Call us now:
Could the convergence of CMMC 2.0 and last weeks proposal by the SEC for cybersecurity risk management, strategy, governance and incident disclosure be the mechanism to kick start cybersecurity across the US global DIB? Previous attempts by the DoD to secure DIB data have not had the desired effect, that the SEC is likely to get from public firms for cybersecurity risk management.
For CMMC 2.0, the SEC and the management of defense prime contractors (Governance) to be satisfied that cybersecurity risks are being managed, a risk based approach to securing defence data across global supply chains is required (FISMA). If not requirements to meet CMMC 2.0 and the SECs proposals will conflict as CMMC 2.0 focuses on CUI and the SECs proposal on material enterprise wide cybersecurity risk and subsequently enterprise data.
If the SEC moves ahead with their proposal then public defense contractors will have to comply with a program similar to Sarbanes Oxley a program evaluated by CPAs or other qualified auditors, but for cyber. Providing management with the appropriate level of assurance of cybersecurity risk management, given the legal and compliance implications of miss reporting. With the volumes of data involved can be economic, if the data is risk assessed and secured by control inheritance through the cloud.
A program that was discussed with the DoD, Commissions, and industry trade bodies in 2021. https://lnkd.in/d-wv6ezN
Ted Dziekanowski
#cmmc #defense #sec #cybersecurity #cyberinsurance #governance #cyberregulation #regulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6910128276145344512