IT Blog

  • RMF Conference Training Observations

    RMF Conference Observations

    By P. Devon Schall, PhD, CISSP, RDRP Over the past 12 months, I have attended a handful of DoD cybersecurity conferences with the goal of convincing the DoD community that RMF training is a key solution in combatting the perceived RMF crisis. These conferences include the Air Force Information Technology & Cyberpower Conference (AFITC), the […]

  • RMF Security Control INheritance

    Security Control Inheritance

    By Lon J. Berman CISSP, RDRP CNSSI 4009 defines Security Control Inheritance as “a situation in which an information system or application receives protection from security controls (or portions of security controls) that are developed, implemented, and assessed, authorized, and monitored by entities other than those responsible for the system or application”. The typical example […]

  • Ask Dr. RMF

    Ask Dr. RMF

    Dear Dr. RMF, Government IT Security staff work with systems owners to make sure that all systems in the agency have implemented the proper Risk Management Framework (RMF) controls. Organizations have deployed technologies like eMASS, XACTA, and RSA to manage the workflow and documentation for the RMF for their systems. Yet, there is confusion about […]

  • Colin Weaver

    How Much Information is in a Message?

    “How much information is in a message?” Huh??? That sentence, in the context of typical use of those words (information & message), doesn’t immediately make sense to most people. Well, I know it didn’t make sense to me, at least. So let me try asking it in a seemingly more complicated but different way: “If […]

  • Ask Dr. RMF

    Ask Dr. RMF

    By P.Devon Schall Ph.D., RDRP Do you have an RMF dilemma that you could use advice on how to handle? If so, Ask Dr. RMF! BAI’s Dr. RMF is a Ph.D. researcher with a primary research focus of RMF. Dear Doctor RMF, We just received our report from Alex, our independent assessor team lead, and […]

  • RMF Training Resources

    A Quantitative Study on the Receipt of Formalized RMF Training and Perceptions of RMF Effectiveness, Sustainability, and Commitment in RMF Practitioners.

    By P. Devon Schall, Ph.D., CISSP, RDRP Over the past year, I have conducted research on the relationship between the receipt of formalized RMF training and perceptions of RMF effectiveness, sustainability, and commitment in RMF practitioners. I am very pleased to announce, I have completed the study and have some interesting results to report. This […]

  • NIST 800-37 Revision 2 Training

    NIST 800-37 Rev 2: It’s Official!

    By Kathryn Daily, CISSP, RDRP NIST has officially released NIST 800-37 Rev 2 and dubbed it as “RMF 2.0.” The framework has been updated to include both cybersecurity and privacy to be key for an authorization decision. “RMF 2.0 gives federal agencies a very powerful tool to manage both security and privacy risks from a […]

  • Security Controls Assessment Workshop Training

    IT Dojo Announces Security Control Assessment (SCA) Training Workshop

    Training Overview Security Controls Assessment Workshop provides a current and well-developed approach to evaluation and testing of security controls to prove they are functioning correctly in today’s IT systems. This course shows you how to evaluate, examine, and test installed security controls in the world of threats and potential breach actions surrounding all industries and […]

  • Is RMF Broken? Article on Risk Management Framework

    Is RMF Broken? Can it be fixed or is it beyond repair?

    By Lon J. Berman CISSP, RDRP Thanks to the work of the Joint Task Force, RMF is now the official information security life cycle process across all three “segments” of the Executive Branch, i.e., DoD, federal civil agencies, and the intelligence community. It’s now been 4 ½ years since DoD officially “adopted” RMF (DoDI 8510.01, […]

  • NIST Framework Training

    The Newest NIST Framework: The NIST Privacy Framework

    By Kathryn Daily, CISSP, CAP, RDRP NIST has announced the development of a Privacy Framework. The framework is needed to ensure the ability to design, operate, or use technologies in ways that are observant of various privacy needs in a progressively connected and complicated environment. It is expected to help manage risk by protecting people’s […]

  • STIG Course

    STIG 101 Training Dates ADDED!

    We’ve had a huge response to our STIG 101 training!  New dates have been added.  If you are interested, please reach out to us soon! August 24, 2018  Live Remote Online August 31, 2018  Live Remote Online September 28, 2018  Live Remote Online October 19, 2018  Live Remote Online October 26, 2018  Live Remote Online November 14, 2018  Live […]