mitigate risk, or follow the approach of defining and assessing cybersecurity controls en-mass. Such as the requirement to implement NIST SP 800-171 under DFARS 252.204-7012.
The rational for risk management is simple. You cannot manage everything, its to expensive (many SMEs have raised this with the CMMC program) so you assess risk as required by FISMA. Then apply the appropriate controls to mitigate the risk. The approach that Basel accords for operational risk requires and no doubt the SEC and EU:DORA will require under their proposals.
What is more interesting here though is the discussion of CSF profiles. CSF profiles that CISA has created for several industries and that incidentally are required by FISMA. Is this the start of the demise of SP 800-171, given CISA has issued DIB CSF guidance?
Maybe we got the strategy right when we wrote the Augusta Plan?(https://lnkd.in/d-wv6ezN)
Ted Dziekanowski Brian McCarthy Jason Spezzano
#dod #scfprofiles #cisa #fisma #cybersecurity #cyberriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6940214998317084672