Bill Thorn

This is a fantastic resource and a well done document. There is a new CMMC FAQ. One question in the new FAQ stuck out to me: "Q4. Can Department contractors implement NIST SP 800-171 Revision 3? A4. Yes. Companies can implement Revision 3 but must use the Department’s Organization-Defined Parameters (ODPs) defined in the April 2025 memorandum, “Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3” found here: https://lnkd.in/eN5pnTzB. Because CMMC Assessments will be conducted against Revision 2 until the class deviation memo (Q3 of this section) is withdrawn or otherwise superseded, DIB companies must ensure any identified gaps between Revision 2 and Revision 3 are addressed." We won't know exactly when the class deviation will removed and CMMC will be on 800-171 Rev 3, but if you want to get a headstart you are permitted to implement Rev 3 if you use the DoD's Organizationally Defined Parameters (ODPs). I will note that the ODPs are subject to change during the rulemaking process. #cmmc

8

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana W. for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

214

19 Comments

🚨 CISA-FBI ALERT: Interlock Ransomware Attacks Surge 🚨 A new wave of sophisticated attacks is underway. Interlock uses fake updates and download pop-ups to infiltrate systems—then encrypts and threatens to leak data. At RansomEye, we respond with real-time, modular defense built for this threat landscape. 🛡️ DPI Defense – Powered by RansomEye Modules: 🔹 DETECT • Linux Agent – Real-time system monitoring & AI inference • Windows Agent – File activity and user behavior tracking • KillChain Core – TTP mapping, adversarial graph scoring • Threat Intel Engine – Live IOC ingestion from MISP, OTX, Abuse.ch 🔹 PROTECT • Forensic Dump Engine – Auto-quarantines suspicious memory/process • Quarantine Manager – Service kill & hash-blocking on compromise • Policy Engine – Dynamic response rules per system criticality 🔹 INVESTIGATE • Timeline Builder – Root cause and chain-of-event reconstruction • IOC Export CLI – On-demand extraction of attack fingerprints • Dashboard UI – Full visibility across assets, alerts, and status With RansomEye, you don’t just detect threats — you contain, understand, and stay ahead of them. #RansomEye #Interlock #CISA #FBI #CyberSecurity #Ransomware #ThreatIntel #AIforSecurity #DPIDefense https://lnkd.in/eUeUSjq5

2

Why is CMMC such an important framework for national security? BARR Advisory Senior Consultant Ava Baratz explains. 👇 #CMMC #Compliance #Security

6

1 Comment

🔒 Is your organization ready for CMMC compliance?   Most companies think they are – but the reality is often very different. CMMC is a pass-fail assessment with no room for interpretation.   SSE’s assessors have designed a simple process that offers a snapshot of your current compliance status, outlines potential gaps, recommendations for next steps, and identifies possible risks in a NIST 800-171 and CMMC self-assessment.   Don't wait until it's too late – “Request Your Readiness Assessment Today”: https://lnkd.in/gbgVbERF   #SSE #CMMC #Cybersecurity #DefenseContractors

4

1 Comment