John Kirkwood

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

90% of ISO 27001 projects look great on paper and change absolutely nothing. I’ve seen it hundreds of times. The certificate arrives. The team celebrates. Then… nothing. No faster sales. No stronger culture. No real control. Because most companies treat ISO 27001 as a compliance trophy not a commercial engine. Here’s what actually shifts the culture: ➤ When founders stop outsourcing responsibility and start owning the risk conversation. ➤ When engineers see controls as accelerators, not obstacles. ➤ When “security” becomes the language of delivery, not delay. ISO 27001 done right doesn’t just tick boxes, it changes how people think, decide, and sell. It makes your business audit-ready, deal-ready, and investor-proof every single day. That’s when the ROI kicks in. Fewer audit cycles. Faster procurement. More trust baked into every demo. Forget the paperwork. You’re not buying compliance. You’re buying credibility. The question is: does your certification live in your culture, or just on your wall? #ISO27001 #SaaSLeadership #CyberSecurityStrategy #StartupSecurity #B2BSales #FinTechSecurity #SecurityCulture #ComplianceThatWins #CISOLife #EnterpriseSales

11

1 Comment

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

This is a fantastic resource and a well done document. There is a new CMMC FAQ. One question in the new FAQ stuck out to me: "Q4. Can Department contractors implement NIST SP 800-171 Revision 3? A4. Yes. Companies can implement Revision 3 but must use the Department’s Organization-Defined Parameters (ODPs) defined in the April 2025 memorandum, “Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3” found here: https://lnkd.in/eN5pnTzB. Because CMMC Assessments will be conducted against Revision 2 until the class deviation memo (Q3 of this section) is withdrawn or otherwise superseded, DIB companies must ensure any identified gaps between Revision 2 and Revision 3 are addressed." We won't know exactly when the class deviation will removed and CMMC will be on 800-171 Rev 3, but if you want to get a headstart you are permitted to implement Rev 3 if you use the DoD's Organizationally Defined Parameters (ODPs). I will note that the ODPs are subject to change during the rulemaking process. #cmmc

8

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

Good morning! Here is this week's ICS Advisory, Other CERT, and Vendor vulnerability advisories weekly summary for 23 - 27 February 2026. This past week, CISA released 12 new CISA ICS Advisories for the following vendors: Copeland, InSAT, CloudCharge, EV Energy, Chargemap, SWITCH EV, Mobility46, EV2GO, Gardyn, Johnson Controls, Inc. Pelco, Inc. and Schneider Electric. One update was released this past week for Honeywell Schneider Electric, Mitsubishi Electric, Hitachi Energy, ICONICS and Mitsubishi Electric. Based on the new CISA advisory, #Energy, #TransportationSystems, #Commercial #Facilities, #Healthcare and #PublicHealth, #Defense #Industrial Base, #Food and #Agriculture, Critical #Manufacturing, #Government #Facilities, #Financial #Services, #InformationTechnology, #Water and #WastewaterSystem are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 16 new ICS Advisories for Festo, ARC Informatique, Moxa, Phoenix Contact, ABB, Bosch Rexroth, Hitachi Energy, Ubiquiti Networks, Trumpf, PDUexperts, Socomec and one update for Hitachi Energy. View the summary details of other CERT & Vendor product advisories identified last week (23 - 27 February 2026) at: https://lnkd.in/efKiMsxs This past week, CISA added 3 new Known Exploited Vulnerability (KEV) Catalog. None added this week correlated to a CISA ICS Advisory. ICS Advisory Project identified one CVE: CVE-2020-11023 – JQuery Cross-Site Scripting (XSS) Vulnerability listed in the Festo advisory for CODESYS vulnerabilities in Festo Automation Suite [VDE-2025-108]. This week, ICS Advisory Project, powered by Industrial Data Works LLC, in collaboration with EmberOT, released our 2024–2025 ICS/OT Vulnerability Intelligence Report. Check it out at: https://lnkd.in/ehG4DNPs Thank you all at EmberOT for your amazing support in getting this report out this year. Acknowledgement: Thank you Mikael Vingaard at the ICSRange for sharing with ICS[AP] the new ICS Advisory for PDUexperts. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides & Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week!  #CISA #ot #ics #otsecurity #icssecurity  #cybersecurity #cybersecurityawareness #industrialautomation #buildingautomation #oilandgas #maritime #vulnerabilitymanagement Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

29

Royce Humpert Jr. has shared some of the development efforts and roadmap for this product. It is truly impressive. This post discusses the application of a thoughtful and extensible framework behind specific deliverables. As the world shifts to technology enabled practice, tools like Neat Labs offers will become the standard toolkit. As just one example (but by no means exhaustive), Security Auditors can shift from the minutia of repetitive data collection and workpaper generation to issues of effectiveness, data workflow, and architectural concerns in applying frameworks to effective security. As always, I speak for myself and as an academic interested in ai evolution and effective security . Neither BDO nor SMU necessarily endorse any products.

6

2 Comments

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

For years, security teams worked to satisfy auditors and check compliance boxes. But today, the harshest critics of your cybersecurity posture aren’t regulators - they’re insurers. Because cyber risk has become an underwriting risk. If you can’t prove control maturity, you’ll pay more - or worse, find out your coverage means nothing when you need it. Cyber risk is now a pricing, eligibility, and survivability problem, a lot more than a technical issue. Real-World Lessons: When “Covered” Didn’t Mean Protected Even well-funded organizations are learning how unforgiving insurers have become: 1. Inchcape Australia v Chubb Insurance (2022) A ransomware attack caused business disruption, but the insurer ruled losses as “indirect” and not payable. 2. Hacked Business Loses Cyber Payout (Australia, 2023) A small business breach claim was denied - missing MFA and weak controls nullified the policy. 3. Supplier Breach, No Cover (2024) A company’s AU$30K response cost claim tied to a vendor incident was rejected - policy misalignment. These aren’t mere paperwork errors. They reflect a systemic shift: insurers now validate cyber maturity at the same depth attackers exploit it. Meeting the Baseline Isn’t Enough “Compliance-ready” doesn’t mean “insurable.” Policies are being restricted, repriced, or outright denied when: Controls exist only on paper, not in enforcement, and IR playbooks haven’t been tested in 12+ months. MFA or segmentation is missing on privileged or legacy systems, while Shadow IT, unmonitored vendors, or undisclosed prior incidents exist. You can’t produce evidence - metrics, logs, or test reports - on demand. Cyber insurance is no longer a safety net. It’s a maturity audit disguised as a policy. If you approach it like compliance, you’ll overpay or be left uncovered. If you treat it like risk management, you’ll earn leverage - lower premiums, higher trust, and resilience that outlasts any claim dispute.

21

1 Comment

Audit readiness ≠ security readiness. They overlap — but they’re not the same thing. Audit readiness answers: “Can we prove we did the thing?” Security readiness answers: “Would the thing actually stop or detect the attack?” What audit readiness looks like: • Policies exist (and were reviewed). • Tickets show approvals happened. • Screenshots show a setting was enabled. • A sample of logs is attached. • A quarterly access review spreadsheet is signed. What security readiness looks like: • The control fails loudly when broken (alerts/tickets). • Coverage is continuous, not point-in-time. • Exceptions are time-boxed and tracked. • Owners have SLAs to remediate failures. • Incidents map back to scenarios (risk assumptions get updated). ⚠️ The common trap: We collect evidence that looks great… for controls that can still break silently. 💡 Practical move (do this with one control this week): Pick one “audit-ready” control and add one “security-ready” signal: • “Vulnerability scans completed” → Alert on critical vulns aging past SLA (e.g., >14/30 days). • “Backups exist” → Proof via restore test results (last restore date + time-to-restore). • “Security training completed” → Measure behavior: phishing failure rate trend + high-risk repeat. That’s how you satisfy audits and reduce real risk. Your leading question should be: “Would this control work on a bad day?”

7

Will your System Security Plan (SSP) lead to a false start at the assessment? Most CMMC Level 2 assessments fail before the auditor even looks at the network. Why? Because the SSP is weak. It’s Evidence Item #1, and if it doesn’t meet the Lead Assessor's expectations, the audit stops there. Here is how to make your SSP actually "Assessor-Ready": 1. Target the 320 Objectives: Don't just write to the 110 practices. Use NIST SP 800-171A. If your SSP doesn’t explicitly address every sub-objective (a, b, c), it’s an automatic finding. 2. Define Asset Categories: You must distinguish between CUI Assets, Security Protection Assets (SPA), and Contractor Risk Managed Assets. An auditor needs to know exactly which requirements apply to which device. 3. Be Specific (Who, What, How): Write precise statements that describe how your organization implements controls to meet the objectives will pass. Here is an example: “Authorized access to the CUI Enclave is restricted via Microsoft Entra ID (GCC High) using role-based security groups. Permissions are granted based on "least privilege" and "need-to-know" following an approved Access Request Form. Evidence is maintained in SEC-POL-01 and quarterly Entra ID Group Membership exports.” 4. Map to Artifacts: Treat your SSP as a roadmap. Link every control directly to a specific piece of evidence (e.g., Policy-V2 or Firewall-Logs-Q1). If the assessor can find the proof instantly, the interview stays short. 5. You are accountable: If you use cloud services (Azure/AWS), clearly define your Shared Responsibility. You are likely responsible for 70% of the controls—show where the provider provides support and where your organization closes the gap. If you have questions, I can help. #CMMC #Cybersecurity #NIST800171 #Compliance #DIB

4

1 Comment

Ransomware Defense Initiative (RDI) fits with your framework, not instead of it. Already using NIST CSF, ISO 27001, or MITRE? Great. RDI isn’t a replacement, it’s a focused framework that makes your strategy more responsive to ransomware threats. Think of it as an overlay, purpose-built for modern ransomware mitigation. https://rdishield.com #rdi #ransomware

5