Rick Driggers

The Cyber Guild continues to move the needle by growing the field of cybersecurity professionals

129

13 Comments

Is the #DoD leveraging enough for space dominance? C4ISRNET emphasizes the need for stronger collaboration in space strategy and how industry solutions could be key to protecting assets and countering threats. Read more here: https://carah.io/f06ad49

5

As we near finalization of the 32 CFR Part 170 component of the #CMMC rules, a top priority for DoD leadership should be on the subjects of Management, Oversight, Administration, and Stakeholder Participation. I remain anxious about the overall feasibility of the CMMC program once the rules are finalized. Seemingly small “features” of the proposed 48 CFR rule, for example the obligation to report “any lapses or changes” to information systems to COs, further aggravate burdens and costs upon contractors with no better than dubious benefit to warfighters and requiring activities. Too much of a doubtful thing, IMO, is not a better thing. There is both complexity and rigidity in these regulations, as all know. But there is no corresponding or proportionate oversight and management, by DoD, and nothing, at present, that enables regular interchange between government and industry stakeholders. This is potentially hazardous to all concerned. When this regulatory complex is applied to tens of thousands of companies at the ground level, we will encounter, immediately, difficult problems in application. These will be frustrating, at least, to contractors. Such problems may disrupt supply chain continuity, for DoD requiring activities and warfighters, as some companies will exit and more will fail assessment requirements. Yet, I do not now see promised, articulated, or actuated, mechanisms within the Department to coordinate a response to the inevitable “deployment” issues. The issues are not self-correcting. These issues must be resolved and means must be fashioned to communicate within the Department, and to industry, both the problems and their resolutions. At the very least, we need something like the National Industrial Security Program Policy Advisory Committee, NISSPAC, https://lnkd.in/gBSTDnqn, which was created under an Executive Order to foster public-private communications for industrial security programs. Even more important, DoD must increase the funding, resources, and authority of entities or organizations charged with the oversight and management of the CMMC program. While the regulations were created by the Office of the DoD Chief Information Officer, contractual implementation is largely the responsibility of Office of the Under Secretary of Defense for Acquisition & Sustainment. CMMC also has obviously importance to USD/I&S, USD/R&E and USD/Policy. An immediate priority should be to create and formalize an Executive Steering Group, reporting to the Deputy Secretary of Defense (DSD), to include representatives from these and other entities with national security responsibilities (e.g., ONCD, NSC, ODNI, NSA). The role and resources of both DCMA and DCSA should be increased with a focus on CMMC implementation. The Department must have a workforce trained and capable of CMMC situational response and general guidance. If I misapprehend DoD’s planning and readiness to manage, I hope to be corrected. Personal opinion.

52

9 Comments

Read Guidehouse Defense and Security's new article, Managing Change Fatigue in the Federal Workforce, outlining our team's recommendations for agencies looking to produce better outcomes in the face of complex workforce challenges: https://lnkd.in/eZ5rEVxh.

3

Read Guidehouse Defense and Security's new article, Managing Change Fatigue in the Federal Workforce, outlining our team's recommendations for agencies looking to produce better outcomes in the face of complex workforce challenges: https://lnkd.in/ep3bnyPS.

1

Read Guidehouse Defense and Security's new article, Managing Change Fatigue in the Federal Workforce, outlining our team's recommendations for agencies looking to produce better outcomes in the face of complex workforce challenges: https://lnkd.in/eXD7JN7V.

6

Another big win for Shift5. BAH knows the value that Shift5's "full take" data capture and analysis brings for both cyber security and conditions based maintenance.

28

Continuing the Federal #Data and #AI Mission Outcomes series, discover how Booz Allen advanced data & analytic solutions for the National #COVID-19 response. Read more here. https://lnkd.in/dFbC6rDs

3

All organizations experience change. The federal government is no different. Read the new Guidehouse Defense and Security article, Managing Change Fatigue in the Federal Workforce, presenting recommendations for agencies to produce better outcomes and results in the midst of complex workforce challenges: https://lnkd.in/eTQyA4KE.

3

Are you a small business navigating the complexities of #CMMC compliance? If you have concerns or are seeking guidance, I encourage you to check out this new pilot program. It’s designed to help small businesses meet #cybersecurity requirements and protect sensitive information. Don’t let CMMC compliance be a barrier—explore the resources and support available through this initiative. #SmallBusiness #Cybersecurity #Compliance #CMMCPilot https://lnkd.in/eb9hEVHh

17

Check out ATARC's latest White Paper: Navigating Cyber Challenges: Federal Agencies in the Digital Age! 🌐 In a recent roundtable, Federal experts discussed the various challenges and opportunities of navigating a rapidly evolving cyber landscape. Read along here - https://ow.ly/rFrJ50R9iYY #security #risk #cyber

7

The Pentagon's new ATO guidance is set to speed up IT modernization by making the approval process clear and quick, a big plus for tech companies working with the DOD. Shoot us an email at [email protected] to see how we can help your company adjust smoothly to these changes. Check out our insights: https://buff.ly/47BKJgo. #DevOps #AI #expertsatyourservice #businessstrategy #Strategicexcellence #Corporateadvisory

2

Government Contracting #govcon seems to be a labyrinth 😕to many outsiders and newer folks coming into the space. I once created an Access database🧮 at a previous employer many years ago to highlight the importance of good data management and common unique identifiers... As the company tended to have some byzantine processes and nomenclature that I was trying to flesh out and focus 🔍on measuring the things that matter. So I've seen quite a bit of diverse contracts from over $100M 💰annual jobs to ones under $100K. I believe the process is essentially the same to ensure a smooth transition from pre-award to 🥇post-award. It starts with being able to accurately code 🔣your contract into your system of record. Do your #proposal 📚and #pricing 💵documents match the contract award 📝documents? Check that before you 🖋sign! Had an experience recently where there was some ambiguity 😵with a contract modification document in what it was doing as it relates to the changes we proposed. Some contracts get complex when you get to a dozen mods or so with many CLINs, SLINs, and 🗜ARCNs... IYKYK We both had differing interpretations🗣 as we worked through the document. There was a 💪🏼challenge with all the moving parts and new CLINs added and old ones removed and it turns out that we both had the same initial confusion that it wasn't done correctly... However, when we dug ⛏deeper into the changes in Section B (contract values) and Section G (funding values) we determined that this customer was doing It's important to have a uniform 🥋methodology on how you read and review your contract documents before you sign it and book the funding and contract values in your accounting system. Set your books up right the first time, or you'll pay💸 for it over-and-over again each month. And get the right people 🤼 and departments involved! Make it a great week 👊🏼

15

5 Comments

The GAO report highlights the barriers faced by federal agencies when implementing cybersecurity risk management processes. Addressing these hurdles ensures a strong and resilient cybersecurity posture. One of the key areas for improvement is the need to refine cyber risk evaluation methods. Currently, federal agencies heavily rely on the Common Vulnerability Scoring System (CVSS) to assess the criticality of security vulnerabilities in software applications. However, this system has its limitations. A more nuanced approach that considers multiple factors would enable a more sophisticated and effective response to cybersecurity threats.

5

We have the opportunity to collaborate with some of the best technology companies in the industry to match capabilities to critical government needs. In discussion with government, one of the common questions that you will hear is, "What TRL is the technology." Technology Readiness Level, or TRL, determines whether a technology in mature enough to include in a larger system. In 1999, the GAO published an influential report called, Best Practices: Better Management of Technology Can Improve Weapon System Outcomes. This report concluded that using immature technology increased program risk and recommended wider use of TRLs. The revised and reissued report is a great reminder of best practices for evaluating the readiness of technology for use in acquisition programs and projects. The Office of the Under Secretary of Defense for Research and Engineering also published a Technology Readiness Assessment Guidebook in June 2023. C5BDI Office of the Under Secretary of Defense for Research and Engineering NavalXDoD SBIR/STTR Program Office Naval Sea Systems Command (NAVSEA)Naval Air Systems Command (NAVAIR) Marine Corps Systems Command

10

1 Comment

Want to learn how to apply practical, governed decisions with #AI? Join  my company’s Chief Data Officer, Justin Magruder, on July 17 from 8:30 - 9:15 a.m. ET during the #CDOIQ2024 Symposium to dig how to accelerate decision making while staying government compliant.

23

1 Comment

I was thrilled to learn that the U.S. Department of State plans to establish three Federally Funded Research and Development Centers (#FFRDCs): public-private partnerships that conduct innovative R&D for their USG sponsors on topics that cannot be effectively met by the government or the private sector alone. FFRDCs are required to have a long-term strategic relationship with the agency that supports them, allowing the FFRDC to recruit and retain scientific and technical expertise, conduct R&D to meet the needs of the sponsoring agency; and offer independent scientific and technical advice. From my days as an FSO at State and as a consultant on national security and technology for the past five years, I’ve strongly advocated for State to join its Executive Branch brethren – Commerce, NIST, DOD, NSA, Energy, HHS, DHS, NIH, Treasury, Transportation, Veterans Affairs, NASA, NSF, the Social Security Administration, and the Nuclear Regulatory Commission – in establishing an FFRDC. This was a recommendation I encouraged the National Security Commission on Artificial Intelligence to include in its 2021 Final Report to the White House and Congress, so it’s heartening to see State finally proceed.  Better late than never! State wants to create three FFRDCs to conduct R&D on: (1) Operational support for acquisition planning and development for new technologies; and operational analysis to identify institutional and capability gaps and how to fill them; (2) Emerging threats, concept exploration, and experimentation and evaluation, developing new concepts, models, prototypes, and proof-of-concept demonstrations, and test-beds, and (3) #IT and #Cyber Operations. I hope this important step, when implemented, will facilitate two more steps that State should take to be a global leader on technology for diplomacy for the rest of the 21st century: (1) Establish an in-house “Technology for Diplomacy” R&D lab that builds off of the FFRDC's work, to conduct internal R&D, prototyping, scaling, and deploying of #AI and other emerging technologies that empower American diplomats, and (2) Fund "Small Business Innovation Research" (#SBIR) Grants to leverage the innovative and entrepreneurial talents of U.S. small technology companies to offer their own innovative tech ideas to bolster US diplomacy and build a private sector constituency for the State Department in America’s vibrant tech startup ecosystems. All of this in due time. The immediate next step is for innovation stakeholders (like FedTech) to give feedback on the proposed scope of the work to be performed by the FFRDCs and on already-existing capabilities in these areas that the Department should consider. Exciting to see State make a long-term commitment to #innovation #technology #entrepreneurism #startups #diplomacy #natsec #leadership.

68

3 Comments