Blog

What You Need to Know About 800-171 Revisions

The long awaited NIST 800-171 Revision 2 and 800-171B drafts were released for comment today. There have been no major changes to the controls in Revision 2. This is good news for many in the DIB who have been diligently working to implement and maintain the security requirements. Of more interest is 171B enhanced security… Read more »

Join Sera-Brynn on June 21 in DC @ the CUI Industry Day

Sera-Brynn is excited to be part of the National Archives and Records Administration (NARA)’s 2nd Industry Day on the Controlled Unclassified Information (CUI) program. The one-day event (free and open to the public) is a good spot to connect face-to-face with some of the Sera-Brynn team, and check out the services that have been developed… Read more »

Pentagon to Unveil New Cybersecurity Maturity Model Certification (CMMC) for Defense Contractors

The Department of Defense announced that it is developing a new cybersecurity standard and certification for defense contractors. It is named the “Cybersecurity Maturity Model Certification” (CMMC). Notably, the intent of the CMMC is to improve cybersecurity deficiencies in the defense industrial base and secure the supply chain. The CMMC is expected to be based… Read more »

Pop Quiz: When is Pen Testing a Compliance Requirement?

We live in a world where organizations are required to pen test their IT systems and networks. Sometimes. Do you know when penetration testing is required? Or when it’s industry standard? Or when it’s just a good idea? Penetration testing, sometimes called ethical hacking, simulates real-world ways hackers can compromise network and IT assets. The… Read more »

GLBA is About to Get a Cybersecurity Upgrade

If you aren’t a regular reader of the Federal Register, you may have missed a proposed upgrade for safeguarding customer information. Background When the Gramm Leach Bliley Act, fondly known as GLBA, was enacted in 1999 we were worried about Y2K, a gallon of gas cost $1.22, and SpongeBob SquarePants had just premiered on Nickelodeon…. Read more »

An Analyst Perspective: Sera-Brynn’s Report on NIST 800-171. Is Compliance Achievable?

Sera-Brynn’s report, “Reality Check: Defense Industry’s Implementation of NIST SP 800-171. Keen insights from certified cybersecurity assessors,” was published in May 2019. If you didn’t have time to read it, it tells the story of an industry struggling to fully comply with the controls of NIST 800-171, which are required to protect sensitive Government data…. Read more »

Cybersecurity Training Is Not Optional…Unless You Are in the House

Congressional Cybersecurity Training Resolution will mandate training for elected officials. Cybersecurity risk management is about understanding why you are a target, how you will be attacked, and the fallout if an attack is successful. Election security is a big deal. Right now, Florida is trying to get a handle on exactly who might have  been… Read more »

Press Release: Report on Defense Industry Implementation of NIST 800-171 Security Controls

Sera-Brynn releases “Reality Check: Defense Industry Implementation of NIST SP 800-171” – a get-real analysis of its cybersecurity assessments in the defense industry.  The report provides the insights, charts, graphs, and statistics that tell the story of an industry struggling with compliance.  FOR IMMEDIATE RELEASE:  May 15, 2019, SUFFOLK, VA.  Today, the certified cybersecurity assessment… Read more »

Data Security under the California Consumer Privacy Act: Instructions Not Included

“Reasonable security.” If you’re a California business, this is what’s generally expected of you (e.g., Cal. Civ. Code § 1798.81.5).  If you collect personal data, you are expected to secure it.  But what’s the right level of cybersecurity under the California Consumer Privacy Act of 2018 (CCPA)?  Are specific frameworks recommended? Let’s wade into the… Read more »

Cybersecurity Frameworks – A (Hard)Core Feature of The Ohio Data Protection Act

In 2018, Ohio – the home of the Rock & Roll Hall of Fame – enacted a cybersecurity law that rocked cybersecurity frameworks. The Ohio Data Protection Act (“ODPA” or the Act) creates a safe harbor for organizations that adopt one of ten cybersecurity compliance frameworks. This is unique. Most other state cybersecurity laws don’t… Read more »