Suggestions
Connor Payne
GRC Automation | CISSP | CMMC CCA
Connor Payne is a professional with a strong background in Information Technology and Security Consulting.
He pursued his Bachelor of Science (B.S.) in Information Technology from Florida State University, where he acquired a solid foundation in technology.
Connor has held key positions in reputable organizations, showcasing his expertise and experience.
Previously, he served as a Practice Manager and Senior Consultant at SP6, demonstrating leadership and strategic skills.
Additionally, he has worked as a Security Consultant at SecureIT, contributing his knowledge in ensuring robust security measures.
Connor's tenure as a Security Consulting Senior Associate and Associate at RSM US LLP further honed his consulting abilities and professionalism.
His diverse roles have equipped him with a comprehensive skill set, ranging from IT management to cybersecurity, making him a valuable asset with a wealth of experience.
Highlights
Many organizations include gap assessments within their annual budget while maintaining unclear or inaccurate scoping for CMMC within their environment. The first step of scoping can be determinantal, if not taken seriously, to achieve a compliant state in any regulatory or security standards for protecting sensitive data. Organizations often overlook this critical step or, worse, misguided by a service provider or product. However, scoping criticality is not unique to CMMC; it is similar to other data security protection standards.
Before a CMMC assessment commences, OSCs must present and confidentially communicate the scope/system boundaries to an assessor.
CMMC Scoping Guide (Level 2): https://lnkd.in/g3_xa2hW
- "Organizations will be required to provide documentation to the Certified Assessor that specifies the assessment scope."
CMMC Assessment Process: https://lnkd.in/gFqAV2ae
- "Determining the proper and accurate CMMC Assessment Scope is essential for conducting a valid Assessment. The OSC has the initial responsibility to establish the CMMC Assessment Scope of their networked environment, to include identifying and taking inventory of the various categories of assets contained therein that will be the subject of the CMMC Assessment."
- "The OSC presents the CMMC Assessment Scope to the Lead Assessor, who then proceeds to verify its accuracy and integrity."
- "Any disagreements or differences of opinion concerning the CMMC Assessment Scope must be resolved before the actual Assessment may commence."
This isn't unique to CMMC?.....
PCI DSS v4.0: https://lnkd.in/g_JN8eSF
- "The first step in preparing for a PCI DSS assessment is for the entity to accurately determine the scope of the review."
- "For each PCI DSS assessment, the assessor validates that the entity accurately defined and documented the scope of the assessment."
FedRAMP Authorization Boundary Guidance: https://lnkd.in/gU5K4DaN
- "The authorization boundary is one of the most critical concepts to grasp and document."
- "An authorization boundary is integral to a CSP’s SSP and must describe components of an information system that process, store, or transmit federal information, and it must be illustrated accurately."
- "The CSP must make the authorization boundary transparent to the Third Party Assessment Organization (3PAO) and the AO."
3 Risks of Overlooking CUI Scoping for CMMC: https://lnkd.in/gRkwNSVA
The CMMC program has been submitted for final review by OIRA, maintaining pace to become effective and begin a phased rollout in early 2025.
This critical step reassures the industry of the legitimacy of the CMMC program.
https://lnkd.in/gA3A5wJd https://lnkd.in/gEazfC7g
#SP6 #ConMon #ASCERA
