Last week the DoD released its cyber strategy for the Defense Industry base (DIB).

← Back to Blog

Last week the DoD released its cyber strategy for the Defense Industry base (DIB). The strategy days little that is not already known, but raises many questions namely why now?

The DoD has been covered by Federal Cybersecurity requirements under FISMA for many years. It self working to address cybersecurity risk management, NIST SP 800-37, and associated cybersecuirty standards that include the Cybersecurity Framework (CSF). That is it driving through its own Defense Instructions.

The DoD had the chance to take the lead on cybersecurity risk management from the early days of FISMA. So it is interesting that the DoD has now aligned its strategy along wide OMB, ONCD, DHS and CISA given it has been pushing DFARS 252.204-7012 since 2017, 2019 and 2020 since 2019 and driving ahead with CMMC, likely from 2025. One sees little that one could consider as enforcing compliance, albeit it could have enforced compliance through DFARS. There is also little that supports the international DIB, that the DoD relies heavily upon.

It is positive to see the DoD is adopting CSF into its operating plans and the execution of cybersecurity responsibilities. A requirement required under FISMA, that the DoD has been working to comply to since 2022 under DoDi 8510.01. A requirement that raises an obvious question. How will the DoDs plans to align with the CSF compare with the requirement to adopt NIST SP 800-171? with the CSF provide the risk management framework @Thaddeus Dziekanowski under which the 171 controls framework sits. Or with the CSF controls framework take precedence?

One has to ask some obvious questions. Why has the DoD simply not enforced FISMA and adopted the foundations of NIST SP 800-37, CSF and associated cyber standards. What is the DoD strategy to address cybersecurity risk management compliance of across the international DIB? Why has the DoD not enforced DFARS 252.204-7012. DFARS has provided the DoD with the tool to oversight and assure cyber compliance since 2017, but it has not really been enforced.

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC

Office of the National Cyber Director, The White House, United States Department of Defense

#cybersecurity #cyberriskmanagement #cyberinsurance #defense

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7180927387608457216