Eric Garwood

Are CMMC Level 2 SSP expectations inconsistent across C3PAOs? There's a wide range of feedback from Lead CCAs. On one end: “Say what you do.” Minimal narrative. Move on. On the other: -FedRAMP-level inheritance mapping. -Detailed CSP CRM citations. -Explicit 800-53 crosswalks. -Tool configurations. -Role-level procedural detail. IMO we have calibration drift... “Say what you do” is more of a slogan than a standard. To one assessor, it means two paragraphs. To another, it means re-documenting Azure GCC High’s FedRAMP baseline inside your SSP. Those are NOT equivalent expectations. CMMC Level 2 is supposed to assess whether practices are performed, not whether an OSC can recreate FedRAMP documentation. IMO an SSP should: -Clearly describe how the practice is operationalized -Identify responsible roles -Reference supporting technologies -Clarify shared responsibility boundaries -Point to objective evidence It should NOT require duplicating the CSP’s entire control set. When subjectivity drives documentation inflation, we create: -Cost distortion -Timeline unpredictability -A documentation arms race Overengineering SSP narratives does not increase security. It increases friction. We need calibration. Clear examples of sufficiency. Alignment on inheritance expectations. CMMC Level 2 should measure operational maturity not literary endurance. Are you seeing the same variance? #cmmc #c3pao #ssp #dib

58

21 Comments

Attention Potential IT Vendors: Approved Vendor Requirement & Fiscal Planning I appreciate the outreach from IT vendors interested in doing business with the State of Arizona. Before we talk, the first and most important step is to make sure your company is registered as an approved vendor with the state. If you're not already registered, you can begin the process through the Arizona Procurement Portal (APP). Without this approval, agencies like ours cannot engage in procurement discussions. Understanding the Fiscal Cycle For most state agencies, the fiscal year runs from July 1 to June 30. Budgets are determined well in advance, meaning new vendor engagements typically align with the next fiscal year’s planning process- not mid-cycle. DCS IT Vendor Spending & Restrictions (specific) At the Arizona Department of Child Safety (DCS), we are not taking on any new IT vendors at this time. Our budget is fully allocated for the current fiscal year, and there is no flexibility for additional services or contracts. When to Engage with DCS If you're interested in working with DCS in the future, the best time to check in is toward the end of the fiscal year as we assess potential service needs for the upcoming cycle. We welcome these discussions, but they must align with our budgetary constraints and operational priorities. Next Steps for Vendors ✅ Step 1: Ensure your company is registered as an approved vendor in the Arizona Procurement Portal (APP) ✅ Step 2: Familiarize yourself with the state’s fiscal process and planning cycles ✅ Step 3: Reach out at the appropriate time (closer to the end of the fiscal year) to discuss potential opportunities I appreciate your understanding and look forward to connecting. #StateProcurement #ApprovedVendors #ArizonaContracts #DCS #FiscalYearPlanning

42

7 Comments

Had the opportunity to attend the Millennium Alliance dinner on behalf of Veeam in Nashville last night, and let me tell you, it was an eye-opener. Great discussions around current ransomware trends hit different when you're sitting around a table with fellow IT leaders who've been in the trenches much longer than I. We dove deep into incident response strategies that actually work (not the theoretical stuff you read about) by way of "exercises", and more importantly, how to get our teams thinking cybersecurity-first without turning them into paranoid wrecks. What struck me most was separating the signal from the noise, understanding which attack scenarios are real threats today versus the ones that made headlines two years ago but aren't as relevant anymore. The cyber extortion landscape shifts faster than the weather forecast, and staying current on what actually works for resilience is crucial. As someone knee-deep in a digital transformation, these conversations around empowering teams with practical cybersecurity knowledge couldn't have come at a better time. It's not just about the tech stack, it's about building a culture where security becomes second nature. Thanks to the Millenium Alliance for hosting and to Veeam Software for the opportunity. Sometimes the best learning happens when you get smart people in a room who aren't afraid to share what's really working (and what isn't). #Cybersecurity #RansomwareProtection #DigitalTransformation #Veeam

6

1 Comment

Legacy DLP is broken. And it’s putting your Microsoft 365 data at risk. Security teams are drowning in noise from false positives while the real threats slip by unnoticed. Lunch menus trigger alerts, but screenshots with exposed SSNs? Missed completely. Nightfall AI’s AI-powered DLP takes care of all that: - Context-aware detection that understands the difference between business and risk - Full visibility across Microsoft 365 — from Exchange to SharePoint - Protection that follows data everywhere work happens, including AI tools With Nightfall, AI, security teams focus on real threats. Employees work without friction. Sensitive data stays safe. Learn how Nightfall transforms Microsoft 365 security: https://lnkd.in/g3-VTK3y

8

🚨 Updated Microsoft 365 Mappings to MITRE ATT&CK🚨  Microsoft 365 (M365) to ATT&CK mapping S serve as a foundation for implementing a threat-informed defense strategy in your M365 Software as a Service (SaaS) environment. The mappings connect ATT&CK techniques with four core M365 product areas: ✅ Microsoft 365 Defender ✅ Microsoft Entra ID ✅ Exchange Online Protection ✅ Microsoft Purview The resources illustrate how M365 security capabilities can protect against, detect, and respond to real-world threats. Understanding how the implementation of M365 security capabilities can mitigate adversary techniques is a valuable tool for organizations to improve their threat-informed defense strategies and enhance their overall security posture. Get the mappings here: https://lnkd.in/ecFMd6d2 Read blog to learn what’s next on our mappings roadmap: https://lnkd.in/ecxcSjuV #Microsoft365 #M365 #ThreatInformedDefense

20

Check out this brief video excerpt from our #Inversion6 CISO's Office Hours where Tyler Hudak and I discuss a too common root cause of some ransomware attacks we've seen. This case was the State of Nevada's 2025 incident post-mortem report. Here is the link to the full video: https://lnkd.in/eA-CzF4M Want to know more? Follow us and reach out to us at Inversion6!

19

1 Comment

If your cybersecurity dashboard looks like a NASCAR sponsor board—full of green check marks and 99.9% success rates—congratulations… you’ve built a very pretty lie. Too many programs measure what’s easy, not what’s meaningful. - Number of patches applied - Phishing click rate last quarter - Average time to close a ticket All tidy. All largely irrelevant in isolation. Reality-based metrics are messy. They force uncomfortable questions: How quickly can we detect and contain a real incident, not a simulated one? Do our controls actually reduce risk, or just make auditors smile? What percentage of our “critical assets” are actually known, classified, and protected? When we say “MTTR,” are we measuring from the moment the attacker got in… or from when someone finally noticed? A good KPI should inform a decision, not decorate a report. If it doesn’t change behavior, drive funding, or influence risk posture, it’s vanity—no matter how pretty the pie chart looks. Cybersecurity isn’t a sport where the highest score wins. It’s one where understanding the why behind the numbers keeps you from becoming the next headline. #CyberSecurity #Metrics #RiskManagement #CISO #InfoSec #CyberResilience

7

1 Comment

Tuesday's reading. Microsoft Defender for Office 365 is now leveraging advanced Language AI to enhance phishing detection. By understanding the nuances and intent behind language, this AI-driven approach significantly improves the identification of sophisticated phishing attempts, helping keep organizations safer from evolving threats. https://lnkd.in/g7YZhThD #Cybersecurity #AI #EmailSecurity #MicrosoftDefender #PhishingProtection

18

CMMC Audit Lesson: Scanning Is Easy. Remediation Is What Counts. Almost everyone can say, “Yes, we run vulnerability scans.” That’s not where CMMC scrutiny lives. Day 2 focused heavily on: - Scan frequency - Coverage - How findings become tickets - Who owns remediation - How severity drives timelines - How closure is verified The audit conversation wasn’t about tools. It was about flow: Scan → Ticket → Assignment → Fix → Verification → Closure Auditors want to see: - Predictable cadence - Severity-based response - Evidence that issues don’t stall - Accountability For SMBs, vulnerability management doesn’t fail because scanning is hard. It fails because no one owns the outcome.

14

9 Comments

Speaking at #GraylogGO 2025: Sept 16–17 (virtual) Talk: Less Pain, More Gain: Smarter Data, Stronger Defenses with Graylog Security teams don’t need more logs. We need more detection. In this session I’ll show how we use Graylog, Inc. to: - Turn high-volume telemetry into actionable signals with Pipelines, Lookup Tables, and Correlation. - Cut hot-tier noise without blinding ourselves (route, don’t drop). - Track fraud operators and standardize the approach across multiple sectors. - Measure what matters. If your goal is fewer false positives, faster triage, and lower ingest costs with evidence, you’ll get working flows, dashboards styles, and a 10-day rollout plan you can test. #GraylogGO #Graylog #SIEM #DetectionEngineering #SOC #Fraud #HigherEd #Cybersecurity #LogManagement

24

1 Comment

The State of Nevada systems have been crippled by ransomware. For weeks. Then so read this: The state of Nevada does not have a single Chief Information Security Officer (CISO); instead, a Chief Information Officer (CIO) role exists, and responsibility for information security is a collaborative effort involving multiple IT security and department leaders, according to this State of Nevada article. Alan Cunningham previously served as the State CIO and oversaw the Enterprise Information Technology Services Division, which supports state agencies, but the position of a dedicated State CISO is not present. Key Takeaways • No dedicated State CISO: Thoughts anyone?

72

89 Comments