The People Behind the Progress: 10 years of Defending.
A 10-year reflection on the people, judgment, learning, and operational security mindset behind InfusionPoints’ continuous defense mission.
Read full blog hereWritten guidance for Continuous Trust teams.
The full InfusionPoints blog library, separated from podcasts so readers can scan, search, and dig into the topics that matter.
Blog Library
Browse the InfusionPoints blog library.
The full InfusionPoints blog library, migrated into the new site experience with practical guidance for authorization, continuous trust, secure cloud operations, and mission defense.
DoW CSP SRG V1R7: Five Actions Cloud Service Providers Should Take Before Their Next Assessment
Personnel security, access models, staffing, and IL6 readiness under DISA’s latest Cloud Service Provider Security Requirements Guide.
Read full blog hereCISA BOD 26-04: What CSPs and Contractors Must Do, and How Agencies Hold Them to It (Part 2)
Agencies own the risk, but providers own the fix. See what CSPs and contractors must deliver under BOD 26-04 and what evidence agencies should demand.
Read full blog hereThe Next-Generation FedRAMP Engineer: What CR26 Demands From a Skills Perspective
CR26 changes FedRAMP engineering skills: infrastructure as code, serverless architecture, CI/CD controls, continuous vulnerability engineering, observability, security logging, and governed AI.
Read full blog hereInfusing Security into Every Point of the Lifecycle: How Command Center Brings the InfusionPoints Model to Life
AWS-Native Security Operations Series | Part 5 of 6. How Command Center turns AWS security signals into managed action, evidence, authorization visibility, and continuous trust.
Read full blog hereWhy Your Future Security Operations Need an Agentic SOC
How VNSOC360° brings AI speed and human judgment into continuous security operations without losing trust, accountability, and proof.
Read full blog hereCISA BOD 26-04: What Every Federal Agency Needs to Know (Part 1)
The directive replaces static patch schedules with risk-based timelines as short as 3 calendar days. Here is what changes and how agencies should prepare.
Read full blog hereSecuring the Modern Campus: How VNSOC360° Helps Community Colleges Build Security Operations They Can Sustain
Community colleges do not need more cybersecurity noise. See how VNSOC360° helps close the gap between what colleges must protect and what lean teams can operate.
Read full blog hereContinuous Compliance Is Not the Same as Periodic Compliance
AWS-Native Security Operations Series | Part 4 of 6. How AWS Config, conformance packs, Command Center, and ConMon-as-a-Service replace point-in-time audits with an always-on compliance posture.
Read full blog hereThe Log Pipeline That Makes Federal Security Auditable
AWS-Native Security Operations Series | Part 3 of 6How CloudTrail, CloudWatch, Kinesis, OpenSearch, and S3 work together to capture, process, and preserve the evidence your…
Read full blog hereHow InfusionPoints Detects Threats Across Your AWS Environment
AWS-Native Security Operations Series | Part 2 of 6A look inside the six AWS security services that power the Defend pillar of the InfusionPoints Continuous Trust…
Read full blog hereWhy AWS-Native Security Operations Is the Only Architecture That Works for FedRAMP 20x, Rev. 5 and DoD Customers
The case for building your security operations stack on the same infrastructure your customers must authorize against.This is Part 1 of the AWS-Native Security Operations…
Read full blog hereFedRAMP Rev5 Under CR26: The Top 5 Things CSPs Need to Focus On
Rev5 isn't going away overnight. Existing Rev5 certifications remain valid through at least December 31, 2028, and FedRAMP will keep accepting new Rev5 applications until June…
Read full blog hereFedRAMP 20x Under CR26: The Top 5 Things CSPs Need to Focus On
FedRAMP 20x is no longer the experimental track. Under CR26, it's the primary path FedRAMP wants every new CSP to take, and the direction it wants existing Rev5 providers to…
Read full blog hereFedRAMP VDR and VER: From Monthly Scans to Continuous Trust
How VDR, VER, CR26, and CISA guidance are reshaping vulnerability management into a continuous operating model for federal cloud trust. For years, vulnerability management in…
Read full blog hereFedRAMP 20x Defending the Mission Isn't a Feature. It's an Operating Model.
What continuous defense actually looks like when it's built into operations not bolted on beside them. Updated based on FedRAMP CR26.There's a version of security that looks…
Read full blog hereFedRAMP Consolidated Rules for 2026 (CR26) Released!
Our full post on CR26 release is coming shortly, but here is a teaser!What's New vs. the Earlier VDR/VER Process Documents
Read full blog hereNIST SP 800-171 Is No Longer Just a DoD Problem
The agency name matters less than the data, and the data moves through a system.
Read full blog herePurpose-Driven Security. Built to Last.
Purpose-Driven Security. Built to Last.At InfusionPoints, purpose isn't a tagline. It's an operating model.Most cybersecurity companies are built to be acquired.They raise…
Read full blog hereHow XBU40 Accelerates IL4 & IL5 Compliance for Mission Owners
The Department of Defense (DoD) faces increasing pressure to modernize mission systems while maintaining strict compliance with the Department of Defense’s Cloud Computing…
Read full blog hereCompliance Is a System security Engineering Problem
In 2020, a major software vendor passed its annual security compliance audit with no significant findings. Weeks later, threat actors were discovered to have maintained…
Read full blog hereSWFT, cATO, 20x and the Rev. 4 Drag Still Inside DoW Cloud Authorization
DoW and FedRAMP are both pushing authorization toward greater speed, reuse, and continuous validation, whether through SWFT, cATO maturity, or FedRAMP 20x’s evidence-first…
Read full blog hereFedRAMP 20x RFC Drop: What You Need to Know
FedRAMP just released a new batch of Requests for Comment (RFCs), and while not every update is major on its own, together they point to a clear direction:CSPs need to review…
Read full blog hereThe Quiet Convergence: why DoD DevSecOps, SWFT, and FedRAMP 20x are Starting to Rhyme
For a bit over a decade, the “FedRAMP world” and “DoD authorization world” have felt like parallel universes. One prioritized government-wide reuse of cloud authorizations; the…
Read full blog hereFedRAMP Public Notices Explained: What They Mean for FedRAMP 20x
As FedRAMP modernization accelerates under FedRAMP 20x, the Program Management Office (PMO) has introduced a new communication channel: FedRAMP Public Notices.These notices…
Read full blog hereFedRAMP’s Landscape Is Changing: Are You Ready?
Cloud service providers supporting federal customers have grown accustomed to the steady—if not always smooth—pace of FedRAMP requirements. But in 2026, the landscape is…
Read full blog hereSix New FedRAMP RFCs: What They Mean and Why Your Input Matters
In January, FedRAMP released six interrelated Requests for Comment (RFCs) at once. This unusually large update signals a major shift in how cloud security authorizations will…
Read full blog hereFrom Pilot to Production: What FedRAMP 20X Really Means for Cloud Providers
When FedRAMP 20X was first introduced, one thing was immediately clear: this wasn’t just another incremental update to the authorization process. It was a fundamental shift in…
Read full blog hereCMMC Is Live: What Defense Contractors Need to Know About the New Compliance Timeline
IntroductionOn November 10, 2025, the Cybersecurity Maturity Model Certification (CMMC) officially went live. For defense contractors, this is more than a policy update—it’s a…
Read full blog hereHow to Approach Third Party External Service Providers & FedRAMP Equivalency
Defining an External Service ProviderIn pursuit of CMMC Certification, External Service Providers (ESPs) are third parties that provide services that affect DoD-controlled…
Read full blog hereCompliance Shouldn’t Be Handcuffs. It Should Be a Helmet.
The Shift from Restriction to ProtectionFor years, cloud service providers (CSPs) endured lengthy compliance efforts that slowed innovation. Audits shackled engineering.…
Read full blog hereFedRAMP Revision 5 Updates: What CSPs Need to Know
On November 18, 2025, the FedRAMP Program Management Office (PMO) published a blog detailing key updates to FedRAMP Revision 5 documentation, signaling the tran
Read full blog hereFedRAMP Rev 5 RSC Requirements Are Coming Fast — Are You Ready?
The federal landscape is shifting again—and this time, the clock is ticking much faster than most Cloud Service Providers realize. FedRAMP Rev 5 introduces a ne
Read full blog hereIRAP vs. FedRAMP: Navigating Global Cloud Security Standards
Introduction With the ever-growing global security landscape, security authorization programs such as FedRAMP and IRAP have become increasingly more important,
Read full blog hereOpinionated by Design: Why Platform plus GRC Wins for FedRAMP20x
TL;DR : I used to approach new tools (think Jenkins) with fixed expectations—only to discover they are often open frameworks that still have to be shaped approp
Read full blog hereFedRAMP 20x Phase Two Pilot, FedRAMP Trust Centers, and Agency Struggles
FedRAMP 20x
Read full blog hereEvergreen Lessons from the AI Era: Urgent Patience and the Myth of the Shortcut
The Paradox of Building in an Age That Moves Too FastWe live in a moment that feels like history in real time.AI, automation, and instant information have made speed the…
Read full blog hereRethinking “Walls and Moats” in Cybersecurity and Compliance
Why Innovation, Not Infrastructure, Is the Only True DefenseFor over a thousand years, the walls and moats of Constantinople stood as the ultimate defense.No army could breach…
Read full blog hereCompliance ≠ Readiness: Why the Public Sector Can’t Afford to Measure the Wrong Metrics
In government cybersecurity, compliance has become the floor, but readiness is the goal. Too often, agencies and cloud providers conflate the two, mistaking checklists and…
Read full blog hereGetting Ahead on NIST 800-63-4: Why the Final Public Draft Matters and What You Should Do Now
As organizations modernize their security architectures, identity has become the critical control point for verifying trust, enforcing access, and reducing risk across digital…
Read full blog hereThe Future of Continuous Assurance: Merging Zero Trust Validation with FedRAMP 20x
The old model of static compliance and perimeter-based trust no longer suffices. In its place, we must evolve toward continuous, evidence-driven verification of trust across…
Read full blog hereFedRAMP 20X Phase Two: How InfusionPoints Is Meeting the Moment
The federal government has taken another decisive step toward modernizing cloud authorization with the launch of FedRAMP 20X Phase Two. This initiative builds on the lessons of…
Read full blog hereFedRAMP’s New Vulnerability Detection and Response Standard
WOW! If you haven’t heard, FedRAMP released a new Vulnerability Detection and Response (VDR) standard on September 11, 2025. This new standard is poised to really change the…
Read full blog hereSystems Engineers: The Quiet Force Behind Federal Cyber Resilience
The Overlooked Role in Federal CybersecurityCybersecurity in the federal government often gets framed around tools: firewalls, encryption, cloud platforms, and threat detection…
Read full blog hereTime to Flip the Table and Throw it Out the Window: Automation, Audit Wars, and the FedRAMP 20X Shift
The days of static SSPs, screenshot-based audits, and year-long ATO cycles are numbered. FedRAMP 20X is changing the game, trading PDFs for real-time dashboards, replacing…
Read full blog hereDeclaring Compliance Independence: FedRAMP 20X’s July 4th Revolution
On July 4th, 1776, a handful of bold visionaries put pen to parchment and declared that the old way of doing business no longer served a new nation’s needs. Today, FedRAMP 20X…
Read full blog hereNavigating the Past, Present, and Future of FedRAMP and DoD CC SRG
How InfusionPoints Helps Cloud Service Providers Accelerate and Sustain Federal Compliance
Read full blog herePioneering the Future of Compliance: InfusionPoints’ Perspective on FedRAMP 20x
The recent FedRAMP 20x Community Working Group meeting brought together early adopters and innovators to reflect on lessons learned and progress made during the pilot. Among…
Read full blog hereReal-Time Compliance is Here: How AuditShield Automates Evidence Collection and Reporting
In the age of FedRAMP 20x, the old ways of proving compliance- manual screenshots, inconsistent documentation, point-in-time audits- are no longer enough. Agencies, assessors,…
Read full blog hereBuilt to Defend: Our Deep Dive into HPE ProLiant Compute Gen12 and HPE Compute Ops Management
In today’s rapidly evolving threat landscape, enterprise hardware must do more than deliver performance—it must protect it. Our team at InfusionPoints recently completed an…
Read full blog hereFrom Reactive to Real-Time: “FedRAMP 20x we’re doing it Live”
At InfusionPoints, we’ve always believed that compliance shouldn't be a one-time event—it should be a continuous, actionable process. That belief is what drove us to develop…
Read full blog hereBuild, Buy or Rent your PaaS
Build, Buy, or Rent? The FedRAMP or DoD Platform Dilemma in 2025Why Platform-as-a-Service is the Prerequisite for Mission Outcomes in the Federal MarketsIn the federal and DoD…
Read full blog hereA Day in the Life of a FedRAMP Platform-as-a-Service Provider in 2025
Staying True to the Mission in a Rapidly Evolving Compliance WorldEvery day in 2025 feels like a sprint. For those of us running FedRAMP platforms on AWS—especially those…
Read full blog hereOur Vision: Fully Automated FedRAMP Compliance, Built for the 20x Future
At InfusionPoints, we are deeply aligned with the transformative goals outlined in FedRAMP 20x—a bold modernization initiative designed to bring federal cloud security…
Read full blog hereBuilt by the Few to Protect the Many
Delivering on the Promise of FedRAMP 20x and DoD SWFT with InfusionPoints’ Build | Manage | Defend Framework At InfusionPoints, our mission has always been bigger than just…
Read full blog hereFedRAMP in Flux: Pete Waterman Unveils FedRAMP 20x
At the recent FedRAMP 20x event in DC, Pete Waterman, Director of the FedRAMP Program Management Office (PMO), delivered a landmark address outlining a bold, transparent, and…
Read full blog hereYour Guide to FedRAMP Diagrams
Your Guide to FedRAMP Diagrams2025 Major Update:
Read full blog hereAuditShield: Your Compliance Defense in a Complex Regulatory World
The Spartan Shield: A Symbol of Strength and ProtectionIn ancient Greece, the Spartan warriors were known for their discipline, resilience, and unmatched ability to defend…
Read full blog hereInfusionPoints: Pioneering Government Efficiency Through the FedRAMP Marketplace
Long before the Government Efficiency program began transforming the way federal agencies operate, InfusionPoints embraced a philosophy of efficiency, innovation, and…
Read full blog hereLeverage Cloud Systems Thinking to Accelerate Your FedRAMP Marketplace Listing
Ever feel like FedRAMP is a never-ending maze? Like no matter how hard you push, there’s always another obstacle? That’s because FedRAMP pushes back—it’s called "compensative…
Read full blog hereSystem Thinking – One Bite Sized Chunk at a Time
Embracing change and innovation in cloud systems with system thinking Why don’t people want to try something new? Change can be scary, overwhelming, and intimidating.…
Read full blog hereReflections on AWS re:Invent: A spotlight on security and partner innovation
Collaboration and innovation were at the forefront of our experience at AWS re:Invent 2024. For InfusionPoints, it was a chance to reaffirm our commitment to AWS as our cloud…
Read full blog hereThe FedRAMP Program Management Office is apparently riding the efficiency wave
Update March 7, 2025:Since my original post, the authorizations continue to come in at a sustained rate adding another 10 authorizations since February 12th. This is great news…
Read full blog hereUnderstanding FedRAMP’s Draft Boundary Policy: What You Need to Know
FedRAMP’s draft Boundary Policy introduces a targeted approach to defining, managing, and assessing authorization boundaries for cloud service offerings. By focusing on…
Read full blog hereIntroducing AWS Security Incident Response
Amazon Web Services (AWS) recently launched its Security Incident Response service, designed to help organizations prepare for, respond to, and recover from security events.…
Read full blog hereUnderstanding FedRAMP Readiness: Where to Begin?
FedRAMP (Federal Risk and Authorization Management Program) compliance is a critical step for companies providing cloud services to U.S. federal agencies. It ensures your…
Read full blog hereHow to set up an AWS Commercial to GovCloud CI/CD pipeline
If you’ve worked with services in AWS GovCloud, you know about the unique challenges that come with it. Not every AWS service is authorized in GovCloud, which reduces your…
Read full blog hereA Comprehensive Guide to FedRAMP POA&M Compliance
IntroductionAchieving and maintaining FedRAMP compliance is crucial for Cloud Service Providers (CSPs) seeking to serve federal agencies. A key component of maintaining…
Read full blog hereFedRAMP Compliant Inventory
IntroductionCreating a comprehensive inventory for FedRAMP compliance is a significant undertaking. The inventory plays a crucial role in the Plan of Action and Milestones…
Read full blog hereThe Emerging DoD Path to FedRAMP - FedRAMP in 5
Welcome to another episode of FedRAMP in five – where we discuss all things FedRAMP in about five minutes. I'm Jason Shropshire and joining in with me is Ryan Adcock. Today,…
Read full blog hereFrom Classroom to Cloud: My Unforgettable Journey with InfusionPoints
Where do I even begin? The last 10 weeks as an intern with InfusionPoints have been an absolute whirlwind. As an enrolled computer information systems senior at the University…
Read full blog hereInternship Reflection
The internship experience at InfusionPoints has been an amazing experience filled with lots of learning opportunities, amazing people and new connections. Throughout my 10…
Read full blog hereInside InfusionPoints: What You Can Gain from a Cutting-Edge Internship Experience
For the past ten weeks, I have worked alongside industry professionals at InfusionPoints in a dynamic remote environment. This experience has allowed me to find my niche and…
Read full blog herePhishing Resistant MFA - FedRAMP in 5
Welcome back to "FedRAMP in Five," where we talk about all things FedRAMP in about 5 minutes. In our latest episode, Jackson Gorman and I delve into a topic that's capturing…
Read full blog hereWhy the New Interest in NIST 800-63 in FedRAMP?
Update 8/8/2024 - For more info on Phishing Resistant MFA, checkout our latest FedRAMP in 5 episode.
Read full blog hereDISA Releases Rev 5 Cloud Computing Security Requirements Guide
DISA Releases Rev 5 Cloud Computing Security Requirements GuideUpdated August 18, 2024: Latest DoD SSP Addendum Insights for IL4/5/6. See the impact in 'What Changed?' below.
Read full blog hereCompliance Acceleration - Top 5 Challenges to Achieve a FedRAMP ATO
In today's digital landscape, cloud solutions have become the cornerstone of modern businesses, especially within government sectors. The Federal Risk and Authorization…
Read full blog hereThe Automated Future of FedRAMP - A Deep Dive Into the FedRAMP Roadmap Episode 5
Note: This is episode 5 of a five-part series on the Future of FedRAMP. See the links below for other episodes.
Read full blog hereScaling the FedRAMP Marketplace - A Deep Dive Into the FedRAMP Roadmap Episode 4
Note: This is episode 4 of a five-part series on the Future of FedRAMP. See the links below for other episodes.
Read full blog hereFedRAMP News and Updates, May 28, 2024
Today, we're going to delve into some recent and significant developments within the FedRAMP space.Background: FedRAMP Authorization Act
Read full blog hereLog Architecture Maturity Assessment for M-21-31
What is M-21-31?M-21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents, is a memorandum published by the US…
Read full blog hereScale and Reciprocity in the FedRAMP Program - A Deep Dive Into The FedRAMP Roadmap Episode 3
Note: This is episode 3 of a five-part series on the Future of FedRAMP. See the links below for other episodes.
Read full blog hereEnhancing Customer Experience -- A Deep Dive Into The FedRAMP Roadmap Episode 2
Note: This is episode 2 of a five-part series on the Future of FedRAMP. See the links below for other episodes.
Read full blog hereFuture of FedRAMP -- A Deep Dive into the FedRAMP Roadmap Episode 1
Note: This is episode 1 of a five-part series on the Future of FedRAMP. See the links below for other episodes.
Read full blog hereCommand Center - Purpose-Built Compliance
Take Command of your Cloud ComplianceIntroduction:Cloud Service Providers (CSPs) targeting cloud compliance face daunting challenges, from grasping Continuous Monitoring…
Read full blog hereCompliance Acceleration AWS Multi-Account Strategy
Overview of InfusionPoints XccelerATOr Cyber Security Framework Multi-account Strategy based on Defense in depth, Least Privilege and least Functionality Concept. Built to meet…
Read full blog hereComply and Conquer - SSDF Attestation Form and Repo Released!
CISA has released the SSDF Attestation Form on March 11 and Publishes the Repository for Software Attestation and Artifacts on March 18.In Effort to Bolster Government…
Read full blog hereDouble-Edged Sword: New Rev. 5 Resources and Compliance Hurdles
FedRAMP’s transition to NIST 800-53 Revision 5 marks a major shift in the federal cloud landscape, bringing in a new era of security and compliance for Cloud Service Providers…
Read full blog hereAbout FedRAMP Equivalency...
Years ago, the DoD introduced the concept of FedRAMP Equivalency in DFARS 7012, but the term was left open to interpretation. With CMMC rulemaking imminent, DoD released a memo…
Read full blog hereXBU40: Security and Compliance without Breaking the Bank
The cybersecurity landscape has been rapidly evolving over the past few years, and organizations are facing many new challenges as a result. One of the most significant…
Read full blog hereAutomatically Generating SBOMs for Customers
Software bills of materials (SBOMs) are one of the hottest topics in cybersecurity. An SBOM contains information about all of the software components of a computing product or…
Read full blog hereSSDF and How it Impacts your CSO-KAS
The BasicsOn May 12, 2021, the Executive Branch of the Federal Government issued Executive Order (EO) 14028 in an attempt to improve the nation’s overall cybersecurity. Section…
Read full blog hereGenerating and Safeguarding Artifacts for SSDF Attestation
Generating and Safeguarding Artifacts for SSDF AttestationFederal agencies are increasingly requiring CSPs to follow the practices in the NIST Secure Software Development…
Read full blog hereLeveraging US Cit/Soil to defend Customers Data
In the intricate fabric of our nation’s cyber defenses, safeguarding sensitive government data has become a critical imperative. As federal agencies grapple with the…
Read full blog hereA Journey through AWS re:Invent 2023
What an electrifying experience at re:Invent 2023 where the InfusionPoints crew and I navigated the landscape of innovation, inspiration, and after-hours excitement. The…
Read full blog hereThe Threat of Ransomware
A Crisis Level Threat Ransomware has made itself known as one of the most dangerous and prevalent cyberthreats for the new decade. As society becomes more and more dependent on…
Read full blog hereXBU40: Value-Driven Compliance Acceleration
XBU40 is a fully managed and compliant Platform-as-a-Service (PaaS) hosted on Amazon Web Services (AWS) GovCloud and built using InfusionPoints’ XccelerATOr Cybersecurity…
Read full blog hereAttainable Security Elevated: Discovering HPE’s Gen11 Servers with iLO 6
Breaking Analysis: How HPE is Leading the Industry in Supply Chain Security The state of the supply chain and the ability of the United States to secure it is being tested like…
Read full blog hereSecurely Transition to FedRAMP Revision 5 with InfusionPoints
The recent update to the FedRAMP baselines, aligning them with the NIST SP 800-53 Rev. 5 Catalog of Security and Privacy Controls, has transformed the federal cloud landscape.…
Read full blog hereWhat’s New in NIST 800-53 Revision 5 for FedRAMP Cloud Service Providers
On May 30, 2023, the FedRAMP PMO released the long awaited FedRAMP baselines for FedRAMP High, Moderate, Low, and Li-SaaS based on NIST 800-53 rev5. Now, it's time for cloud…
Read full blog hereQuantum Computing vs Cybersecurity: Who Will Win?
Introduction We live in a world where new technological strides are made every day. It can be difficult to keep up with these rapidly evolving technologies, especially when…
Read full blog herePasswords: Revisiting the Tried and True
Introduction Passwords have been an integral part of our digital lives for many years, providing a layer of security for our online accounts and sensitive information. However,…
Read full blog hereRamping Up for StateRAMP
Introduction It is a challenging task staying up to date in the ever evolving realm of cybersecurity compliance. There is a sea of documentation that needs to b
Read full blog hereLack of Cyber-Warriors: The Cybersecurity Workforce Shortage
Introduction Cybersecurity has become one of the fastest-growing fields in the world due to our ever-increasing reliance on technology. With the rapid expansion of digital…
Read full blog hereTesting Your Cryptography: How Concealed Are You?
Introduction Why did the encryption algorithm go to see the doctor? Because it had a bad case of ciphertext! Jokes aside, we are living in an ever increasingly digitized world…
Read full blog hereSCRM Plans and You: FedRAMP Rev.5, SR-2
Introduction SCRM, or Supply Chain Risk Management, has become a crucial aspect of modern cybersecurity, particularly as organizations rely on complex supply chains to deliver…
Read full blog hereFedRAMP is Law! So What?
FedRAMP Signed into Law, So What? The Federal Risk and Authorization Management Program, better known as FedRAMP, is a government-wide program that provides a standardized…
Read full blog hereWhat are the top five challenges of FedRAMP Continuous Monitoring (ConMon)?
Five common challenges of FedRAMP Continuous Monitoring Understanding FedRAMP ConMon Requirements Cross-
Read full blog hereImplementing Zero Trust Architecture for FedRAMP Solutions
Implementing Zero Trust Architecture for FedRAMP Solutions As Government data and resources are distributed across multiple clouds and on-premises environments, protecting them…
Read full blog hereNavigating Compliance: A Guide for SBIR Grant Recipient Companies
Maximizing the Potential of Your Small Business Innovation: How FedRAMP Can Help SBIR Grant Recipient Companies Read Time: Approximately 2.5 minutes.
Read full blog hereInfusionPoints' XccelerATOr Public Applications in Private Networks
InfusionPoints’ XccelerATOr uses a dedicated AWS account, labelled “Transit”, as a boundary cloud access point (BCAP).
Read full blog hereFedRAMP in 5: Amazon WorkSpace Hardening
Amazon Web Services offers many useful tools to achieve FedRAMP compliance. Amazon WorkSpaces is just one of them. Used to complete day-to-day business tasks from a cloud…
Read full blog hereWhat is this thing called consulting?
How does InfusionPoints define ‘consulting’? Consulting, and what it is, can be confusing. There are two main models: staff-augmentation, project-based, or advisory consulting.…
Read full blog hereIntelligence Diversification
Intelligence Diversification Why your organization should use a wide range of threat and vulnerability intelligence tools As our dependence on technology continues to grow, so…
Read full blog hereComply & Conquer - FedRAMP Revision 5 Updates
Let's Get Started! Visit Our Contact Page to Meet Your New Cybersecurity & Compliance Partner! Contact us
Read full blog hereFedRAMP Revision 5 Preparation
FedRAMP Revision 5 Preparation Strategically plan for the upcoming baseline shift Are you a Cloud Service Provider (CSP’s) considering FedRAMP authorization or an authorized…
Read full blog hereSupply Chain Risk Management Deep Dive
Deep Dive into the new Supply Chain Risk Management Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST…
Read full blog hereSecurity Assessment and Authorization Deep Dive
Deep Dive into Changes to the Security Assessment and Authorization Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines…
Read full blog hereSystem and Information Integrity Deep Dive
Deep Dive into Changes to the System and Information Integrity Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines…
Read full blog herePhysical and Environmental Protection Deep Dive
Deep Dive into Changes to the Physical and Environmental Protection Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines…
Read full blog hereConfiguration Management Deep Dive
Deep Dive into Changes to the Configuration Management Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on…
Read full blog herePlanning Deep Dive
Deep Dive into Changes to the Planning Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST Special…
Read full blog hereContingency Planning Deep Dive
Deep Dive into Changes to the Contingency Planning Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST…
Read full blog herePersonnel Security Deep Dive
Deep Dive into Changes to the Personnel Security Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST…
Read full blog hereIdentification and Authentication Deep Dive
Deep Dive into Changes to the Identification and Authentication Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines…
Read full blog hereAccess Control Deep Dive
Deep Dive into Changes to the Access Control Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST Special…
Read full blog hereRisk Assessment Deep Dive
Deep Dive into Changes to the Risk Assessment Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST Special…
Read full blog hereIncident Response Deep Dive
Deep Dive into Changes to the Incident Response Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST…
Read full blog hereAwareness and Training Deep Dive
Deep Dive into Changes to the Awareness and Training Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST…
Read full blog hereSystem and Services Acquisition Deep Dive
Deep Dive into Changes to the System and Services Acquisition Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based…
Read full blog hereMaintenance Deep Dive
Deep Dive into Changes to the Maintenance Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST Special…
Read full blog hereAudit and Accountability Deep Dive
Deep Dive into Changes to the Audit and Accountability Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on…
Read full blog hereSystem and Communications Protection Deep Dive
Deep Dive into Changes to the System and Communications Protection Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines…
Read full blog hereMedia Protection Deep Dive
Deep Dive into Changes to the Media Protection Family in FedRAMP Revision 5 The FedRAMP Program Management Office (PMO) has released new proposed baselines based on NIST…
Read full blog hereFedRAMP NIST 800-53 Revision 5 Deep Dive
FedRAMP Releases Proposed Updated Baselines Following the release of NIST Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations,…
Read full blog hereExploring the World of DISA STIGS: An Introduction
The world of cybersecurity can manifest complex problems, obfuscated puzzles, and skilled bad actors that you will inevitably encounter during your journey within the industry.…
Read full blog hereInfusionPoints XccelerATOr Logging Architecture
InfusionPoints' XccelerATOr Infrastructure as code (IAC) leverages a set of detection mechanisms in each account. This base set of mechanisms is aimed at detecting a wide range…
Read full blog hereFedRAMP in 5 - AC-2 Types
Let's Get Started! Visit Our Contact Page to Meet Your New Cybersecurity & Compliance Partner! Contact us
Read full blog hereFedRAMP in 5 - Prepping for Security Events in a FedRAMP Environment
Let's Get Started! Visit Our Contact Page to Meet Your New Cybersecurity & Compliance Partner! Contact us
Read full blog hereFedRAMP in 5 - Draft Boundary Guidance
Your Guide to FedRAMP Diagrams (UPDATED) What is the purpose of this guidance? The FedRAMP Authorization Boundary guidance provides a roadmap for developing, maintaining, and…
Read full blog hereFedRAMP in 5: Client-Side Components
Check out our newest FedRAMP in 5 episode!
Read full blog hereCreating XccelerATOr
InfusionPoints began our advisory work in FedRAMP just when the FedRAMP program was being formed. Our first FedRAMP project was with Dell Services where we helped develop the…
Read full blog hereFedRAMP in 5 - Staffing and Training
FedRAMP in 5 Where we talk all things FedRAMP, in about 5 minutes or less. Todays Topic: Staffing and Training. What is InfusionPoints doing about staffing? InfusionPoints does…
Read full blog hereHPE is Elevating Supply Chain Security
“Supply chain attacks are real and here to stay.” This is the lesson learned as we watched a global pandemic, the SolarWinds attack, and Ransomware attacks on critical…
Read full blog hereDevice Identity and Component Attestation comes to HPE Gen10 Plus servers
Supply chain and cyber-attacks are dominating headlines in 2021. The need for assurance of the provenance, security, and trustworthiness of hardware, firmware, and software…
Read full blog hereInfusionPoints’ First APN TV video is Live!
As an AWS Advanced Consulting Partner and Public Sector Partner, InfusionPoints makes use of the highly innovative features of the AWS platform to deliver a highly available…
Read full blog hereHere Today, Gone Tomorrow. New IOC Trends
Here Today, Gone Tomorrow. New IOC Trends
Read full blog hereDFARS, NIST, and CMMC - The New Interim Rule for DoD CyberSecurity Requirements
The New Interim Rule & What it Means for You The Office of Information and Regulatory Affairs at the Office of Management and Budget have released a new interim rule that…
Read full blog hereHow HPE is Leading the Industry in Supply Chain Security
Breaking Analysis: How HPE is Leading the Industry in Supply Chain Security The state of the supply chain and the ability of the United States to secure it is being tested like…
Read full blog hereMalicious Coronavirus COVID-19 Link
Malicious Coronavirus COVID-19 Link Hackers are taking advantage of fears surrounding the Coronavirus/COVID-19 outbreak by luring people into clicking links that download…
Read full blog hereFedRAMP in Five - Database Vulnerability Scanning
Database Vulnerability Scanning Vulnerability scanning is a very important part of obtaining and keeping a FedRAMP ATO, and generally scanning is a well understood topic.…
Read full blog hereDFARS | CMMC - What You Need to Know as a Contractor
CMMC Overview The purpose of the new Cybersecurity Maturity Model Certification (CMMC) is to measure the level of cybersecurity maturity of prime contractors and their supply…
Read full blog hereFedRAMP in Five - Encryption of Data in Transit
Encryption of Data In Transit Recently, the Project Management Office (PMO) has been enforcing a very strict interpretation of what needs to be encrypted in-transit (SC-8).…
Read full blog hereCMMC and the POAM– Are POA&Ms really not allowed?
Has the use of the Plan of Actions and Milestones (POA&M) changed based on CMMC? CMMC v1.0 has officially been released as of Friday, January 31, 2020. One topic that has…
Read full blog hereDFARS|CMMC Updates
8/16/2020 - CMMC Accreditation Body Announced The board members are self-nominated, non-felon US citizens. The Board Chairman will select the Directors, who are then approved…
Read full blog hereNIST: Privacy Framework v1.0 Overview
Why Privacy is Important From NIST: Privacy Framework - Privacy is challenging because not only is it an all-encompassing concept that helps to safeguard important values such…
Read full blog hereCyberSecurity Advisory
InfusionPoints is providing this cybersecurity advisory to our customers and contacts as a community service. The Cybersecurity and Infrastructure Security Agency (CISA) within…
Read full blog hereOSCAL: The Next Gen of SSP
OSCAL and FedRAMP Automated compliance is a constantly evolving topic, especially when it comes to large and complex cloud services. The demand for automated compliance for…
Read full blog hereProwler: What it does, how we use it, and why you need it.
What is it? Prowler is an open source Amazon Web Services (AWS) “Security Best Practices Assessment, Auditing, Hardening, and Forensics Readiness tool” developed by Toni de la…
Read full blog hereThe Serious Business of DFARS Compliance
A California U.S. district court ruled last week that allegations against Aerojet Rocketdyne could progress following Brian Markus’ complaint that the company terminated his…
Read full blog hereAWS Root Account Best Practices
“Our entire AWS account is gone. The call center is down, we can’t log in - it’s like it never existed! How do we get it back?” A multimillion-dollar services provider…
Read full blog hereRobbinhood: Prince of Ransomware
As some things from our childhood, things aren’t always as they appear. With what we thought was a vigilante that stole from the rich to give to the poor is now shooting arrows…
Read full blog hereWhy Am I Getting So Much Spam?
An Intro To Email Bombs You’re working quietly at your desk and suddenly start getting emails. Lots, and lots, and lots of emails! You easily received 40-50 emails in just one…
Read full blog hereDepartment of Defense Goal is to Streamline Enforcement for DFARS 7012 Compliance
Department of Defense (DoD) may seek to outsource it’s supply chain cybersecurity audits by allowing organizations to verify DFARS 7012/NIST SP 800-171 compliance. During a…
Read full blog hereDFARS Compliance Audits are Coming... Are You Prepared?
When the countdown has finalized and its now time to become DFARS compliant, who do you turn to?
Read full blog hereDoD continues to provide additional guidance for Assessing Compliance Required by DFARS Clause 252.204-7012
Right on Schedule, on November 6th, 2018, DoD’s Acting Principal Director for Defense Pricing and Contracting (DPC) issued a memorandum titled, “Guidance for Assessing…
Read full blog here4 Key Highlights Impacting Defense Contractors from the NIST CUI Workshop Held October 18, 2018
On October 18, 2018, the National Institutes for Standards and Technology (NIST) hosted a day-long workshop that featured experts from across the government brought in to…
Read full blog hereInfusionPoints is in-process with ISO 27001 and SOC 2 accreditation
At InfusionPoints, we have just gone through the onsite portion of our audit for ISO 27001 and SOC 2, and should have those certifications along with our ISO 9001:2015…
Read full blog hereRunning is a Passion
Running is a passion for us...and InfusionPoints sees the benefit too! Great benefits…check. Work-life balance…check. Excellent coworkers to work alongside…double check.…
Read full blog hereChanges to the FedRAMP Significant Change Process
On August 30th, the FedRAMP PMO dropped a new round of changes that they had warned about since the updated boundary guidance came out in May. These changes included updates to…
Read full blog herePart 1: MITRE Report Recommends Critical Changes to the Department of Defense’s Strategic Approach to Supply Chain Security
MITRE Corporation recently released a report recommending significant changes to cybersecurity for the DoD supply chain, including changes in the role of cybersecurity in the…
Read full blog herePart 2: MITRE Report Recommends Critical Changes to the Department of Defense’s Strategic Approach to Supply Chain Security
This is Part 2 of a 2-part InfusionPoints’ Series based on MITRE’s report that recommended critical changes to the Department of Defense’s (DoD) strategic approach to supply…
Read full blog hereWhat's new in the FedRAMP High SSP Template?!
On August 30th, the FedRAMP PMO dropped a new round of changes that they had warned about since the updated boundary guidance came out in May. These changes included updates to…
Read full blog hereWhat's new in the FedRAMP RAR?
Yesterday, the FedRAMP PMO dropped a new round of changes that they had warned about since the updated boundary guidance came out in May. These changes included updates to the…
Read full blog hereDefending your CUI/CDI infrastructure with an improved Security Operations Capability
DFARS/NIST compliance is hard We are hearing more and more from our customers every day that they are being required to attest to their DFARS compliance status and all…
Read full blog hereDraft DoD Guidance for reviewing NIST SP 800-171 SSP and POA&M -- Do you want to compete in the Federal Market Space?
On April 24, 2018, the Department of Defense (DoD) issued a Notice and Request for Comment on draft guidance for procurements that require contractors to meet security…
Read full blog hereDemystifying FedRAMP - Part 4 - Who is allowed to work on the system or access SSP documentation? What about non-US Persons / non-US Citizens?
Who is allowed to work on the system or access SSP documentation? Note: This is part 4 of a multi-part series. See the links below for other topics in the series. Today we will…
Read full blog hereDemystifying FedRAMP - Part 3 - Is system documentation included in the system boundary? What classification should be placed on our system security plan (SSP)?
Note: This is part 3 of a multi-part series. See the links below for other topics in the series. Today we will address questions around handling and classification of the…
Read full blog hereDemystifying FedRAMP - Part 2 – If I follow FedRAMP requirements and get a P-ATO, my cloud service will be well designed and attractive to Federal Agencies, right?
In part 1 of this series, we addressed the question “Is an NDA with FedRAMP needed to protect my company’s trade secrets?” In today’s topic we address the question “If I follow…
Read full blog hereDemystifying FedRAMP - Part 1 - Is an NDA with FedRAMP needed to protect my company’s trade secrets?
While providing FedRAMP consulting for our customers, we’ve have had to address a variety of questions that have come to us varying from the strategic to specific questions on…
Read full blog hereThe Mecklenburg County Ransomware Attack -- Four Key Takeaways for Your Breach Readiness Program
The scope of ransomware victims continues to rapidly expand beyond individual consumers and into business and Government organizations. This was recently evidenced in early…
Read full blog hereIs your organization ready for a data breach?
We talk with many organizations every day, and the most common issue we see in cyber security today is culture, even though we see the threats everywhere in the news, on TV, in…
Read full blog hereYour wireless network is KRACK-ed! Time to act!
A new wireless vulnerability affecting WPA2 protected wireless networks was published by security researchers on Monday as first reported by ArsTechnica.
Read full blog hereHigher Education Must Ensure Information Security
I was talking to my colleague, Nicole White, the other day about the need for DoD contractors to implement NIST 800-171 controls before the end of 2017 to comply with DFARS…
Read full blog hereThank you for ten incredible years!
It’s hard to believe Plan B has turned into ten of the best years of my life. Who said starting a business in the middle of the great recession was a bad idea? Through the…
Read full blog hereDangers of not complying with DFARS/NIST 800-171
I am not a fear monger. I don’t try to use Fear, Uncertainty, and Doubt to influence people. Regardless, today, I am writing to raise up warning flags. If you sell products or…
Read full blog hereLeveraging VNSOC360° Managed Security Services for Federal Compliance
If you have been in IT or Security Operations long enough, you’ve come across that environment or product that you have to deal with on a day-to-day basis that has you pulling…
Read full blog hereBusiness-Friendly Security
Security becomes an adversary to your organization when it hinders the operation of key business functions. And the smooth operation of revenue-producing business processes…
Read full blog hereDFARS and NIST 800-171... Why are they important?
For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government . . . the following security requirements apply:
Read full blog hereResetting the enable password on a Force10 S50N switch
Googling around for a solution to this one and you'll find many. Over time these have changed based on the boot code and FTOS version so many will no longer work. We ran into…
Read full blog here6 Essential Questions for Small to Midsize Businesses (SMB) to ask, that will Improve Their Security Posture
There are two types of Small to Midsize Businesses (SMB) in today’s world: those who know they have been breached, and those who do not. The difference between these types of…
Read full blog hereYou are under attack right now… but how would you know… are you watching?
If you are connected to the internet, you are under attack right now…Are you monitoring or watching your IT ecosystem, if you are not how would you know? Most small to midsize…
Read full blog hereWhat you see is what you get with Small Business Security Culture
As a small business owner myself, I truly understand the everyday challenges we face, Payroll, Human Resources, Service Delivery, New Business, Equipment Maintenance… Cyber…
Read full blog hereSmall and Mid-Sized Businesses need to focus their security spending on tactical and strategic controls….
For several decades now, business have been transformed by technology. However, small to midsize businesses (SMB) were at a disadvantage competing against a bevy of larger,…
Read full blog hereThe transformation of rural telecommunications organizations are increasing Cyber Security Risks
Rural telecommunications organizations are moving fast to deliver high-quality and reliable communications services, as well as provide additional services such as video on…
Read full blog hereTotal loss of control of the ever expanding enterprise security boundary -- #WhereDidMyDataGo
Traditionally, an organization’s systems were developed, acquired and deployed inside of the corporate security boundaries for use by employees, partners and contractors in an…
Read full blog hereThe Irony in WaPo's "Net of Insecurity"
In the opening of part 3 of the Washington Post series “Net of Insecurity”, WaPo posits that L0pht warned congress early on in 1998 of the inherent security flaws of the…
Read full blog hereHas SenderBase.org caused widespread email disruptions this week?
Note: This post is about an ongoing issue and is based on available information. Updates will be amended, and corrections made as new information becomes available.
Read full blog hereRogue Access Points
A Rogue Access Point is an unauthorized wireless device that acts as a gateway to your internal network. They are typically attached to an open network port in an empty office…
Read full blog hereIdentity Management Services and the Cloud
I was recently interviewed for an upcoming article, and thought the questions and answers would make for a good blog post. Interview on Identity Management Services in the…
Read full blog here