Brush Cyber

🚨 𝗖𝗠𝗠𝗖 𝗶𝘀 "𝗽𝗮𝘂𝘀𝗲𝗱." 𝗧𝗵𝗲 𝗼𝗯𝗹𝗶𝗴𝗮𝘁𝗶𝗼𝗻 𝗶𝘀 𝗻𝗼𝘁. Breaking Defense canvassed the industry this week and the read was consistent: the third-party audit is on hold, the reviews are likely coming back, and the obligation underneath never left. Breaking Defense: https://lnkd.in/eSVibHyy 🔹 Katie Arrington, who built CMMC, says the Pentagon lands back here because there is no other reliable way to get compliance. 🔹 Summit 7's Jacob Horne points to the DoD Inspector General finding from years ago: letting contractors grade their own homework had already failed once. 🔹 CyberSheath's Emile Sayegh makes the quieter point that matters most: most contractors believe they are compliant. 𝗕𝗲𝗹𝗶𝗲𝗳 𝗶𝘀 𝗻𝗼𝘁 𝗲𝘃𝗶𝗱𝗲𝗻𝗰𝗲. 📌 𝗧𝗵𝗲 𝗕𝗿𝘂𝘀𝗵 𝗖𝘆𝗯𝗲𝗿 𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻. The DoW suspended one checkpoint. It did not suspend DFARS 252.204-7012. It did not suspend your SPRS score. It did not suspend the False Claims Act. The standard is still NIST 800-171 Rev 2, and the self-assessment is still required. ⚖️ Every SPRS score you post is an attestation to the government. The Civil Cyber-Fraud Initiative is still active, and qui tam relators are still paid to find the distance between what you attested and what you can prove. Remove the external audit and you do not remove the exposure. You concentrate it. A contractor who self-attests without contemporaneous documentation is 𝗺𝗼𝗿𝗲 𝗲𝘅𝗽𝗼𝘀𝗲𝗱 𝗻𝗼𝘄, 𝗻𝗼𝘁 𝗹𝗲𝘀𝘀, because nothing surfaces the gap before a whistleblower does. The recent settlements (Aerojet Rocketdyne, Verizon, Penn State) were not decided by a C3PAO. They were decided by evidence. 🎯 The question stopped being "when is your audit?" It became: 𝗶𝗳 𝗮 𝗿𝗲𝗹𝗮𝘁𝗼𝗿 𝘀𝘂𝗯𝗽𝗼𝗲𝗻𝗮𝗲𝗱 𝘆𝗼𝘂𝗿 𝗦𝗣𝗥𝗦 𝗮𝘁𝘁𝗲𝘀𝘁𝗮𝘁𝗶𝗼𝗻 𝗮𝗻𝗱 𝗲𝘃𝗲𝗿𝘆 𝗮𝗿𝘁𝗶𝗳𝗮𝗰𝘁 𝗯𝗲𝗵𝗶𝗻𝗱 𝗶𝘁, 𝗰𝗼𝘂𝗹𝗱 𝘆𝗼𝘂 𝗱𝗲𝗳𝗲𝗻𝗱 𝗶𝘁? 🔒 Collect evidence the way a forensic investigator would: dated, hashed, source-attributed, captured at the time of attestation. Attest what you can defend. Defer what you cannot. That was the right posture before July 13. The suspension just removed the excuse. 𝗧𝗵𝗲 𝗮𝘂𝗱𝗶𝘁 𝘀𝗶𝗴𝗻𝗮𝗴𝗲 𝗰𝗵𝗮𝗻𝗴𝗲𝗱. 𝗧𝗵𝗲 𝗼𝗯𝗹𝗶𝗴𝗮𝘁𝗶𝗼𝗻 𝗱𝗶𝗱 𝗻𝗼𝘁. #CMMC #DFARS #FalseClaimsAct #DIB #Cybersecurity

⚠️ CMMC Phase 2 audits are suspended. https://lnkd.in/eFzXNBgA 🚫 The obligations behind them are not. United States Department of War CIO Kirsten Davies signed a memo pausing Phase 2 third-party assessments. A CMMC Reform Task Force will report findings by September 11. 👀 Here is what did not change: DFARS 252.204-7012 and -7019 remain in every signed DIB contract. NIST 800-171 Rev 2 controls still require implementation and evidence. SPRS scores still have to be defensible the day they are posted. Prime flow-down obligations still bind sub-tier contractors to their primes. 🧿 The False Claims Act clock did not move either. FCA scienter under 31 USC 3729(b)(1) is satisfied by actual knowledge, deliberate ignorance, or reckless disregard. After Schutte v. SuperValu (2023), the standard turns on the contractor's subjective belief at the time of attestation. The DOJ Civil Cyber-Fraud Initiative is active. Aerojet Rocketdyne, Verizon, and Penn State have already settled. 🔥 The audit signage changed. The real work did not. For DIB contractors, the near-term work is unglamorous and specific: 1. Pull every signed contract and map the DFARS clauses in each. 2. Reconcile the posted SPRS score against the actual control state in a dated internal memorandum. 3. Preserve the evidence chain that supports the score in a form you can attest to. Brush Cyber has spent the last six months building the platform designed to make that work defensible by default. Announcement coming. #CMMC #DFARS #DIB #FCA #CyberCompliance

For CISOs, dark-web monitoring is now an evidentiary function that must be coordinated with counsel and data governance. Brush Cyber’s CEO and cyber legal expert, Douglas Brush, shares key insights on the 4th Cir. Court of Appeals ruling on Holmes v. Elephant at CSO Online. The Fourth Circuit clarified Article III standing in breach cases: plaintiffs must show that the data was actually made public (e.g., posted on the dark web) to pursue damages. This sharpens litigation exposure around publication while leaving regulatory notification and consent-order obligations fully intact. (Note: Threat actors will be all over this ruling as an effort to remind victims of their duties and to extort more money.) Read 📚: https://lnkd.in/gmHgdJWn Key takeaways for CISOs Treat publication risk as a first-class factor: confirm whether any records that were breached became publicly accessible. Build admissible evidence: capture screenshots, hashes, first-seen timestamps, URLs, and chain-of-custody tying postings to your data. Reduce publication vectors: rate-limit and monitor lookups, block enumeration/scraping, and tokenize or truncate sensitive identifiers. Segment cohorts in incidents: separate individuals with verified public posting from those without; align comms and legal strategy accordingly. Vendor risk is your risk: require dark-web monitoring, rapid publication reporting, and anti-enumeration controls in contracts. Compliance remains unchanged: Article III standing does not alter breach notification triggers, regulator expectations, or consent agreement duties. Brush Cyber delivers a publication-risk assessment and evidence plan tailored to your environment, implements continuous dark-web monitoring with defensible artifacts, hardens high-risk app features, and aligns findings with legal, regulatory, and insurance requirements. If you want a concise, board-ready plan that prevents publication and proves what did—or did not—happen, contact Brush Cyber. (CC: Gregg Friedman / Justin Logue / Timothy Schmidt) #CISO #DataBreach #CyberInsurance #Litigation #Cyber #Legal #DFIR #ClassAction #Dutyofcare #DOCRA https://lnkd.in/gmHgdJWn

Law-firm security isn’t optional—it’s a professional duty. Next week, our founder, Douglas Brush, will deliver an Ethics CLE at The Colorado Bar Association's Solo/Small Firm Institute in Denver. Firms are high-value, soft targets. Attackers don’t need to break the bank if they can read the law firm's deal calendar and client strategy. The weak points are predictable: • Credential theft/BEC (mailbox rules, wire fraud) • Ransomware + data theft (encryption + leak pressure) • Vendor exposure (MSPs, DMS, e-discovery) • Misconfiguration & legacy auth (over-sharing, poor logging) What you will learn: • A 90-day plan that a small firm can actually execute • A first-72-hours playbook for ransomware/BEC • Incident vs. breach: language that triggers duties • Vendor oversight you can prove (clauses, monitoring, evidence) • How to build a risk register to document decisions If you’re attending, come ready to leave with a plan, not just slides. Registration via CBA-CLE: https://www.cobar.org/ssf Want an objective read on your posture? Brush Cyber offers Law Firm Security Assessments a blunt, evidence-based review, a prioritized remediation roadmap, and ready-to-use playbooks. Please feel free to DM us or email info@brushcyber.com to schedule. #Cybersecurity #LawFirms #CLE #RiskManagement #Denver #CISO