Thomas Follo

Defense Information Systems Agency Deputy Director Chris Barnhurst recently spoke at the AFCEA TechNet Cyber 2025 conference and he highlighted the milestones the Thunderdome program has achieved, the agency's priorities, and the importance of partnership with industry. "At DISA, we are a team (...) if you contract with DISA, you're on the team," he stated. Thunderdome has been an example of what good collaboration can accomplish, and certainly industry is ready to tackle any other modernization goals. https://lnkd.in/dWimk9Xt #disa #govcon #industry #thunderdome #nationalsecurity #nationaldefense #cybersecurity #zerotrust

22

🛰️ U.S. Army — C5ISR MAPS Professional Services IDIQ (Pre-RFP) Army Materiel Command (AMC), through Communications-Electronics Command (CECOM), is planning a major knowledge-based professional services IDIQ to support C5ISR mission requirements across the Army. This effort reflects the merger of RS3 and ITES-3S into the new Marketplace for the Acquisition of Professional Services (MAPS), creating a unified, flexible vehicle for engineering, technical, and staff augmentation support. 📣 Key Details 📄 Solicitation No.: W15P7T25RMAPS 💼 Est. Value: $50B (Deltek) | Small Business & Full & Open 🔎 Engineering, Scientific & Technical Services | IDIQ 📅 Est. Solicitation: Apr 2026 | Est. Award: Aug 18, 2027 📍 CONUS & OCONUS | Aberdeen Proving Ground, MD NAICS 541715 | 5-Year Base + 5-Year Option 🔐 CMMC Certification Required Additional Notes 📅 Industry Day: Jan 28, 2026 (Virtual & In-Person) ❓ Draft RFP Q&A Due: Jan 27, 2026 @ 2:00 PM ET 📣 Up to 50 awards anticipated per domain (mix of SB, Large, and Commercial vendors) #FederalContracting #USArmy #C5ISR #MAPS #ProfessionalServices #DefenseContracts #IDIQ #PreRFP #NAICS541715

121

6 Comments

Zoom for Government has received authorization from the Defense Information Systems Agency (DISA) for Department of Defense (DoD) IL4 NIPRNet and internet-facing communications 👉 https://zm.me/41P0yPq This continues our previous DISA authority and Air Force Authority to Operate but now adds IL4 collaboration directly behind the DoD Boundary Connection Access Point or BCAP. This authorization reflects DISA’s rigorous review and reinforces their trust in Zoom for Government as a secure and robust platform for DoD and its mission partners.

132

4 Comments

The Deputy Secretary of Defense has issued a directive to disestablish JCIDS (Joint Capabilities Integration and Development System) and reform the way the Department identifies and funds requirements. For DoD civilians: - less process - more speed - tighter budget alignment For industry: - earlier access - more transparency - better chances to cross the valley of death (if solutions are aligned with Joint Force problems) https://lnkd.in/gWXbcvJ3

182

15 Comments

🔒 For defense agencies, compliance isn’t optional — it’s mission-critical. This agency modernized with Clovity + Atlassian, achieving: 🔹45% faster compliance audit readiness 🔹Automated approval workflows 🔹Centralized, secure data access 🔹Real-time dashboards for oversight 👉 Discover how mission-critical compliance was achieved without slowing down operations. #Defense #Compliance #DoD #Atlassian #Clovity

8

1 Comment

Fail of Fame: ClearanceJobs.com 1. CSP set to “Please Hack Me” default-src * blob: data: 'unsafe-inline' 'unsafe-eval' • This is the CSP equivalent of leaving your front door open with a neon “WELCOME” sign. • Allows any script from anywhere, runs any inline code, and even executes arbitrary strings with eval(). • Impact: Any XSS bug instantly becomes full account compromise, data theft, or drive-by malware. No browser-side safety net at all. 2. CORS Misconfiguration From Hell Access-Control-Allow-Origin: *.clearancejobs.com + Access-Control-Allow-Credentials: true • Wildcard origins aren’t valid with credentials — browsers should ignore it, but backend logic could still misapply it. • If improperly enforced server-side, this could let a malicious subdomain read authenticated API responses. • Impact: Potential data leakage of personal info, resumes, or job activity from logged-in users. 3. Permissions-Policy? Referrer-Policy? COOP/CORP? Nope. • Zero modern isolation headers to reduce the blast radius of a compromise. • Impact: Easy clickjacking, over-sharing of referral data, and no site isolation to contain injected code. 4. Audience Risk Profile Off the Charts • The user base isn’t random shoppers — it’s people with active or pending security clearances, working in defense, intel, and government. • Impact: An XSS or session theft here isn’t just personal inconvenience — it’s an espionage goldmine. 5. CloudFront Popcorn Machine • Sitting behind AWS CloudFront, so an attacker only needs one injection point in any origin server to serve malicious code globally in minutes. • Impact: Massive scale, instant reach, global compromise in one hit. 6. No Defense in Depth • No content isolation, no sandboxing, no enforced HTTPS beyond HSTS, and no selective resource loading. • Impact: Everything depends on backend code being flawless — and backend code is never flawless. Translation: Right now, any competent attacker who finds a small injection or misconfig on ClearanceJobs.com could: • Steal logins and personal data from people with active clearances. • Pivot to spear-phishing campaigns targeting high-value individuals. • Potentially harvest sensitive employment history that could be used for foreign intelligence targeting. Source:

22

11 Comments

There are no waivers for defense contractors who need to comply with the cybersecurity requirements in contract clause DFARS 252.204-7012. Ultimately, if you need to vary from the baseline requirements, you need to make a case to the DoD Chief Information Officer (Katie Arrington) But getting that request to the CIO can be circuitous for subcontractors. How? The guidance has been in solicitations and contracts since 2016: 𝗗𝗙𝗔𝗥𝗦 𝗽𝗿𝗼���𝗶𝘀𝗶𝗼𝗻 𝟮𝟱𝟮.𝟮𝟬𝟰-𝟳𝟬𝟬𝟴(𝗰)(𝟮)(𝗶) 𝗮𝗻𝗱 (𝗶𝗶): "If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that are in effect at the time the solicitation is issued ... the Offeror shall submit to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO), a written explanation of— - Why a particular security requirement is not applicable; or - How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection. An authorized representative of the DoD CIO will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. 𝗔𝗻𝘆 𝗮𝗰𝗰𝗲𝗽𝘁𝗲𝗱 𝘃𝗮𝗿𝗶𝗮𝗻𝗰𝗲 𝗳𝗿𝗼𝗺 𝗡𝗜𝗦𝗧 𝗦𝗣 𝟴𝟬𝟬-𝟭𝟳𝟭 𝘀𝗵𝗮𝗹𝗹 𝗯𝗲 𝗶𝗻𝗰𝗼𝗿𝗽𝗼𝗿𝗮𝘁𝗲𝗱 𝗶𝗻𝘁𝗼 𝘁𝗵𝗲 𝗿𝗲𝘀𝘂𝗹𝘁𝗶𝗻𝗴 𝗰𝗼𝗻𝘁𝗿𝗮𝗰𝘁." 𝗗𝗙𝗔𝗥𝗦 𝗰𝗹𝗮𝘂𝘀𝗲 𝟮𝟱𝟮.𝟮𝟬𝟰-𝟳𝟬𝟭𝟮(𝗯)(𝟮)(𝗶𝗶)(𝗕): "The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the DoD CIO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be nonapplicable or to have an alternative, but equally effective, security measure that may be implemented in its place." Of course, if you're a subcontractor you definitely don't want to be going around the prime which is why DFARS 7012(m)(2)(i) says: "Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer" 𝗥𝗲𝗺𝗲𝗺𝗯𝗲𝗿: CMMC verifies the baseline you agreed to in your contract (variances and all) which is why 32 CFR 170 § 170.24(c)(8) says: "If an OSC previously received a favorable adjudication from the DoD CIO indicating that a security requirement is not applicable or that an alternative security measure is equally effective (in accordance with 48 CFR 252.204-7008 or 48 CFR 252.204-7012), the DoD CIO adjudication must be included in the system security plan to receive consideration during an assessment. A security requirement for which implemented security measures have been adjudicated by the DoD CIO as equally effective is assessed as MET if there have been no changes in the environment." Waiting until assessment day to plead your case for non-applicability is a dangerous, expensive game.

58

10 Comments

A new survey from MITRE says that a majority of non-traditional defense contractors face barriers of inflexibility and complexity in the acquisition process. As DoD tries to bring more innovation and flexibility into its stable of contractors, what really needs to change to make this possible? Keoki Jackson of MITRE joined the Federal Drive with Terry Gerton to share more about the survey's results. https://lnkd.in/dFXpvB8G

41

1 Comment

#CMMC Tidbit for today. #MSSPs and #MSPs supporting Defense Industrial Base (DIB) companies are both in scope and required to participate in a #CMMC assessment. This is hard-coded into the CMMC Assessment Process (CAP) document. "1.6. If the OSC has identified an ESP as being within their CMMC Assessment Scope, the Assessment Team shall confirm that a Customer Responsibility Matrix (CRM) will be available and that ESP personnel will be present and actively participating in the assessment. " "Actively participating in the assessment." This can, and often is, a showstopper in getting a CMMC certification assessment. An ESP is an MSP or MSSP (simply put). This is NOT optional. Just having a Shared Responsibility Matrix (SRM)/Customer Responsibility Matrix (CRM) alone is not enough. That is required too, but not enough by itself. Many MSPs and MSSPs think they have no responsibilities for CMMC. This is incorrect and not how CMMC is constructed. If you are an MSP or MSSP and want to keep your DIB customers, then you must start to figure out how CMMC applies to you and your systems. It does. If you are in the DIB and have a MSP or MSSP then they are in scope and must **participate** in your CMMC assessment. If there are questions about their preparation, then that is something to start working on now. We anticipate that the CMMC contract clause will begin appearing in contracts late this year. When you are trying to schedule a CMMC assessment is not the time to be figuring this out. https://lnkd.in/gvZDMYR6 Jacob Horne, Bobby Guerra, Amira Armond, Glenda R. Snodgrass, Wayne Boline, Katie Arrington, Stacy Bostjanick (PS Katie and Stacy. Some strategic communication with the MSP world, perhaps speaking at an MSP conference rather than a DoD conference, would probably help close the gap in understanding)

89

36 Comments

DoD Finalizes CMMC Rule: Cybersecurity Now a Contractual Requirement Introduction The Department of Defense has issued its final rule incorporating the Cybersecurity Maturity Model Certification (CMMC) into the Defense Federal Acquisition Regulation Supplement (DFARS). Effective September 10, 2025, contractors must meet enforceable cybersecurity standards to remain eligible for DoD contracts, making verified protection of sensitive information a contractual condition. Key Details • CMMC Program Basics • Establishes tiered cybersecurity requirements for contractors managing Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). • Compliance is now mandatory, not voluntary, for contract awards. • Evolution of the Rule • Builds on the October 2024 CMMC Policy Rule, which set program structure and assessment methodology. • The DFARS Final Rule moves the framework from principle to enforceable contract law. • Certification Levels • Level 1: Basic cyber hygiene to protect FCI. • Level 2: Advanced practices aligned with NIST SP 800-171, required for contractors handling CUI. • Level 3: The highest tier, requiring expert cybersecurity measures for the most sensitive environments. • Enforcement & Impact • Contractors must undergo assessments, either self-attestation (Level 1) or third-party certification (Levels 2 & 3). • Compliance will be written into solicitations, contract modifications, and option exercises. • Non-compliance risks disqualification from bidding and contract loss. Why It Matters The finalization of the CMMC DFARS Rule represents a watershed moment for the Defense Industrial Base. Cybersecurity is now a prerequisite for doing business with the DoD, placing accountability on every contractor and subcontractor. With adversaries targeting sensitive defense data, CMMC ensures verified safeguards are in place, reshaping procurement and raising the cybersecurity bar across the industry. 🔒 Ready or Not: CMMC Rule Cleared for DoD Contractors 👤 CEOs, COOs, CFOs, CISOs, CCOs, Heads of Procurement — the clock is ticking. Proud to spotlight @Churchill & Harriman and Ken Peterson, CTPRP, for demonstrated leadership in CMMC readiness. Why it matters • You must be able to accurately attest to your CMMC environment. • The Churchill & Harriman (C&H) delivery team has delivered or is currently working on over 50 CMMC Level 2 engagements. • 30 years of successful execution across government and industry. If you’re not ready, expect: • ❌ Lost contracts • ❌ Forfeited revenue • ❌ Reputational damage ⚠️ Your Value at Risk is real. Next step 👉 Partner with validated experts to get C3PAO assessment-ready and protect what matters most. 🔗 https://lnkd.in/gp-WhRW4 📧 info@chus.com Ken Peterson, CTPRP #CMMC #CyberSecurity #DefenseIndustrialBase #AuditReadiness #RiskManagement #DoD #Compliance

7

1 Comment