Government cybersecurity standards such as FedRAMP and CMMC can be challenging to comprehend. There are a host of details to decipher between the two. Let’s dive into common questions about these programs: how they work together, how they work independently, and other questions that frequently arise.

David Klopp, Managing Director in the Cyber Risk practice of Kroll, recently spoke at the first session of PARIMA’s Confident Response Series 2021. The series aims to fine-tune incident response preparedness and help risk managers understand the latest tactics, techniques and procedures from the most successful cybercriminals, leading to deeper collaboration with business partners and mitigation of technical, legal and reputational risks.

If your firm is a government contractor working with the U.S. Department of Defense, or works anywhere in the DoD supply chain, brace for big changes in the cybersecurity requirements your business will need to meet. By 2026, the Defense Department will require its contractors to comply with new cybersecurity standards known as the Cybersecurity Maturity Model Certification — CMMC, for short.

SAN FRANCISCO – March 10, 2021 – Reciprocity, a leader in information security risk and compliance with its ZenGRC solution, today announces ZenGRC has been named a winner of four 2021 Cybersecurity Excellence Awards. The company was also recognized as a Grand Trophy Winner, the top honor, along with four category awards by the Globee Awards 17th Annual Cyber Security Global Excellence Awards.

Compliance management ensures that an organization’s policies and procedures align with a specific set of rules. The organization’s personnel must follow the policies and procedures to ensure compliance with the set of rules. These rules are based on legal, regulatory, and industry standards.The goal of the compliance management program is to reduce an organization’s overall risk of non-compliance with the legal, regulatory, and industry standards that apply to the business.

In the late 1990’s and early 2000’s there was a concept that was bandied about that was coined “Return on Security Investment” or ROSI. Borrowing from the common business term Return on Investment (ROI) where a return on a particular investment (capital investment, personnel, training etc.) could be quantified, the cybersecurity industry attempted to quantify a return on security investment.