Call us now:
It is widely recognised that cybersecurity compliance for the US Defence Industry Base (DIB) will be a challenge. Challenges which will impact any sector if programs like CMMC are deployed by other Federal Agencies. NIST SP 800-171 Self attestation under DFARS 252.204 – 7012 did not achieve the desired outcome, resulting in the CMMC program. Which has had its own challenges including the impact to small business, the cost of compliance, lack of skilled resources to provide oversight and assurance and the impact of compliance across a very large and diverse industry base. One size rigid cyber frameworks do not provide the appropriate flexibility when implemented as part of larger risk management programs such as FISMA and in the case of the DoD their RMF. Which is a regulatory requirement for Federal Agencies through the OMB.
NIST provides an approach using Cybersecurity Framework Profiles. CSF profiles provide a flexible approach to the management of cyber-risk, aligned to risk appetite, the business environment, strategy, mission and business objectives. There is always going to be a cost, cyber does not come free. But CSF profiles provide an appropriate controls framework as part of a risk-based cyber program, as required by FISMA (NIST SP 800-37R2), the DoD (RMF) and DoDi 5000.90 (DoD procurement).
In the enclosed video by Ted Dziekanowski discusses the Manufacturing Cybersecurity Framework Profile, released in October 2020. It provides a risk based approach for cyber risk management, aligns to existing frameworks and closes compliance gaps including governance, risk management, business environment and strategy. In the case of the Manufacturing CSF cyber controls are aligned to mission and business objectives. This could be the mission objectives of a chosen weapon system.
NIST CSF profiles have been created for a number of specific applications (search google). They can be tailored to industry sector, business environment, specific systems and data types, for the assessment and management of cybersecurity risk. E.g. the Energy sector, nuclear.
Jason Spezzano‚Â Brian McCarthy
#theaugustagroup‚Â #theaugustaplan‚Â #cybersecurity‚Â #supplychainriskmanagement‚Â #cyberriskmanagement‚Â #compliance‚Â #cyberinsurance‚Â #insurance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esgrisk‚Â #cyberregulation‚Â #esgreporting‚Â #soc2‚Â #defenceindustry‚Â #esg‚Â #defence‚Â #dodi500090 #NISTCSF
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6839114860958146560