All articles by Mark Larson:
A GSA nonfederal Controlled Unclassified Information (CUI) assessment is an independent review of a contractor’s system against the security and privacy requirements the GSA initially published in May 2022, with version 1 adopted in January 2026. If an organization stores, processes, or transmits CUI on a GSA contract, that organization requires a third-party attestation to [...]
The Department of Defense (DoD) has restructured its supply chain cybersecurity requirements, signaling a shift from self-attestation to verified compliance. For organizations within the Defense Industrial Base (DIB), navigating this transition is no longer optional. The Cybersecurity Maturity Model Certification (CMMC) program is the definitive framework for this new era. This CMMC compliance guide helps [...]
Effective incident response is no longer just a best practice—it’s a critical business function. As cyber threats grow more complex, organizations must ensure their incident response plans are aligned with the latest standards. In April 2025, the National Institute of Standards and Technology (NIST) officially withdrew Special Publication 800-61 Revision 2 and released Revision 3: [...]
People often make New Year’s resolutions to reflect on the past year and set goals for personal growth, improvement, or change in the year ahead. One of the funniest I’ve heard is, “My New Year’s resolution is to stop procrastinating… starting tomorrow.” If you’ve been procrastinating on learning about CMMC, now is the time to [...]
In November 2021, the Department of Defense (DoD) announced Cybersecurity Maturity Model Certification (CMMC) 2.0, a program meant to assess an organization’s cybersecurity program maturity. The CMMC program is designed to achieve the following goals: “Safeguard sensitive information to enable and protect the warfighter” “Enforce Defense Industrial Base (DIB) cybersecurity standards to meet evolving threats” [...]
Today’s information age mandates organizations take appropriate action to ensure effective security and privacy practices are embedded throughout the entire organization. The effectiveness of privacy and security practices should continually be assessed to ensure they remain adequate and sufficient to support the organization’s ever-changing risk profile. It’s imperative that organizations not only assess their own [...]
As technology continues to evolve at an exponential rate, it’s not uncommon to feel overwhelmed or exhausted by the current rate of change. While new technologies are often introduced with the promise of benefits, they also introduce new challenges and risks. In 2023, there will continue to be plenty of focus on big data, edge [...]
The number of cybersecurity incidents continues to rise. This upsurge in frequency and complexity has also resulted in an increase in costs. According to IBM’s 2022 Cost of a Data Breach Report, the average total cost of a data breach is USD $4.35 million, 83% of organizations studied have had more than one data breach, [...]
Cyber Threat Intelligence (CTI) encompasses the people, processes, and technologies that a Company uses to proactively identify and mitigate threats to its brand, assets, employees, third parties, and clients. In simple terms, the goal of CTI is to stay one step ahead of malicious actors and take action before an attack occurs or avoid the [...]
As a security practitioner and auditor, questions regarding the differences between vulnerability assessments and penetration testing come up often. Even though seasoned security professionals may already know the answer to a question like this, there are a number of non-security professionals who may need help understanding the differences, the benefits, and the costs. While larger [...]
But there’s still plenty worth exploring. Try a different search, or browse the Blog.
"*" indicates required fields
