Security Forethought

CMMC Whisperer since 2020. Certified CMMC Assessor (CCA). 20 year CISSP. Improve your InfoSec risk with Security Forethought.

[Security Forethought @Sec4Thought]

#CMMC update!
The 48 CFR rule, which lets DOD require CMMC certification before a contract is awarded, is now under final review at OMB. It could be published in 30 days and then after a 60 day Congressional review period will be live.
Contact me if you need CMMC assistance.

[Security Forethought @Sec4Thought]

@TheHackersNews MFA and PIM.

[Security Forethought @Sec4Thought]

@TracketPacer Some of us just use a Mac.

[Security Forethought @Sec4Thought]

@BentleyAudrey Does she know how to use a kitchen?

[Security Forethought @Sec4Thought]

@TracketPacer 1988 was told by promotions director of a TV station that he wanted to hire me for the full-time position, but he was told that he had to hire a woman.

[Security Forethought @Sec4Thought]

@H3KTlC My resume many years ago said that I don't do printers. It no longer needs to be stated because I don't do printers. My default solution for a printer problem today is throw away the one giving me problems and buy a new one.

[Security Forethought @Sec4Thought]

Ops Mgr came back from vacation, moved all unread emails to a folder and sent this to all:

"Hello. I just accidentally deleted all unread emails. Please resend any email that still needs to be addressed."

Only 20% of emails sent to her while on vacation were resent.

[Security Forethought @Sec4Thought]

CMMC news: Phase 1 begins 10NOV. The 48 CFR regulation that allows DoD/DoW to require 3rd party assessments for new contracts and extensions hits the federal register tomorrow and goes into effect 60 days later. https://t.co/nYmbJQZhnb

[Security Forethought @Sec4Thought]

Don’t forget that CMMC requires a periodic test of your incident response plan. Btw, periodically for CMMC means annually… 365 days or less.

[On Call Compliance Solutions @OnCallComputers]

𝗪𝗼𝘂𝗹𝗱 𝘆𝗼𝘂 𝗵𝗶𝗱𝗲 𝘆𝗼𝘂𝗿 “𝗱𝗮𝘆𝘀 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁” 𝘀𝗶𝗴𝗻?

Then don’t bury your incident response plan either. NIST 800-171: Keep it accessible, not archived.

#CMMC #IncidentResponse #Cybersecurity #Compliance #DFARS #NIST800171 #DefenseContractors

[Security Forethought @Sec4Thought]

@OnCallComputers Start with the baseline and document authorized ports and protocols. Then validate what is authorized and confirm anything not authorized is disabled. This is CMMC basics and can be easily caught with proper procedures. There is a reason continuous monitoring is part of CMMC.

[Security Forethought @Sec4Thought]

Just realized have been CISSP 20 years. Had been doing enterprise network & systems work 10 years and realized those skills were becoming common. Security had always been part of that work so it was simple to just refocus. Earned CISSP in 2005 & CISA in 2008. Now CMMC CCA.

[Security Forethought @Sec4Thought]

@Brianforlisa @HardPass4 Let me know if you need help with CMMC.

[Security Forethought @Sec4Thought]

@VBierschwale It will shake out when they can’t get the required Level 2 certification and can’t get any new contracts. Could happen pretty quickly depending if they have a solid prime.

I am a CCA in case anyone out there needs CMMC advice.

[Security Forethought @Sec4Thought]

@techspence First you validate that all compliance expenses are part of the operations budget.

[Security Forethought @Sec4Thought]

Now a Certified CMMC Assessor

[Security Forethought @Sec4Thought]

@UK_Daniel_Card @digitalocean @Ubiquiti I’ve been able to do this with a FortiGate for well over a decade.

[Security Forethought @Sec4Thought]

@elhackernet @amyengineer

[Security Forethought @Sec4Thought]

@midnight_comms @Cyb3rMonk SANS has always been overpriced.

[Security Forethought @Sec4Thought]

@Cyb3rMonk @DataJinn Are they still giving away free MacBooks with a course? Any organization that includes that type of incentive for attending its courses is overpriced… and by handing out such valuable “freebies”they were admitting it. (Yes, we understand the cost of the freebie was built in)

[Security Forethought @Sec4Thought]

@_CatholicWest @techspence We had cassette tapes for storage!