The #1 Problem in Cybersecurity: The Truth You Don’t Want to Know
The Truth You Don’t Want to Know My new favorite saying, and it seems to be rampant in the halls of success, but perhaps nowhere more so...
top of page
Vincent Scott
Jan 5, 20228 min read
Scoping Guide
Although the new Cybersecurity Maturity Model Certification (CMMC) Scoping Guides bring much needed clarification, specific aspects of...
Vincent Scott
Dec 11, 20214 min read
The FedRAMP System needs updating; it was never intended for commercial use
As we move forward with accountability around cyber for the Defense Industrial Base (DIB), the specific language in the rules, controls,...
Vincent Scott
May 31, 20218 min read
How Do We Right the CMMC Ship?
Previously I wrote CMMC Trip to Tartarus story under the banner “CMMC is impossible and here is why!” I did not receive many comments...
Vincent Scott
Apr 22, 20216 min read
CMMC: A Trip to Tartarus
So I normally don’t go in for the sensationalized headline. I abhor them in fact, but in this case, I think it is needed. Put the breaks...
Vincent Scott
Apr 19, 20217 min read
CMMC and the Challenge of Documentation
History A long-time requirement for any auditable process or standard has been documentation. I sometimes think that early cave paintings...
Vincent Scott
Jan 26, 20213 min read
Observations from a CMMC Protest paper: A plain English translation
I have put this together as a review of the paper posted by Bob Metzger’s law firm, New DOD Cyber Rules Create Fertile Bid Protest...
Vincent Scott
Jan 17, 20213 min read
Cyber Operations, Cyber Standards, and Solar Winds
In the course of the much appreciated exchange of ideas in a LinkedIn thread, the concept of Cyber Standards like CMMC (the new DoD...
Vincent Scott
Dec 12, 20205 min read
CUI, DFARS, and the Catch-22
Federal Government: "Put CUI controls in place so we can give you a contract." Federal Contractors: "No. Give us the contract and tell us...
Vincent Scott
Nov 22, 20203 min read
Cybersecurity in an Uncertain World
For a commercial enterprise, how much cybersecurity investment needs to be determined from a risk assessment based on a number of...
Vincent Scott
Aug 5, 20203 min read
Is Your Dashboard Zombie Green?
Some years ago a good friend of mine sarcastically quipped, "Yeah that scorecard is green, Zombie Green!" It became a running joke on our...
Vincent Scott
Apr 29, 20206 min read
FAR, DFAR, and NIST 800-171; The Complexities of Compliance
The Short Answer For anyone who wants to skip to the end, here it is. In order to be DoD cybersecurity compliant today, you should have...
Vincent Scott
Apr 24, 20204 min read
What is in a Password
Passwords are ubiquitous in terms of modern information security. So much so that considering if the current password policy we have is...
Vincent Scott
Mar 4, 20202 min read
A Case Study in Poor Risk Assessment
Assessing Coronavirus risk is an interesting case study in how humans broadly assess risk and do so very poorly. Everyone on the planet...
bottom of page