Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

To say that the actions of the Trump administration are having an impact on cybersecurity is an understatement. Executive orders are an important and useful tool that have been used by many presidents for the good of the country – and sometimes for other ends – and some recent executive orders have been aimed at establishing and improving the cybersecurity of the country. Meanwhile, others have, to put it lightly, the opposite impact.

When it comes to overall productivity platforms, collaboration tools, and office suites, the two biggest options dominating the market are the Google G Suite and Microsoft’s Office ecosystem. Whether it’s word processing, team collaboration, IT frameworks, device management, or the entire infrastructure of a business, there’s a pretty good chance one of these two options is going to power the way you operate.

A lot goes into protecting the information security of the nation. The National Institute of Standards and Technology, NIST, maintains a list of security controls under the banner of NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations. Meanwhile, the Federal Risk and Authorization Management Program, or FedRAMP, sets up a framework that makes those security controls apply to governmental agencies and the third-party cloud service providers that work with them.

FedRAMP is a key part of maintaining the digital security of the federal government, by way of enforcing security rules across departments and the cloud service providers that work with them. Any CSP that wishes to work with a federal agency or department and handle controlled information needs to obtain an authority to operate (ATO) from the program management office. Part of that ATO is the continuous monitoring of the CSP’s systems to ensure ongoing security in a changing world.

Security isn’t something you implement once and leave alone. It’s a mindset, an operation, and an ongoing policy. Security frameworks like FedRAMP require a process called continuous monitoring in order to remain valid. The world of information threats is constantly evolving. Technology grows, changes, and improves, but with those changes come new vectors for intrusion, new methods for unauthorized access, and new exploits.

The full compliance process for CMMC, the Cybersecurity Maturity Model Certification, culminates in an audit that validates an organization’s cybersecurity posture and its implementation of the security controls that apply to it. Throughout this process, there is a gatekeeper who performs your audit. You may have heard of them referred to as a CMMC Auditor or a CMMC Assessor. With these two terms in play, you may be wondering what the difference is between them.

The Cybersecurity Maturity Model Certification, version 2.0, is finally in effect, which means thousands of businesses that have roles in the Department of Defense supply line need to do the work to comply and pass their audits to receive certification. It’s inevitable that many of these businesses will fail their initial audits. The standards are high, the margin of error is narrow, and the timeline is tight.

The final step to achieving ISO 27001 certification is passing a final audit of your ISMS. During this process, you will work with an external, third-party auditor to perform a thorough audit of your systems, to evaluate compliance with the guidelines in ISO 27001. The question is, what will that auditor be doing? Do you hand them paperwork and the keys to the building and let them do their thing, or are they more interactive? What can you expect when working with your auditor?

When you’re looking into government cybersecurity certifications, like FedRAMP and CMMC, you’re going to see two acronyms everywhere you turn. These two acronyms are almost identical: 3PAO and C3PAO. With just one letter dividing them, what’s the difference?

Cybersecurity is a complex business, and there are numerous standards and frameworks meant to help businesses achieve some level of security and protection in a hostile world. Among those programs is CMMC, the Cybersecurity Maturity Model Certification. With a new final rule in the finishing stages, it’s critical to know the details if it’s important to your business. CMMC is an initiative and a framework developed and maintained by the United States Department of Defense.