Heath Nieddu, PhD, CISSP

The Federal Contracting Reality: CMMC Compliance Is No Longer Optional By Professor Gary Vause, II Beginning November 10, 2025, government contractors that handle Federal Contract Information (FCI) must comply with Cybersecurity Maturity Model Certification (CMMC) Level 1 requirements. This marks a major shift in how the Department of Defense and federal agencies enforce cybersecurity across the defense industrial base. Key mandates now include: • Mandatory compliance tied directly to contract awards • Annual cybersecurity self-assessments • SPRS reporting requirements • Continuous compliance during contract performance • Senior-official compliance affirmation • Subcontractor cybersecurity flow-down requirements Failure to comply may result in loss of contract eligibility, suspension of awards, or removal from competitive procurement opportunities. At Vause Computer Systems, LLC, we help government contractors reduce this risk by translating cybersecurity policy into operational readiness. Our advisory services include: • CMMC Level 1 readiness assessments • FCI data identification and protection strategies • SPRS documentation and reporting preparation • Cybersecurity governance and policy alignment • Subcontractor compliance flow-down strategies • Continuous monitoring and audit readiness With more than 30 years of advisory experience in governance, risk, security, and compliance, our role is simple: help contractors protect sensitive federal information and remain eligible to compete for government contracts. For many organizations, CMMC compliance is now the cost of staying in the federal marketplace. #CMMC #GovernmentContracting #CybersecurityCompliance #DefenseIndustrialBase #RiskManagement #VauseComputerSystems #FCI #DoDContracting

1

The Cybersecurity and Infrastructure Security Agency's Infrastructure Security Division is seeking public comment on an extension of its information collection for voluntary vulnerability assessments of critical infrastructure organizations. In a Federal Register notice published last week, the agency requests an additional 60 days for comments on the CISA Vulnerability Assessments program, with submissions due by Sept. 10. The assessments collect high-level information on an organization’s security posture and dependencies and use the data to generate Protective Measures and Resilience Measure indexes that organizations can use for risk identification, mitigation, planning, and security-related decisions.  Under the proposed extension, CISA would continue collecting information electronically through assessments conducted by Protective Security Advisors and Cybersecurity Advisors, or through organizational self-assessments. The agency said changes since its previous Office of Management and Budget approval include moving three cyber-focused questionnaires to a separate system and decommissioning the Stakeholder Risk Assessment and Mitigation, reducing estimated annual respondent burden costs from US$1.91 million to $640,685. The collection covers an estimated 1,100 respondents and 7,150.5 burden hours annually, with information also shared with the Federal Emergency Management Agency for public assistance grant determinations.  Winfield P. Werntz, acting chief information officer at DHS’ CISA, said that the Office of Management and Budget is particularly interested in comments assessing whether the proposed information collection is necessary for the agency to perform its functions effectively and whether the information would have practical utility. More at: https://lnkd.in/d56Q6HPZ

17

1 Comment

Audit Retrospective: Gaps in Mitigating Restrictive Software Licensing A 2023 GAO review found that restrictive software licensing practices impacted Department of Defense cloud computing efforts, yet the DOD lacked the guidance and plans to effectively mitigate these risks. This underscores the persistent challenge of managing vendor lock-in and preserving flexibility in large-scale IT modernization. The audit assessed how restrictive licensing practices affected DOD cloud services and evaluated the department's mitigation efforts, reviewing selected components and investments. Auditors identified that practices like vendor bundling and cross-platform fees increased cloud infrastructure and licensing costs, though specific amounts were not quantified. The review found that vendor restrictions limited the choice of cloud service providers, with some investments effectively locked into a single provider due to cost-prohibitive migration. It noted that the DOD's guidance did not require components to analyze impacts for established IT investments or to develop plans for mitigating adverse licensing terms. The report documented that, of six selected investments, none fully addressed the key industry practices of identifying, analyzing, and planning to mitigate restrictive licensing impacts. Reports like this are critical benchmarks, revealing systemic gaps that drive the development of more robust acquisition and risk management frameworks. The underlying issue of navigating complex vendor agreements to maintain strategic flexibility is universal: what processes has your organization established to identify and mitigate restrictive licensing clauses before they impact cost and operational agility? For detailed findings, review the 2023 GAO report GAO-23-106290, “DOD Software Licenses: Better Guidance and Plans Needed to Ensure Restrictive Practices Are Mitigated.” #GAO #Audit #ITAcquisition #CloudComputing #VendorManagement #RiskManagement #SoftwareLicensing #ContinuousImprovement

1

This is good stuff from CISA. There are some issues here - like what if a cve hasn't been published yet - but it's a much better framework than "patch all the high scores!" The problem is that the tooling for this is mostly balls. Curious if anyone has recs for automated tools that would help implement automation for such a framework. Because when I look at the below, I see a lot of manual evaluation. Perhaps this is where the marriage of agentic frameworks and security analysis tools gives some lift.

1

CISA just retired the flat patching deadline. BOD 26-04 dropped this week, revoking BOD 22-01 and 19-02. Remediation urgency for federal systems is now set by four factors: public exposure, KEV status, exploit automatability, and whether the vuln yields total system control. The combinations map to timelines ranging from 3 days down to “fix it at the next upgrade.” Most coverage is focused on the 3-day clock. The part I think deserves more attention: the forensic triage requirement. For top-tier findings, patching alone no longer closes the book. Agencies must assess whether the system was already compromised and document what they found, or didn’t. A verbal all-clear is dead. The tangible artifact is the requirement. The other underrated detail: public exposure is the one variable agencies determine themselves. Your asset inventory just became deadline math. If you can’t say with confidence which assets are internet-reachable, you can’t say which clock you’re on. This is mandatory for FCEB agencies only. But BOD 22-01’s KEV catalog became the de facto prioritization signal far beyond government, and we can expect this four-factor model to follow the same path. Honest question for anyone running a vuln management program, federal or not: could your team produce a documented compromise assessment on a 3-day clock today? https://lnkd.in/ga9hjM58 #Cybersecurity #VulnerabilityManagement #CISA #FISMA #RiskManagement

4

1 Comment