Nathan Rollings

CMMC Level 2 Assessment Objective: Separation of Duties PRACTICE: Organizations must separate the duties of individuals to reduce the risk of malevolent activity without collusion. ASSESSMENT: No one person should be in charge of an entire critical task from beginning to end. Documenting and dividing elements of important duties and tasks between employees reduce intentional or unintentional execution of malicious activities. Be prepared! Your assessor could ask to 🔍 EXAMINE access control policy. 🗣 INTERVIEW personnel with responsibilities for defining divisions of responsibility and separation of duties. 📝 TEST mechanisms implementing separation of duties policy. (CMMC Assessment Guide: Level 2 Version 2.13, page 22) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

66

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

Here's a reminder to thank your cybersecurity professionals. Just read in the University of Illinois System CFO Annual Report that system networks alone are subject to up to 218 million cyberattacks per day. That's not a typo. That's 2.5K+/second. Thankfully, most of that protection is automated, but cybersecurity experts are the only thing between us and absolute chaos.

63

5 Comments

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana Wesley for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

213

19 Comments

Gary Hayslip provides key advice for #cybersecurity professionals who are looking to capitalize on opportunities and adapt to new risks in 2025! Check out the full podcast interview: https://lnkd.in/ggqfsMzr

48

2 Comments

I’ve spent years guiding organizations through audits, SOC reports, FedRAMP, and ISO compliance. And while I’m proud of that work, what’s happening right now feels bigger. The White House dropped America’s AI Action Plan on July 23, 2025. It’s not a direct roadmap for data centers. But one section is loud and clear: expect a boom in AI infrastructure, especially data centers...with fast-tracked permitting and environmental rollbacks to make it happen. That means compliance leaders can't just be auditors anymore. We’ve got to cut deeper: understand how AI data systems are built, how they’re powered, and how permits and permitting shortcuts are changing the ground beneath us. It’s exciting, honestly. We’ve always been the ones asking “How do we know it’s secure?” Now we’re asking “How do we make it responsibly fast?” We’re talking energy grids, environmental impact, Clean Water Act permits, federal land use and how all of that mesh into a compliance posture that keeps pace with the world’s fastest-growing sector!!! P And if you want a deeper dive, this is my latest blog: The AI Action Plan and Data Center Compliance https://lnkd.in/eA63yqh4

33

The top 3 CMMC questions MSPs keep asking about SPRS and scope. (And Why the Answers Matter) 1. “What's an SSP and can we submit an SPRS score without it?” Short answer: No. (And PLEASE STOP DOING THIS!) Long answer: No SSP, therefore an assessment can't be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012. You cannot evaluate implementation of the 110 requirements (320 assessment objectives) without knowing what systems, users, assets, and boundaries are in scope and that all lives in the SSP. No SSP = No assessment. No scope. No credibility. And definitely no defensible score. 2. “But what if our client hired a consultant to submit the SPRS score for them?” Doesn’t matter who did it. If there’s no defined scope, no asset inventory, no categorization of in-scope systems, and no SSP… that score isn't defensible. One MSP recently relayed that a client's “consultant” submitted a score of 30 (yes, a positive 30) with none of those artifacts. It’s a misrepresentation and could lead to false claims issues down the road. 3. “What counts as in scope for CMMC Level 2?” CMMC Level 2 scope is defined by asset categories in 32 CFR § 170.19(c) and detailed in the official Scoping Guide Level 2 and Assessment Guide Level 2. Search for these documents, download them, read them... dodcio-dot-defense-dot-gov Here’s the TLDR: CUI Assets - Anything that stores, processes, or transmits CUI must be inventoried, diagrammed, and assessed against all 110 controls. Security Protection Assets - Firewalls, SIEMs, MFA providers, etc., that secure the CUI environment must be assessed for their relevant control responsibilities. Contractor Risk Managed Assets - These must be documented, risk-justified, and treated in the SSP. Out-of-Scope Assets (my personal favorite) - Only allowed when logically and physically separated from the CUI environment. You can’t just “say” something is out of scope. You have to prove it, visibly, with documentation, and defensibly. If you're an MSP supporting clients in the defense industrial base, stop winging it on SPRS scores and scoping. Read the guides. Build the evidence. Or partner with someone who knows what they’re doing. Because “good enough” won't be when the C3PAO shows up. #falseclaimsact #sprs #dfars #cmmc #msp

34

10 Comments

🚨 The Cybersecurity Information Sharing Act (#CISA) protections quietly expired this week. For the past decade, CISA enabled organizations to share cyber threat intelligence with government and peers under legal safeguards. With those protections gone, companies may think twice before collaborating — just as threat actors are ramping up their tactics. This moment is a reminder of how vital #trust and #transparency are in collective defense. Even without legal frameworks, security teams will need to find ways to keep intelligence flowing and risks visible. #CyberSecurity #ThreatIntelligence #CollectiveDefense

18

I have a little secret to share: I love the English language and understanding words that are used less often! One of my favorites is "prognosticator" which means someone who predicts the future based on signs or symptoms. This word perfectly captures one of the essential skills of great cyber security leaders. As a Chief Information Security Officer (CISO), your role goes beyond traditional security measures. You need to stay on top of current trends, not just in threats, vulnerabilities, and attack techniques, but also in business, geopolitics, and other areas. This way, you can develop a proactive strategy to protect your organization. It's crucial to think ahead because cyber threats are becoming more sophisticated, and a security breach can have devastating consequences. By predicting and preparing for emerging risks, you can implement strong security strategies that minimize potential damage and ensure your organization's information systems remain resilient. Moreover, being able to foresee future challenges allows you to align your security initiatives with your organization's long-term goals and regulatory requirements. This strategic foresight helps you allocate resources effectively, prioritize critical security investments, and foster a culture of continuous improvement within your team. By staying ahead of the curve, you not only protect your organization from immediate threats but also contribute to its overall growth and stability in an ever-changing technological landscape.

40

7 Comments

Why Do We Need CMMC? 1. Motivation: Business is about managing risk, but people routinely underestimate the risks and fail to properly support security and compliance efforts. Companies won't do it properly unless you force them to prove it. 2. Self-attestation has failed: NIST 800-171 has been required for defense contractors since 2017 but less than 1% of DoD contractors were ever audited and most of those submitted inflated or inaccurate SPRS scores without ever fully implementing the required 110 controls. Multiple False Claims Act settlements revealed firms claimed compliance without doing the work. CMMC introduces third-party validation to enforce accountability. No more “trust but don’t verify.” 3. The Cyberwar is real: Real adversarial nations, sponsor real hacking, to steal secrets, to produce real weapons, to obtain leverage or to indirectly or directly harm us. The 2025 Verizon DBIR shows 88% of ransomware breaches in SMBs target orgs like small defense contractors. Bottom line: We need CMMC because adversaries don’t care what you say you're doing. They exploit what you're not doing. “The only thing necessary for the triumph of evil is for good {people} to do nothing.” – Edmund Burke I can help.

22

2 Comments