May 24, 2024
RMF Alignment with ISC2’s CGRC Exam
IT Dojo's training programs were developed with the information systems professional in mind. NIST’s Risk Management Framework is one of the most widely used …
Read Article
April 17, 2024
Strengthening Cybersecurity: Navigating the Risk Management Framework for DoD IT
In an era marked by evolving cyber threats and stringent security requirements, the Department of Defense (DoD) plays a pivotal role in safeguarding sensitive …
Read Article
September 27, 2023
Navigating the Risk Management Framework (RMF) for DoD and Government Agencies
In today's tech-driven world, safeguarding sensitive data and critical systems is a top priority, especially for government agencies, including the Department …
Read Article
June 28, 2023
RISK MANAGEMENT FRAMEWORK (RMF) TOMORROW: TRUTH OR FICTION?
BY LON J. BERMAN, CISSP, RDRP JULY 2023, VOLUME 15, ISSUE 3 When it comes to the future of RMF, rumors abound but truth is hard to come by. In this article, …
Read Article
February 8, 2022
DoD Transition to NIST SP 800-53 Rev 5 … Why is it Taking so Long?
By Lon J. Berman, CISSP, RDRP Welcome to 2022! It’s now been well over a year since the release of NIST SP 800-53 Rev 5, yet Rev 4 remains the DoD standard. …
Read Article
May 25, 2021
Risk. What to Do With It.
By Kathryn Daily, CISSP, CAP, RDRP Recently our regional grocery store chain notified their employees and customers that they had a data breach involving some …
Read Article
May 25, 2021
RMF Across the Government Landscape
By Lon J. Berman, CISSP, RDRP More than ten years ago, RMF came into existence with the intention of becoming the “unified information security framework for …
Read Article
January 12, 2021
Welcome, Step 0
By Lon J. Berman, CISSP, RDRP Q. The Risk Management Framework (RMF) life cycle is comprised of how many steps? A. Oh, that’s easy, it’s six. Well … not so …
Read Article
November 12, 2019
Ask Dr. RMF!
Dear Dr. RMF, I work in an Army program and I feel like I am getting the hang of RMF, but when the heck do I schedule an independent assessment (SCA-V)? Show Me …
Read Article
April 15, 2019
Ask Dr. RMF
Dear Dr. RMF, Government IT Security staff work with systems owners to make sure that all systems in the agency have implemented the proper Risk Management …
Read Article
April 15, 2019
Security Control Inheritance
By Lon J. Berman CISSP, RDRP CNSSI 4009 defines Security Control Inheritance as “a situation in which an information system or application receives protection …
Read Article
January 11, 2019
Powerful but not well understood: Reciprocity, Type Authorization, and Assess Only
By Lon J. Berman CISSP, RDRP All of us who have spent time working with RMF have come to understand just what a time-consuming and resource-intensive process it …
Read Article
October 9, 2018
Is RMF Broken? Can it be fixed or is it beyond repair?
By Lon J. Berman CISSP, RDRP Thanks to the work of the Joint Task Force, RMF is now the official information security life cycle process across all three …
Read Article
April 17, 2018
RMF and the Defense Security Service (DSS)
By Lon J. Berman, CISSP, RDRP at BAI. The Defense Security Service (DSS) serves as an interface between the government and cleared industry. DSS administers and …
Read Article
October 17, 2017
Is Your System a National Security System (NSS)? and How Does That Affect RMF Efforts?
By Lon J. Berman, CISSP, RDRP By federal law, an information system will be designated as a National Security System (NSS) in accordance with the following …
Read Article
October 17, 2017
RMF: Is It Effective?
By Kathryn Daily, CISSP, RDRP In July 2017, SolarWinds conducted an online survey via Market Connections aimed at approximately 200 federal government IT …
Read Article
July 13, 2017
Continuous Monitoring Today—And Tomorrow
This article was written by Lon Berman, CISSP, RDRP of BAI Information Security Step 6 of the Risk Management Framework (RMF) is entitled “Monitor Security …
Read Article
July 13, 2017
Security Control Spotlight— Inheritance from a FedRAMP Approved CSP
This article was written by Kathryn M. Daily, CISSP, RDRP of BAI Information Security. In a previous article, security control inheritance from an external …
Read Article
September 16, 2016
Security Control Spotlight—Contingency Planning
By Kathryn M. Daily, CISSP of BAI Information Security In this issue we will shine the spotlight on the Contingency Planning (CP) family of security controls. …
Read Article
September 16, 2016
Top Ten RMF Pitfalls Revisited
By Lon Berman, CISSP of BAI Information Security Like any complex process, RMF is not without its share of potential pitfalls. Now that we have the benefit of …
Read Article
September 16, 2016
Understanding the Authorization Decision
By Lon Berman, CISSP of BAI Information Security If you ask most system owners about the desired outcome of their RMF efforts, they will readily tell you “we …
Read Article
June 8, 2016
Top Ten—RMF “Lessons Learned”
By Lon J. Berman, CISSP BAI Information Security I recently had the pleasure of consulting for a DoD program that successfully navigated the RMF process and …
Read Article
June 7, 2016
Security Control Baseline “Tabletop Review”
By Lon J. Berman, CISSP at BAI Information Security Let’s take a look at some strategies for reviewing the Security Control Baseline and creating “action plans” …
Read Article
June 1, 2016
Security Control Spotlight—Inheritance
By Kathryn M. Farrish, CISSP BAI Information Security Security Control Inheritance is one of the most powerful tools available to facilitate the RMF process. …
Read Article
March 1, 2016
Top Ten—Questions for your Authorizing Official
By Annette Leonard The importance of the Authorizing Official (AO) in the RMF process is self evident. As the individual charged with signing your Authorization …
Read Article
November 23, 2015
Security Control Spotlight: A Little Good News?
Article by Kathryn Farrish, CISSP Imagine this dialog between Edward, a System Owner, and Christine, his Information System Security Manager (ISSM): Edward …
Read Article
March 13, 2015
Security Control Spotlight—The PM Family
By Lon J. Berman, CISSP The Beatles were comprised of how many musicians? Easy, right? They were called the “Fab Four”, so there were definitely 4. Now Google …
Read Article
March 12, 2015
Getting Off to A Good Start with Your RMF Transition
This is a top ten list of things that will help you at the beginning of your transition from DIACAP to RMF.
Read Article
March 11, 2015
RMF Transition—What do I Really Need to Know?
By Lon J. Berman, CISSP It’s hard to believe it’s been a whole year since the publication of DoD Instruction (DoDI) 8510.01 in March of 2014, which officially …
Read Article
January 27, 2015
Spotlight: Information Security Continuous Monitoring
By Lon Berman, CISSP No longer just a technical issue, instead a strategic program to manage cybersecurity risk. Targeted cyber attacks are a strategic …
Read Article
November 13, 2014
Security Control Spotlight—By the Numbers
By Lon J. Berman, CISSP of BAI, Inc. In this issue’s “Spotlight”, we’re not going to focus on any specific controls or families, but rather on a comparison of …
Read Article
October 21, 2014
RMF Transition—What is the Real Timeline?
By Lon Berman of BAI, Inc. Now that RMF is official DoD policy, every DoD system owner needs to begin planning their “transition” from DIACAP. In order to plan …
Read Article
October 16, 2014
Spotlight: Transitioning to the Risk Management Framework (RMF)
With the publication of revised DoD Instruction 8510.01, adoption of the Risk Management Framework (RMF) by DoD has begun. DoD programs are busy planning and …
Read Article
July 21, 2014
Security Control Spotlight— Organization-Defined Parameters
By Kathryn M. Farrish, CISSP BAI Consulting Under RMF, NIST SP 800-53 is the primary source for security controls. If we compare these controls to the DoDI …
Read Article
July 18, 2014
Top Ten—Ensuring a Smooth Transition to RMF
By Lon J. Berman, CISSP BAI Consulting Now that DoD has “officially” begun its adoption of “RMF for DoD IT”, let’s take a look at some of the things your …
Read Article
July 16, 2014
DoD Programs “Gear Up” for Transition to RMF
By Lon J. Berman, CISSP BAI Consulting With the publication of revised DoD Instruction 8510.01, adoption of the Risk Management Framework (RMF) by DoD is now …
Read Article
April 25, 2014
RMF Transition Timeline Infographic
IT Dojo offers a comprehensive course on the transition from DIACAP to RMF. Please take a look at our RMF training courses here. Here is a link to a great book …
Read Article
April 11, 2014
DoD (Finally) Begins Transition to RMF
By Lon J. Berman, CISSP BAI Consulting The wait is over! RIP DIACAP!! At long last, DoD has announced the start of transition from the legacy DIACAP …
Read Article
April 10, 2014
Top 10 Things that Will Be Staying the Same with RMF
By Lon J. Berman, CISSP BAI Consulting As DoD begins its transition from DIACAP to Risk Management Framework for DoD IT, everyone is naturally focused on all …
Read Article
April 8, 2014
Top Ten—What’s “new” in RMF for DoD IT?
By Lon J. Berman, CISSP BAI Consulting Now that DoD has “officially” begun its adoption of RMF, let’s take a look at some of the things that are “new”! 10. …
Read Article
April 7, 2014
Continuous Monitoring—It’s Not (Just) About The Tools
by Annette Leonard BAI Consulting Continuous Monitoring has long been recognized as a critical element in maintaining a strong security posture for any IT …
Read Article
March 24, 2014
DIACAP says, "So Long"
DoD replaces DIACAP with NIST-based RMF standard.
Read Article
February 28, 2014
DoD Transition to RMF Imminent—Will You Be Ready?
By Lon J. Berman, CISSP For quite some time, it’s been well known that DoD would be making a transition from the legacy DIACAP Certification and Accreditation …
Read Article
May 20, 2011
The Debate Surrounding Section 6.5.4.1
The IANA (Internet Assigned Number Authority) distributes IPv6 address to RIR's (Regional Internet Registry's) around the world. At the moment there are five …
Read Article