Across government and private organizations, the need to match records and confirm death has become a major concern. People who take out credit or receive benefits do so because they are living, and once they pass, there must be a way to align the state of their benefits and finances. This is where the NTIS… Read More
Business decision-makers can only talk about AI. This seemingly ubiquitous solution introduces several quality-of-life capabilities and significant cybersecurity issues. Here, we touch on Executive Order 14110 and how it addresses this issue for government agencies and contractors.
The Secure Software Development Framework, outlined in NIST Special Publication 800-218, provides guidelines and best practices to enhance the security and integrity of software development processes. NIST developed it to help organizations implement secure software development practices and mitigate risks associated with software vulnerabilities.
Modern industry relies heavily on automation and control systems to maintain efficiency, productivity, and safety. With the increasing integration of these systems into broader networks, the risk of cyberattacks has significantly grown. ISASecure, a globally recognized cybersecurity certification program, is a critical certification body providing standards and assessments to protect these integral systems against modern… Read More
Insider threats are a massive problem due in no small part to the prevalence of apps, accounts, and systems that employees have to plug into daily. Once you’ve let an employee go, there’s no accounting for how they can steal data using their old credentials… unless you have a proper offboarding plan. Here, we discuss… Read More
Hardware, operating systems, software and apps, and third-party platforms are all components of your IT infrastructure, including its operating procedures and settings. Misconfiguration of these components can have ripple effects across an entire network, so investing time and effort into configuration management is critical. Here, we cover secure configuration management and why it’s essential for… Read More
Like any other agency, the IRS works with a network of technology providers and third parties to support its mission of managing sensitive financial data. These relationships present unavoidable security risks. IRS 4812 helps address these security challenges by outlining security requirements and best practices for contractors working with the IRS to handle specific forms of… Read More
IT providers meeting the strict requirements of CMMC might assume that they are secure enough to withstand most threats. The truth is that while CMMC is an end goal for many compliance strategies, it can also complement more resilient security approaches, like Zero Trust. Here, we discuss what it means to consider implementing Zero Trust… Read More
CMMC is already a comprehensive framework that the DoD uses to secure its digital supply chain. The maturity model includes three levels corresponding to the increasingly deep incorporation of NIST controls targeting the protection of Controlled Unclassified Information (CUI), specifically from Special Publications 800-171 and 800-172. Organizations meeting CMMC requirements, therefore, meet the standards required… Read More
We’ve talked quite a bit about the technical compliance requirements in this space, and IT and security support are the most critical parts of your CMMC strategy. However, business leadership is the backbone of ongoing compliance strategies (and their success). Business leaders set the tone for compliance strategies, prioritizing organizations’ resources and attention to ensure… Read More
Starting in Q1 2025, software providers in the DoD supply chain must align their security with CMMC 2.0 standards. While many enterprise customers have been spending that past year getting ready, the reality is that most businesses don’t share this level of preparedness–specifically, small businesses. Meeting the challenges of a complex framework like CMMC can… Read More
CMMC is a crucial framework developed by the Department of Defense to enhance the cybersecurity posture of contractors within the Defense Industrial Base. The CMMC model is crucial for organizations dealing with Controlled Unclassified Information (CUI) because it ensures that these entities meet specific cybersecurity requirements to protect sensitive information. More likely than not, however,… Read More
Cybersecurity trends are moving from checklist compliance to comprehensive, risk-driven security. This is just as true in the European Union, where data subject privacy and security requirements are strict. Fortunately, GDPR provides significant guidance on general risk management and specific risk assessment requirements. We’ll cover those requirements here.
Generative AI is in the news, as usual. However, one of the big pushes we’re seeing lately is how the practices used by AI providers like OpenAI may violate user privacy. This, of course, is a big no-no for jurisdictions like the EU. Here, we’re dipping into the world of AI to talk about the… Read More
We are big believers in packaging your compliance needs into a single, effective standard within your organization. It doesn’t make any sense to double up on work, and streamlining compliance across multiple standards makes your efforts better and faster. In light of that, we’re discussing how you can streamline some of your existing ISO compliance… Read More
In today’s digital age, cybersecurity is not just a technical necessity but a critical compliance requirement. Organizations worldwide face rigorous regulations to safeguard sensitive data and maintain public trust. The Common Criteria certification is a pivotal standard in cybersecurity compliance among these regulatory frameworks. This article will discuss how CC plays a role in other,… Read More
We use “the digital supply chain” regularly because enterprise and government businesses rely heavily on it. The relationships between vendors, cloud providers, software, and customers are so deeply intertwined that it’s impossible to avoid the big picture–that security is a complex activity that can span dozens of entities. A recently discovered flaw in the R… Read More
We’ve previously written about the importance of NVLAP Common Criteria accreditation for lab testing and validating products for use in high-risk industries. It’s probably unsurprising that we are markedly interested in cybersecurity labs’ requirements. Here, we’re discussing NVLAP Common Criteria accreditation for cybersecurity labs–what it is, how it is unique for assessed labs, and some… Read More
Unfortunately, HIPAA data breaches are increasingly common. Kaiser Permanente, one of the largest healthcare insurance providers in the U.S., recently reported a massive exposure of millions of patient records (Protected Health Information, or PHI). This unfortunate event also serves as a learning moment for companies who may not understand how to avoid such unintended consequences.… Read More
Government agencies (and their vendors and partners) are increasingly entrusted with sensitive data. Accordingly, protecting critical infrastructure and cybersecurity are both top priorities. The tools they use must come from time-tested and verified protocols to ensure they are secure and not tampered with. In turn, this means that these tools must come from labs that… Read More
Streamline Compliance and Documentation with Continuum GRC AI Automate reporting with machine learning and AI. The Necessity of Accurate Reporting in Compliance Documentation and reports are the end product and backbone of your compliance efforts. They are how your organization demonstrates compliance with relevant regulatory and governing bodies.
We’ve written extensively about CMMC and NIST Special Publication 800-171, which cover the handling and protection of Controlled Unclassified Information (CUI). But what is CUI? How is it created, and why is it so important to protect? Here, we’re digging into CUI and why it’s integral to significant cybersecurity frameworks in the federal marketplace.
Our previous articles on CMMC Level 1 certification focused on what organizations need to know when conducting self-assessments. These documents relied primarily on the fact that the contractor would do their assessments and reporting. With Level 2 certification, the game changes. Not only are nearly all assessments performed by C3PAOs, but their requirements expand nearly… Read More
Our previous article discussed what it meant to scope your self-assessment while pursuing Level 1 Maturity under CMMC. This approach included identifying the boundaries of FCI-holding systems and comprehensively cataloging technology, people, and processes that play a part in that system. Here, we take the next step and cover CIO guidelines for performing your self-assessment. … Read More