Richard Servillas

🚨🚨 Big news for the CMMC (the Cybersecurity Maturity Model Certification) program - the final DFARS rule(s) is at OMB for final review. Once OMB reviews it (and presumably approves it), it will be published in the final register with an effective date in the near future after that. This means that CMMC will be placed onto solicitations/contracts and contractors will be responsible for at least self-certifying to Level 1 or Level 2 compliance for all solicitations from that date forward.

392

39 Comments

I’ve spent years guiding organizations through audits, SOC reports, FedRAMP, and ISO compliance. And while I’m proud of that work, what’s happening right now feels bigger. The White House dropped America’s AI Action Plan on July 23, 2025. It’s not a direct roadmap for data centers. But one section is loud and clear: expect a boom in AI infrastructure, especially data centers...with fast-tracked permitting and environmental rollbacks to make it happen. That means compliance leaders can't just be auditors anymore. We’ve got to cut deeper: understand how AI data systems are built, how they’re powered, and how permits and permitting shortcuts are changing the ground beneath us. It’s exciting, honestly. We’ve always been the ones asking “How do we know it’s secure?” Now we’re asking “How do we make it responsibly fast?” We’re talking energy grids, environmental impact, Clean Water Act permits, federal land use and how all of that mesh into a compliance posture that keeps pace with the world’s fastest-growing sector!!! P And if you want a deeper dive, this is my latest blog: The AI Action Plan and Data Center Compliance https://lnkd.in/eA63yqh4

33

The California Privacy Protection Agency is pleased to announce that Minnesota and New Hampshire have joined the bipartisan Consortium of Privacy Regulators -- this demonstrates a unified and collaborative approach to enforcement across the states https://lnkd.in/gRKTtyta

59

3 Comments

We just released another new The Identity at the Center Podcast episode! Jim McDonald and I chatted with Matthew Franko from RSM US LLP about the critical connection between identity and cybersecurity. We discussed risk management, attack vectors, building strong identity practices, where IAM should sit in an organization, who should a CISO report to, coaching youth sports, and more! Listen in your favorite podcast app or watch it here: https://lnkd.in/eWCu6JxR #iam #podcast #idac

55

MITRE has announced that U.S. government’s funding to run the CVE (@Common Vulnerabilities and Exposures) program and related efforts like the CWE (Common Weakness Enumeration) will end on April 16, 2025. For more than 25 years, MITRE’s CVE (Common Vulnerabilities and Exposures) program has been a cornerstone of how we talk about and manage cybersecurity threats. It’s helped everyone—from government agencies and large corporations to small businesses—use a shared language to identify and respond to security issues. This could have a big impact on the global cybersecurity community. It’s crucial to understand what this means and how to stay prepared for any disruptions ahead. The CVE database is a crucial resource for anyone working in vulnerability management, cybersecurity research, or threat intelligence. It’s something many people and organizations rely on, and it’s typically supported by the U.S. government, which also heavily uses this information. Huge discussion underway. https://lnkd.in/gWus-Bdc #CVE #MITRE

418

20 Comments

🚨 Key Takeaways from Ashford's SEC Settlement on Cyberattack Disclosure🚨 The SEC recently announced that asset manager Ashford has agreed to settle charges related to misleading disclosures about a 2023 ransomware attack. This case highlights several critical issues in cybersecurity governance and regulatory compliance: 🔒 The Breach: Hackers accessed 12 terabytes of sensitive data, including identity card photos, partial credit card numbers, and bank account details. Despite the severity, Ashford’s early disclosures claimed no customer information was compromised, a statement the SEC challenged. Which is problematic, because they must have known: they either knew and did not disclose, or did not know because their staff was not skilled enough to understand the details. SNAFU. 📄 Regulatory Scrutiny: The SEC’s investigation emphasized the importance of accurate and timely cyberattack disclosures. Ashford’s settlement comes under the agency’s new rules from 2023 requiring companies to report material cyber incidents within four business days. 💰 Cost of Compliance: Ashford’s decision to delist from public markets, citing cost savings, underscores the financial impact of cybersecurity and regulatory requirements on publicly traded companies. 🤔 Shifting Regulatory Landscape: With SEC Chair Gary Gensler stepping down, there is speculation about how enforcement might evolve under new leadership. Will companies face lighter penalties or more flexible disclosure timelines? The Takeaway: This case serves as a reminder that cybersecurity is not just an IT issue, it is a governance priority. For companies, the risks of insufficient disclosure extend beyond financial penalties to reputational damage and erosion of stakeholder trust. As the regulatory environment evolves, organizations must double down on proactive cyber-risk management and transparent communication with investors and customers. What is your perspective on the balance between regulatory oversight and corporate responsibility in cybersecurity? #Cybersecurity #Governance #Compliance #RiskManagement #SEC #Ransomware #DataPrivacy 

36

1 Comment

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

I kicked off this week at the NACD (National Association of Corporate Directors) Annual Summit where I was joined by the amazing Justine Phillips in facilitating a group cyber security tabletop exercise. We had a blast sharing our insights and experience with Audit Committee Directors. Key takeaways: 1. There is so much change and evolution in technology right now that it is more important than ever that the plans and preparation for a cyber attack are rock solid. 2. Key decision making that may take place during a critical incident needs to be well thought through in advance of an attack. 3. Audit and risk committees need to lean in and ask the right questions around cyber preparedness and resilience so that cyber crisis can be avoided in the first place. It was such a pleasure representing KPMG US and spending time with the NACD participants.

90

5 Comments

Threat Feeds or Threat Fatigue? Where’s the Actionable Insight? The recent cyber incident at the U.S. Office of the Comptroller of the Currency (OCC) serves as a stark reminder of the challenges we face in cybersecurity. Despite the vast amounts of threat data collected daily, the OCC experienced unauthorized access to executives' and employees' emails, compromising sensitive information about federally regulated financial institutions . This incident prompts a critical question: Are our current threat intelligence efforts effectively distinguishing actionable insights from background noise? In many organizations, the sheer volume of data can obscure genuine threats, leading to delayed responses or overlooked vulnerabilities. The OCC's experience underscores the necessity for refined threat intelligence processes that prioritize clarity and actionable information over quantity. As cybersecurity professionals, we must evaluate our systems and strategies to ensure we're not just gathering data but are equipped to interpret and act upon it effectively. How is your organization addressing the challenge of transforming vast data into meaningful threat intelligence? #CyberSecurity #ThreatIntelligence #DataAnalysis #OCCIncident #ActionableInsights https://lnkd.in/dCP6E3p3

18

Today the Cloud Security Alliance released Zero Trust Guidance for Small and Medium-Sized Businesses (SMBs). The foundational guidance detailing these evolving principles guide SMBs in adopting Zero Trust as a core cybersecurity strategy. The unique challenges for SMBs are discussed to provide a roadmap for evaluating, implementing, and benefiting from a Zero Trust architecture. As a precursor for SMBs to the CSA Zero Trust Guiding Principles2 foundational guidance, this document offers relevant context and practical steps tailored for SMBs across the five-step methodology. The document and an executive presentation can be found here https://lnkd.in/e32rbmJS Want to get involved? Sign up here https://lnkd.in/eKFHfJMR Thank you to the primary authors: Frank DePaola  Mark Fishburn  Larry Kinkaid  Andrea Knoblauch  Aaron Robel  Alex Sharpe  🔐Michael Theriault And the CISA staff: Erik Johnson  Stephen Lumpe  Stephen Smith Special thanks to Alice Muravin. #cybersecurity #informationsecurity #riskmanagement #executivesandmanagement #zerotrust #SMB

50

11 Comments

In August of 2023, the National Credit Union Administration (NCUA) issued their Cyber Incident #Notification Requirements (23-CU-07), requiring all #CUs to notify the #NCUA of any "reportable" #cyber incidents or notifications from third parties of the same within 72 hours. The NCUA has recently issued Letter 25-CU-02, which updates 23-CU-07 and provides CUs with the Cyber Incident Credit Union Reporting System online form, which can be used to send a secure incident report directly to the NCUA. The NCUA also has additional resources around cyber incident reporting (https://lnkd.in/gbTK_gPP) and Cybersecurity Resources (https://lnkd.in/gRxFrH8C) available. Reminder that regulatory agencies' goals around cyber incident reporting is to provide assistance with the incident where possible, monitor the financial industry for potential repeat threats or trends, and alert other institutions if there is a widespread issue - not to beat up FIs for reporting incidents! Stay safe out there! https://lnkd.in/gaMtHmHM #sbs #sbscyber #creditunion #cybersecurity #technology #incidentresponse

13

3 Comments

The wait continues...CISA has delayed finalizing its cyber incident reporting rule under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) until May 2026. The extension follows significant industry feedback urging clarity, reduced scope, and better alignment with other federal requirements. Key takeaway: The delay offers critical infrastructure operators more time to prepare—but also signals that incident reporting expectations are coming, and they’ll be broad. Now is the time to assess readiness! Read more from CyberScoop: https://lnkd.in/eJThVUaR

12