Georgia Tech Procurement Assistance Center

Georgia Defense Industrial Base Task Force hosting CMMC summit May 18th

By

No matter where you’re at on the CMMC journey, there are resources to support you.  Join the Georgia Defense Industrial Base Task Force (GDIBT) – a partnership between the Georgia Department of Economic Development (GDEcD), Georgia Cyber Center, and the Technology Association of Georgia (TAG) on May 18 from 9 a.m. – 12: 30 p.m. to map out your path forward.

Join local businesses as they share their experiences with CMMC and answer your questions.  CMMC-AB Marketplace providers and cyber professionals explain how their tools and ‘turn-key’ services support your CMMC journey.  Chart your course further with a training session focused on NIST 800-171 and more.

PRICE: FREE

FORMAT: VIRTUAL

Event Contact:
Heather Maxfield
(404) 920-2022
Send Email

Date and Time:  Tuesday, May 18, 2021 (9:00 AM – 12:30 PM) (EDT)

Registration Link:  https://members.tagonline.org/calendar/Details/cmmc-summit-337318?sourceTypeId=Hub

AGENDA

9:00 – 9:05 AM                     Larry Williams, President and CEO, TAG 

9:05 – 9:10 AM                     Eric Toler, Executive Director, Georgia Cyber Center

9:10 – 9:20 AM                     Keynote – Dr. Joye Purser, Regional Director—Region 4, Cybersecurity and Infrastructure Security Agency (CISA)

9:20 – 10:20 AM                   Peer Panel, Moderated by Roy Hadley, Adams and Reese, LLP

  • Allison Giddens, Co-President, Win-Tech
  • Allison Stewart, Compliance Analyst & Training, Top Flight
  • Miguel Garcia, AMRAAM Project Manager / Business Development, Collins Manufacturing

10:20 – 10:35 AM                 Break 

10:35 – 11:35 AM                 UGA SBDC “NIST 800-171 + Beyond” Training

  • Mark Lupo, UGA SBDC

11:35 –12:25 PM                  ‘Solutions’ Provider Panel, Moderated by Roy Hadley, Adams and Reese, LLP

  • Horacio Maysonet, President & CEO, Cyber Security Solutions
  • Chris Silvers, Founder and Principal Consultant, CG Silvers
  • Chris Hallenbeck, Chief Information Security Officer, Americas Tanium

12:30 PM                               Closing, Cassia Baker, Georgia Department of Economic Development Center of Innovation for Aerospace 

Mandatory breach notification requirements are coming for government contractors

By

The Biden Administration is imminently expected to release an executive order that will require government contractors to notify the government in the event of a cybersecurity breach.  Despite the relatively steady rise in cyberattacks and breaches over the years and the enactment of consumer data breach disclosure laws in all 50 states, there is currently no standardized reporting requirement for government contractors.  However, the Biden administration has promised executive action on the issue, largely in response to a cyberattack by a suspected nation-state against multiple software companies, including the SolarWinds software company.

Continue reading at:  Husch Blackwell

CMMC is coming: How government contractors can prepare

By

People like to say that cybersecurity threats are constantly evolving.  So perhaps it’s fitting that cybersecurity compliance is undergoing a significant evolution of its own this year, too.

That evolution is the arrival of the Cybersecurity Maturity Model Certification, more commonly abbreviated as CMMC.  CMMC is a new standard for cybersecurity that the U.S. Defense Department is rolling out to defense contractors, requiring companies to enforce new oversight across their operations and down their supply chains.

The Defense Department’s goal is to make CMMC a standard clause for all defense contracts by 2026, including higher education institutions that do government-sponsored defense research; and professional services firms that provide consulting to the Defense Department.

Even if you are not a prime defense contractor, CMMC is still likely to join your list of compliance obligations sometime soon.

Continue reading at:  Risk & Compliance Matters

What is CUI – The devil is in the details

By

Controlled unclassified information (CUI) is defined, in part, as “information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.”

Despite this seemingly straightforward definition, identifying CUI has been a challenge for the government and contractors.  This challenge has become particularly evident as the Defense Department implements its interim rule to the Defense Federal Acquisition Regulation Supplement to protect CUI through a mandatory Defense Department assessment methodology and through a slow rollout of its Cybersecurity Maturity Model Certification program.

Continue reading at:  National Defense Magazine

Let’s talk about “zero trust”

By

Zero trust has taken the federal government by storm.

As more and more agencies move to the cloud — and especially as they sustain mass telework during the COVID-19 pandemic and beyond — the perimeters of their networks are becoming obsolete.  Unable to place confidence in a traditional firewall in this new environment, agencies have no choice but to give “zero trust” to users and devices on their network, requiring them to validate and identify themselves anytime they move across the IT architecture.

In essence, this is the idea behind zero-trust security.

Listen to the podcast at FedScoop Radio:  https://www.fedscoop.com/radio/lets-talk-ep-17-guide-zero-trust-featuring-cisas-sean-connelly/  

Podcast: CMMC, and transitioning to the new requirements

By

Everyone knows that DoD gets thousands of attacks every day.  These attacks are getting more creative by attacking DoD’s trusted supply chain.  The SolarWinds incident is an example of how a trusted software supplier was shown to have been compromised.

To control some of these creative attacks, DoD has created the Cybersecurity Maturity Model Certification (CMMC) that companies who do business with DoD may need to comply with to continue to do business with the DoD in the future.

The Federal News Network recently held a podcast with John Gilroy and FedHIVE CEO Michael Cardaci, who talked about ways to smooth the transition to the Cybersecurity Maturity Model Certification or CMMC.

Listen to the Podcast at:  The Federal News Network

Agency hacks could accelerate push to “zero trust” security model

By

Chris DeRusha, the federal chief information security officer, on Thursday in hearing with senators said the White House will push federal agencies to start moving toward a new “zero trust paradigm.”

“In this new model, real-time authentication tests users, blocks suspicious activity, and prevents adversaries from the kind of privilege escalation that was demonstrated in the SolarWinds incident,” he told lawmakers on the Homeland Security and Government Affairs Committee.

Continue reading at:  FCW

SolarWinds hack proves contractors need to be prepared for APTs

By

If you don’t know about SolarWinds, then you haven’t been reading the news for the past six months.  Last October 2020, it was reported that a widely-used networking tool that helps companies in the public and private sectors manage their Information Technology (IT) portfolios – SolarWinds Orion product — had been compromised.  Publicly, it has been reported that about 18,000 private and government users downloaded the tainted software update, and it provided Russian hackers access to their systems.  The hack hit Federal agencies, including the Departments of Treasury, Commerce, and State, the Department of Homeland Security (DHS), National Security Agency, and parts of the Pentagon, as well as public and private sector companies.  The breadth and depth of this hack are still being assessed.

Continue reading at:  Government Contracting Matters

Final rule, formal training on CMMC could hit this summer

By

A final rule on the Defense Department’s unified cybersecurity standard could debut as soon as this summer, defense officials said.  But implementation hinges on standing up a formal training system.

Diane Knight, who is DOD’s lead for the Cybersecurity Maturity Model Certification program’s pathfinders and pilots, said a final rule could roll out as soon as April but wouldn’t confirm a concrete timeline.

“There will be a final rule and we have that identified on schedule coming up here too,” Knight said Jan. 26 during a virtual town hall hosted by the CMMC Accreditation Body (AB).

Knight also previewed a “notional” timeline for the pilots where requests for proposals would be released in April and awards coming in August.  By April contractors seeking to participate in the pilots would be expected to have prepared for a CMMC assessment, reviewed requirements with subcontractors and to request an authorized third-party assessors (C3PAOs) assessment.  Proposals would be due by July, according to the documents, and a certification would be needed when the contract is awarded.

Continue reading at:  FCW

DOD’s cybersecurity certification requirements to appear in DHS contracts

By

The Department of Defense is figuring out how to incorporate its Cybersecurity Maturity Model Certification program in contracts offered by the Department of Homeland Security, according to the official helming the initiative.

The CMMC program will ultimately require all defense contractors have their cybersecurity practices certified by a system of independent third-party auditors.  As it is now, companies simply pledge their adherence to security controls detailed in standards issued by the National Institute of Standards and Technology.

Rules to implement the program are expected to be finalized as early as next month and have caused some heartburn within the contracting community.  But the program is being rolled out in phases—15 prime contractors, and all their subcontractors, are being selected to undergo assessments this year—and won’t be fully applicable until 2025.

Continue reading at:  Nextgov

Contracting News

Read More

Contracting Tips

Read More

GTPAC News

Read More

Georgia Tech News

Read More