Yesterday, the Office of Management and Budget (OMB) released Memorandum M-22-18, implementing software supply chain security requirements that will have a significant impact on software companies and vendors in accordance with Executive Order 14028, Improving the Nation’s Cybersecurity. The Memorandum requires all federal agencies and their software suppliers to comply with the NIST Secure Software Development Framework (SSDF), NIST SP 800-218, and the NIST Software Supply Chain Security Guidance whenever third-party software is used on government information systems or otherwise affects government information. The term “software” includes firmware, operating systems, applications, and application services (e.g., cloud-based software), as well as products containing software. It is critical to note that these requirements will apply whenever there is a major version update or new software that the government will be using.
No Summer Break for Cyber: Newly Unveiled CMMC Assessment Process Provides Industry with Upcoming Assessment Insights
After much anticipation, the Cyber AB, formerly known as the Cybersecurity Maturity Model Certification (CMMC) Accreditation Body, recently released its pre-decisional draft CMMC Assessment Process (CAP). The CAP describes the overarching procedures and guidance that CMMC Third-Party Assessment Organizations (C3PAOs) will use to assess entities seeking CMMC certification. The current version of the CAP applies to contractors requiring CMMC Level 2 certification, which will likely be most contractors handling Controlled Unclassified Information (CUI) based on the Department of Defense’s (DoD) provisional scoping guidance for CMMC 2.0.
Byte-Sized Q&A – What Should Contractors Know About the Cybersecurity Provisions Included In, and Left Out of, the National Defense Authorization Act
Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces. In this episode, Evan Wolff and Chris Hebdon discuss the notable cybersecurity provisions and omissions in the National Defense Authorization Act (NDAA) for Fiscal Year 2022.
Listen: Crowell.com | PodBean | SoundCloud
Byte-Sized Q&A: What’s not in CMMC 2.0?
Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces. In this episode, hosts Evan Wolff and Kate Growley talk through some key elements that are no longer expected under CMMC 2.0.
Listen: Crowell.com | PodBean | SoundCloud | Apple Podcasts
Byte-Sized Q&A: What can we expect under CMMC 2.0?
Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces. In this episode, hosts Evan Wolff and Kate Growley talk through the fundamental changes that the DoD has announced will be made under “CMMC 2.0.”
Listen: Crowell.com | PodBean | SoundCloud | Apple
CMMC 2.0: DoD Unveils Sweeping Changes Streamlining CMMC Requirements
The Department of Defense (DoD) recently announced significant changes to its Cybersecurity Maturity Model Certification (CMMC) program intended to simplify the requirements and ease the compliance burden on contractors. Unlike its predecessor, the new CMMC 2.0 moves to three compliance levels rather than five; aligns the required security controls (known as practices) with National Institute
Byte-Sized Q&A – What About Micro-Purchases?
Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces. In this episode, host Evan Wolff talks with Chris Hebdon about micro-purchases and the cybersecurity obligations that contractors may encounter in the performance of these small dollar contracts.
Listen: Crowell.com | PodBean |
Byte-Sized Q&A: Part 2 – The NIST DoD Assessment Clauses
Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces. In this second episode of a three-part series, hosts Kate Growley and Evan Wolff overview the high points from the new DFARS clauses 252.204-7019 and -7020.
Listen: Crowell.com | PodBean | SoundCloud |
Byte-Sized Q&A – What is Ransomware?
In this episode, hosts Kate Growley and Evan Wolff talk with Matthew Welling about all things ransomware, including how to prepare for and respond to these kinds of incidents. Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces.
Listen: Crowell.com | PodBean
Byte-Sized Q&A: What Do Contractors Need To Know About The New Cybersecurity Executive Order?
In this episode, host Evan Wolff discusses the Biden Administration’s recent Executive Order on Improving the Nation’s Cybersecurity. Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces.
Click below to listen or access from one of these links:
Listen: Crowell.com | PodBean |