As the cyber threat landscape becomes increasingly dominated by state-sponsored actors and advanced persistent threats, the DoD has taken critical steps to evolve its cybersecurity requirements for defense contractors.

For contractors handling Controlled Unclassified Information (CUI) and seeking to achieve CMMC Level 3, the NIST SP 800-172 Enhanced Security Requirements represent the most stringent technical and procedural benchmarks currently required in the Department of Defense (DOD) Industrial Base (DIB).

This article examines the practical application of NIST 800-172 controls, focusing on the advanced security capabilities, resilience engineering, and operational maturity required for high-trust environments.

Read More

Over the past week, a new vulnerability in the Linux operating system and the XZ compression utility has led to a new security alert and an immediate call to roll back some new updates. While this threat is a massive problem for federal IT systems relying on specific Linux distributions, it also highlights how poorly managed open-source projects can fundamentally undermine federal security. It also demonstrates how state-sponsored actors can use these projects as a staging ground for more extensive Advanced Persistent Threats. 

Read More