Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

FedRAMP is the federal government’s framework for evaluating and enforcing standardized security across the cloud service providers operating as contractors. They take security seriously, and the protection of controlled information is their top priority. A key part of validating the security of a CSP is the SAR, or Security Assessment Report. What is the SAR, and how do FedRAMP agencies evaluate SAR submissions?

Companies that need to comply with CMMC to earn their governmental contracts have a lot of work ahead of them. Securing their systems against intrusion and protecting data from breaches, malicious actors, and snooping is all part and parcel of the program. One aspect of information security that can be distressingly easy to overlook is disposal.

Here on the Ignyte blog, we talk a lot about ISO 27001 as a valuable international framework for information security. We also frequently touch on two related documents: ISO 27002 and Annex A. As you may know, ISO/IEC, the organization responsible for developing the various ISO standards, has a lot of different standards for a lot of different purposes.

As one of the most common information security frameworks in the world, ISO 27001 is used by tens of thousands of organizations worldwide. That means it has to fit a lot of different groups with a lot of different needs. It also means that there’s a lot of information pertaining to ISO 27001 within each of those companies. Data like the logs of access control systems, the chain of custody for sensitive information, and the results of audits are all stored somewhere.

Ask anyone on the outside of information security what the most important part of the industry is, and you’ll get a lot of different answers, but among them will be cryptography. Using strong encryption to hide information where it can’t be accessed without the proper authorization makes a lot of sense, and the idea of strong cryptography has saturated popular culture.

Here on the Ignyte blog, we talk a lot about the most important cybersecurity frameworks for the federal government, including FedRAMP and CMMC. There’s a lot that goes into these frameworks, with contributors all across the information security world, but one of the more important agencies is DISA. The United States Defense Information Systems Agency, formerly known as the Defense Communications Agency, is the DoD sub-agency responsible for IT services and security for the Department of Defense.

We’ve known it’s been coming, but it’s finally here: CMMC is no longer optional. Approval to issue the new Final Rule was fast-tracked, and the deadline is looming.

CMMC is a strict and difficult standard to meet, which leads a lot of companies to wonder: how necessary is it, really? After all, CMMC is not alone in the world of security and compliance. There are a lot of other frameworks, both within the United States (like FedRAMP) or internationally (like ISO 27001). Companies that meet other compliance standards and have systems in place, like an ISMS or a QMS, might wonder: Is CMMC still required?

CMMC is a strict certification, but there’s also a lot of variation within its security controls and the demands it makes of agencies looking to achieve that certification. The standards are high, especially at the higher levels of CMMC, but there are also many tools and platforms available to meet those needs appropriately, without reinventing the wheel from base principles. Businesses need the tools necessary to function in a modern digital world.

The first C in CMMC stands for cybersecurity, so it makes sense that the vast majority of content and information about it (both here and elsewhere online) is focused on the cyber aspect. Digital security makes up the bulk of the certification, and it’s by far the biggest threat vector in a modern business space. There is, however, still that detail that has to matter sooner or later: the fact that everything digital has to have somewhere it lives in physical space.