Call us now:
This is an important read to understand the direction the DoD and its CIO, under Federal Information Security Modernization Act (FISMA), is adopting for cyber security, risk management and the deployment of Continuous Diagnostic Monitoring (CDM). The DoD has an active program in place under DoDi 8510.01 to implement the Risk Management Framework (RMF) across its branches, and DoDi 5000.90 to deploy the RMF for defence procurement. This Memorandum establishes the requirement to implement CDM to enable real time diagnostics of cyber controls for defence systems, ahead of an Authorisation to Operate (ATO). Continuously monitoring security controls within an information systems security baseline.
Why is this important? The RMF (NIST SP 800-37R2) uses NIST SP 800-53 for baseline controls. In my view this is reaffirming the RMF and baseline controls to manage risk and cyber-risk within the DoD, and CDM to provide oversight and assurance. Important for defence contractors is DoDi 5000.90, as it establishes the requirements for the RMF to be applied to manage cybersecurity within the Defence Acquisition System (DAS) and ATO processes.
CDM is also an initiative the Department of Homeland Security (DHS) has been keen to establish across Federal Government. However it requires Federal Government to address the risk management elephant in the room that is FISMA, the RMF and OMB A-130. That we discuss here https://lnkd.in/dVdM3ZRq
It is difficult to ignore and underestimate the impact of the RMF and the direction the DoD CIO is taking in re-affirming for the RMF, that it is required to be adopted under FISMA.
Ted Dziekanowski
#theaugustaplan‚Â #cybersecurity‚Â #cyberriskmanagement‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #cybercompliance‚Â #cyberregulation‚Â #cybergovernance‚Â #sec‚Â #cyberriskgovernance‚Â #ransomeware‚Â #csfprofiles‚Â #governance‚Â #nist‚Â #cyberinsurance‚Â #insurance
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6895272842137866240