INTERTEXTrEVOLUTION

Make.Hack.Play.Learn

Greg McVerry / Writing & conversations

Post archive

Browse the things I’ve written, shared and replied to.

Subscribe via RSS ↗

Browse by date

All dates
March 2025
MonTueWedThuFriSatSun
13302295
3132421453506172724681919277
10251112661224813209141881518816178
17248183251937720279212082213523152
24169252552613327172281992913930219
31198

6 posts have no recorded date and appear under “All dates.”

March 27, 2025

172 posts

Greg McVerry
Replies

@AriaImagined @cmarieonline 100% you should have a risk register Not to get too into the weeds but beyond the 110 security controls there are 62 NFOs

In reply to twitter.com ↗

@AriaImagined @cmarieonline 100% you should have a risk register Not to get too into the weeds but beyond the 110 security controls there are 62 NFOs or Non-Federal Organization controls that are "expected to be routinely satisfied by non-federal organizations without specification." These are things the…

Greg McVerry
Replies

@AriaImagined You do not comply with NIST-SP-800-171 , you implement the requirements. You are complying with DFARS 252.204-7012 by proving you have a

In reply to twitter.com ↗

@AriaImagined You do not comply with NIST-SP-800-171 , you implement the requirements. You are complying with DFARS 252.204-7012 by proving you have adequate security to meet the 110 requirements of NIST-SP-800-171 by having evidence all 320 objectives are met in your System Security Plan

Greg McVerry
Replies

@cmarieonline @AriaImagined You define how you assess per 3.12.1 Security Assessment and Monitoring of NIST-SP-800-171 risk register only one type of

In reply to twitter.com ↗

@cmarieonline @AriaImagined You define how you assess per 3.12.1 Security Assessment and Monitoring of NIST-SP-800-171 risk register only one type of documentation one might use and is not req (though this will help with 3.11.01 Risk Assessment, and should be done as part of your overall security plan)

Greg McVerry
Replies

@AriaImagined Can I push back a little calling NIST-SP-800-171 a framework? It isn't a framework like RMF or CSF but a series security requirements yo

In reply to twitter.com ↗

@AriaImagined Can I push back a little calling NIST-SP-800-171 a framework? It isn't a framework like RMF or CSF but a series security requirements you must meet to hold the Government's assets. NIST-SP-800-171 does not technically require you to have a framework but you need one to meet all…

Greg McVerry
Replies

@johnkonrad @ConInsurgent Not how SIPR phones work, like at all. Users often prefer non-managed apps over those allowed in Classified environments. Do

In reply to twitter.com ↗

@johnkonrad @ConInsurgent Not how SIPR phones work, like at all. Users often prefer non-managed apps over those allowed in Classified environments. Doesn't mean they get to use them Even if the DoD CIO signed a waiver so NSC could use a non-managed app, it does not negate 32 CFR Part 117.

Greg McVerry
Replies

@johnkonrad @FPWellman Wickr, Mattermost, and Teams are all available for IL5+ environments. Signal group chats are not encrypted at rest. If anyone p

In reply to twitter.com ↗

@johnkonrad @FPWellman Wickr, Mattermost, and Teams are all available for IL5+ environments. Signal group chats are not encrypted at rest. If anyone pwns the device they have access to the chat logs without MFA Signal is being used to skate Presidential Records Act and Executive Order 12829

Greg McVerry