Dear Dr. RMF, In my research I cannot find any Agency level documentation that states this, however, I have located examples of contracts that have PII guidance pertaining to contractors. So, would it be considered compliant if I have examples of the contracts or should this be documented at Agency…
Dear Dr. RMF, What is the purpose of having all personnel register at the DTIC website to receive update notifications? If we do not implement this, do we need to submit POA&M for risk acceptance to the AO? Why DTIC, Regarding CA 1.6, the expression “What were they thinking?” comes…
Dear Dr. RMF, In my office we are disputing the intent of RMF Control SA-4(9), i.e., whether it can be inherited or if it is intended to be system-specific. The control description states organization but the compelling evidence call for SSP. Furthermore, the AP procedures calls for contract / agreements to be inspected. …
By Kathryn Daily, CISSP, CAP, RDRP Despite the current pandemic, the CMMC AB (Cybersecurity Maturity Model Certification Accreditation Body) is moving right along. They have now announced the requirements to become a Certified Professional (CP), Certified Assessor (CA), Certified Third Party Assessment Organization (C3PAO), or Registered Practitioner. The C3PAO will…
By Lon J. Berman, CISSSP, RDRP 2020 has been a turbulent year, to say the least. When it comes to operating and maintaining our information systems, a lot of the “usual routine” has been disrupted in the name of health and safety. In spite of all this turmoil, the need…
By Kathryn Daily, CISSP, CAP, RDRP CMMC is still a hot conversation topic in the DoD world. The model as well as the process surrounding the model continue to develop and has largely stuck to the initial schedule set out by Katie Arrington at the onset of this project, no…
By Philip D. Schall, Ph.D., CISSP, RDRP BAI RMF Resource Center is pleased to announce the RMF Micro Edition Video Series created in collaboration with CompTIA. Below is a summary of the course content as described by BAI’s lead trainer, Linda Gross: “BAI, in partnership with CompTIA, recently produced a…
By Grace Brammer, RDRP As an undergraduate computer science student, I often find it difficult to connect my work in academia to real-world cybersecurity implementation. While demand in the tech industry continues to grow, studying for a technical degree in college is both exciting and stressful. Unfortunately, the stress compounds…
Dear Dr. RMF, I am doing an annual review for an information system I have. Originally, this was inherited from our network boundary, but in reviewing this again it speaks specifically to information systems, which from my under-standing this cannot be inherited. If I am reading this control correctly it…
Dear Dr. RMF, I have an information system that is current-ly being assessed and authorized and the boundary consists of desktops, laptops, printers, a major OS, and about 10 to 15 applications, which is spread throughout an enterprise. In reviewing the DoDI 8510.01 and the definition of IT products it…
