Audit Criteria

The Center for Internet Security announced new capabilities for its SecureSuite Platform to help organizations improve their cybersecurity posture. A new feature called Cybersecurity Journey converts assessment results into an interactive roadmap aligned with the NIST Cybersecurity Framework functions. The update also includes an integrations framework supporting Action1 and direct access to CIS Benchmarks from…

The Public Company Accounting Oversight Board issued a request for public comment on its standard-setting agenda, including the role of artificial intelligence in audits. The board noted that previous commenters disagreed on whether AI issues should be handled through staff guidance or formal standards. It asked whether current auditing standards are fit for purpose in…

The National Institute of Standards and Technology is releasing the first two volumes of the Control Overlays for Super Intelligence Systems project. This initiative adapts existing SP 800-53 security controls to address specific risks in predictive, generative, and agentic AI systems. The guidance covers components like training data and model weights that traditional IT security…

A developer guide explains how to satisfy NIST SP 800-53 CM-3(6) by replacing manual tracking with automated cryptographic management. The article advocates for Cryptography-as-Code, using Infrastructure-as-Code tools like Terraform to define TLS policies and key lengths. It details integrating automated Certificate Authorities via the ACME protocol to enable zero-downtime rotation of certificates and keys. The…

A cybersecurity expert explains that System Security Plans and Plans of Action and Milestones are not new to defense contractors. These documents have been required under DITSCAP, DIACAP, RMF, and now CMMC. The core requirement remains to document system protections and track open findings. Under CMMC Level 2, contractors must meet at least 88 of…

NIST has opened a comment period for its draft Special Publication 800-221r1. The document focuses on governing and managing information and communications technology risk within an enterprise portfolio. It aims to help organizations align their risk management with the NIST Cybersecurity Framework 2.0. The public comment period remains open through December 7, 2026. Read the…

GovRAMP launched an AI Security Task Force to create practical guidance for AI-enabled cloud products used by government agencies. The initiative builds on established standards, specifically NIST SP 800-53 Rev. 5 and the NIST AI Risk Management Framework, to address new data flows and dependencies. The group is developing an AI Self-Reporting Addendum to help…

NIST has released the initial public draft of SP 800-100 Revision 1, an information security handbook for executive leadership. The revision restructures the 2006 original to align with the NIST Cybersecurity Framework 2.0 organization. It covers governance, risk management, and topics under the Identify, Protect, and Detect/Respond/Recover functions. A public comment period runs from October…