Exploring the NIST Cybersecurity Framework 2.0: What You Need to Know

Summary

このトランスクリプトは、Windsor Technology GroupのMatt KazlowskiとArctic WolfのTodd Malletが共同で行ったウェビナーの内容を要約しています。彼らは、NISTサイバーセキュリティフレームワーク2.0について議論し、その更新点、供給チェーンのリスク管理、および新しいガバナンス機能の強化されたemphasisを説明しています。また、Arctic WolfとWindsor Technology Groupが顧客のニーズに合わせて提供するサービスと製品についても触れています。

Takeaways

• 📌 NIST Cybersecurity Framework 2.0 はまだドラフト段階にありますが、ほぼ完成品に近いとされています。
• 🛡️ Winslow Technology Group は、マサチューセッツ州のウォラムズに本社を置いており、東北部からカリフォルニアまで地域的なカバーを提供しています。
• 🤝 Arctic Wolf は Winslow Technology Group とパートナーシップを結んでおり、セキュリティ技術やサービスを提供しています。
• 🔍 NIST 2.0 は、グローバル経済や垂直統合の進展により、供給チェーンのリスクが重要視されるようになりました。
• 📈 NIST 2.0 では、6つの機能（Identify, Protect, Detect, Respond, Recover, Govern）が新たに設けられました。
• 📚 旧バージョンの NIST 1.1 から NIST 2.0 への移行は、既存のセキュリティ体制を改善するための一歩として位置付けられています。
• 💡 Arctic Wolf は、継続的な監視と事象分析を通じて、マネージドセキュリティオペレーションセンター（MDR）を提供しています。
• 🔄 NIST 2.0 は、リスク管理戦略やポリシーの重要性を強調し、組織全体のセキュリティ体制に関与する利益関係者を拡大するよう求めています。
• 🚨 セキュリティ事件への対応においては、迅速かつ計画的なアプローチが重要であり、混乱を避けるための事前準備が求められます。
• 🛠️ NIST フレームワークの評価や、リスク管理に関するサポートが必要な場合は、Winslow Technology Group が提供する無償のミニ評価を受けることができます。

Q & A

NIST Cybersecurity Framework 2.0の主要な更新点は何ですか？

NIST Cybersecurity Framework 2.0の主要な更新点は、新しい統治機能の追加、供給チェーンのリスク管理の強化、およびCMMCに関連する制御のいくつかの変更です。

統治機能がNIST 2.0にどのように役立つのでしょうか？

統治機能は、NIST 2.0において、他の5つの機能を組織の使命とステークホルダーの期待に関連联させることを助け、全面的なセキュリティ戦略を構築する上で欠かせない要素となっています。

Winslow Technology Groupが提供するサービスは何ですか？

Winslow Technology Groupは、プロフェッショナルサービス、网络安全、ネットワーク、クラウドなどの分野で、技術的なエンジニアリングを提供しています。また、Arctic Wolfなどのパートナーシップを通じて、デスクトップからデータセンターまでをカバーするゲームチェンジングのソリューションと技術を提供しています。

Arctic WolfのMDRサービスとは何ですか？

Arctic WolfのMDRサービスは、マネージドセキュリティオペレーションセンターをサービスとして提供することを指します。これは、継続的な監視、異常イベント分析、およびインシデント対応を含みます。

NIST 2.0のリリースに準備するために、どのようなアクションを取ることができますか？

NIST 2.0のリリースに準備するために、組織は現在のセキュリティ状況を評価し、リスク管理戦略を改善し、継続的な監視とインシデント対応計画を強化する必要があります。また、GRCツールなどの支援ツールを利用して、効果的な実施を図ることも重要です。

Arctic WolfがCMMCレベル2の認定を取得しているのはいつからですか？

Arctic Wolfは現在、CMMCレベル2の多くのコントロールを満たしており、そのほとんどを補完しています。将来的には、CMMCレベル2の正式な認定を目指しています。

FedRAMP ModerateまたはHighのクラウドセキュリティ要件を満たすために、Arctic Wolfはどのような措置をとっていますか？

Arctic Wolfは、北米に基づく顧客に対して、北米のみのArctic Wolfの従業員と通信し、データロケールは100％アメリカ合衆国に基づいており、他の国にはトラバースされないことを保証しています。また、PII（個人を特定できる情報）は吸収せず、吸収された場合でも即座に削除する制御が設けられています。

NISTフレームワークとSOC 2の関係は何ですか？

NISTフレームワークは、SOC 2プログラムと重複しています。NISTフレームワークは、多くのコントロールをカバーしており、SOC 2に準拠するための大きな準備をします。ただし、SOC 2はサービスプロバイダーに特化したコントロールを持っているため、NISTフレームワークとSOC 2の両方を満たすことが重要です。

Winslow Technology Groupは、NIST評価をどのように支援していますか？

Winslow Technology Groupは、無料でミニNISTサイバーセキュリティフレームワーク評価を提供しています。これは、各機能に関する一連の質問に基づくコンサルチティブなインタビューであり、顧客がフレームワークに関する質問や一般的なセキュリティに関する質問をすることができます。評価の結果、顧客は赤、緑、黄の異なるカラーコーディングによる完全な報告を受け取ります。

GRCツールについて、どのようなアドバイスがありますか？

GRCツールは、ガバナンス、リスク管理、コンプライアンスを管理するのに役立ちますが、エクセルなどの基本的なツールでは効果的に管理することが難しいです。Winslow Technology Groupは、GRCツールを提供しており、顧客がNIST 2.0への移行を支援することができます。

Outlines

00:00

📢 ウェルカムとNIST CSF 2.0の紹介

Matt KazlowskiがWindo Technology GroupのVPとして、Cyber Securityに関するウェビナーで登壇。Toddを紹介し、NIST Cyber Security Framework 2.0について話し合う。NIST 2.0はまだドラフト段階にあるが、已完成の製品に近い。このフレームワークの更新版には重要な情報がある。

05:00

🗓 ウェビナーのアジェンダとWindo Technology Groupの紹介

ウェビナーのアジェンダを説明し、Windo Technology GroupとArctic Wolfのサービスについて説明。参加者は質問をチャットで投じて、後半でまとめて回答する。Windo Technology Groupのローカルカバーとパートナーシップについても触れる。

10:03

🌟 Winslowの技術力とNISTフレームワークの適用

Windsor Technology Groupの技術力と、Pre-salesとPost-salesの専門家がNIST 1.0または1.1フレームワークに対応する方法について説明。GRCツールを提供し、リスク管理の様々な要素を取り入れている。

15:03

🚀 NIST CSF 2.0の更新と供給チェーンの強化

NIST CSF 2.0の更新内容について説明し、Govern機能の追加と供給チェーンのリスク管理の強化について議論。CMMCに関連する制御についても触れ、Arctic Wolfがどのように役立つかを示唆。

20:04

🔍 NIST 2.0の検出と対応機能の改善

NIST 2.0における検出過程の改善と、Arctic Wolfのマネージドセキュリティ運用センター(MDR)サービスの役割について説明。継続的な監視と事件分析の重要性に焦点を当て、Arctic Wolfが提供するサービスの背後にある理念を明確にする。

25:06

🛠️ 事故復旧計画とNIST 2.0の改善

NIST 2.0の復旧機能の焦点を事故復旧計画の実行と通信に変更することを説明。事故対応の際の分析、計画の立て方、適切な行動の重要性について強調し、Arctic WolfとWindsor Technology Groupがどのように役立つかを述べる。

30:07

🏛️ ガバナンスとNIST 2.0の全体像

NIST 2.0におけるガバナンス機能の6つのサブカテゴリーについて説明し、組織全体のセキュリティ框架に対する認識を高める。重要なのは、ガバナンスが他の5つの機能に影響を与えることである点である。

35:08

🔑 セキュリティの管理とNIST 2.0の適用

NIST 2.0の管理機能がどのように組織のセキュリティ戦略を確保し、リスク管理戦略を定義するかを説明。NIST 2.0が他のコンプライアンスに準備する際に役立つ理由を強調し、Arctic WolfがFedRAMPやCMMCの認定に向けて取り組んでいることを述べる。

40:10

📋 NIST CSF 2.0のタイムラインとQ&A

NIST CSF 2.0のドラフトのタイムラインを説明し、ウェビナーの最後にQ&Aセッションを提供する。Arctic WolfのサービスがどのようにNIST 2.0の要件に対応しているか、またGRCツールがどのように役立つかを説明。

Keywords

💡NIST Cybersecurity Framework 2.0

NIST Cybersecurity Framework 2.0は、アメリカ国立標準技術研究所（NIST）が開発した、サイバー脅威に対するリスク管理のためのフレームワークです。このフレームワークは、企業がサイバーセキュリティを強化するための指針を提供し、識別、保護、検出、対応、復旧という5つの機能に基づいています。また、2.0バージョンでは、ガバナンスが新たに追加され、組織全体のセキュリティ戦略を強化するよう求めています。

💡Risk Management

リスク管理とは、潜在的なリスクを識別、評価、および優先順位付けを行い、それに対する対策を立てることです。これにより、組織は将来的な問題を回避し、損失を最小限に抑えることができます。リスク管理は、サイバーセキュリティにおいても重要な役割を果たし、NIST Cybersecurity Framework 2.0においてもその重要性が強調されています。

💡Supply Chain Risk

サプライチェーンリスクは、組織が外部と連携する際に発生する可能性のあるリスクのことを指します。これには、資料の提供者やパートナー企業など、外部の関係者がシステムへのアクセスを取得し、そのようなアクセスを悪用する可能性があることが含まれます。サプライチェーンリスク管理は、NIST Cybersecurity Framework 2.0においても重要なテーマとなっています。

💡Governance

ガバナンスとは、組織の戦略、目的、および利害関係者の期待を考慮して、意思決定や管理を行うプロセスのことを指します。NIST Cybersecurity Framework 2.0においては、ガバナンスが新たに追加され、サイバーセキュリティ戦略を組織全体のコンテキストに置いて定義し、実施するための枠組みが提供されています。

💡Managed Security Operations Center (MSOC)

マネージドセキュリティオペレーションセンター（MSOC）とは、外部企業が提供するサービスを通じて、継続的に監視、検出、分析、対応するセキュリティオペレーションセンターのことです。MSOCは、組織のセキュリティインシデントに対する迅速な対応を可能にし、専門的な知識と技術を利用してサイバー脅威に対応します。

💡Incident Response

インシデント対応とは、サイバー攻撃やセキュリティ違反が発生した際に、迅速かつ効果的に対処するためのプロセスです。これには、攻撃の検出、インシデントの報告、分析、対応策略の立案、被害の最小化が含まれます。NIST Cybersecurity Framework 2.0においては、インシデント対応計画の策定と実施が重要視されています。

💡CMMC (Cybersecurity Maturity Model Certification)

CMMC（Cybersecurity Maturity Model Certification）とは、アメリカ国防総省が導入する、サイバーセキュリティの熟達度を評価・証明する制度です。CMMCは、防衛契約者が持つサイバーセキュリティ能力を標準化し、サイバーリスクを管理するためのガイドラインを提供します。

💡FedRAMP (Federal Risk and Authorization Management Program)

FedRAMP（Federal Risk and Authorization Management Program）とは、アメリカ連邦政府のクラウドサービスプロバイダーのセキュリティおよびプライバシー基準を確立するプログラムです。FedRAMPは、クラウドサービスを利用する政府機関のリスクを管理し、情報システムのセキュリティを確保することを目的としています。

💡SOC 2 (System and Organization Controls Type 2)

SOC 2（System and Organization Controls Type 2）とは、サービスプロバイダーの信息系统のコントロールに関する評価基準です。SOC 2は、コンフィデンシアリティ、インテグリティ、可用性、プロテクション、プライバシーの5つのトラストサービスカテゴリに基づいて、サービス提供者がこれらのカテゴリに対するコントロールをどのように適用しているかを評価します。

💡GRC Tool (Governance, Risk, and Compliance Tool)

GRCツール（ガバナンス、リスク、コンプライアンスツール）とは、組織がガバナンス、リスク管理、コンプライアンスを効率的に管理するためのソフトウェアツールです。GRCツールは、ポリシーの遵守、リスクの評価、規制の対応、レポートの作成など、幅広い機能を提供し、企業が複雑な規制環境を適応させる助けます。

Highlights

Overview of the NIST Cybersecurity Framework 2.0

Introduction of Matt Kazlowski, VP of Professional Services in Cybersecurity at the Winslow Technology Group

Todd, a senior sales engineer from Arctic Wolf, joins the discussion

The framework has been in development and is close to a finished product

Updates to the NIST Cybersecurity Framework 2.0 and their importance

Agenda for the webinar covering Winslow Technology Group and their Cybersecurity Solutions

Discussion on the regional coverage and reach of Winslow Technology Group

Emphasis on customer satisfaction and outcomes as a measure of success for Winslow Technology Group

Technical Engineers at Winslow Technology Group and their combined technical experience

Introduction to Arctic Wolf and their partnership with Winslow Technology Group

Updates to the NIST Cybersecurity Framework 2.0, including the addition of the 'Govern' function

Discussion on the supply chain risks and their relevance to the NIST framework

Timeline for the rollout of NIST Cybersecurity Framework 2.0

How to prepare for NIST Cybersecurity Framework 2.0 and the offerings from Winslow and Arctic Wolf

Explanation of the six controls of NIST 2.0 and their purposes

Discussion on the importance of governance in the NIST Cybersecurity Framework 2.0

The role of the 'Govern' function in creating a comprehensive security plan for organizations

The impact of the NIST Cybersecurity Framework 2.0 on various stakeholders within an organization

The evolution of the NIST Cybersecurity Framework from version 1.1 to 2.0

The significance of the 'Improvement' category in the Identify function of NIST 2.0

Details on the Protect function and its focus on platform security and technology infrastructure resilience

The Detect function and its emphasis on continuous monitoring and adverse event analysis

The Respond function and its new categories for incident management, analysis, response reporting, and communication

The Recover function and its focus on restoring assets and operations with a well-orchestrated plan

The Govern function and its role in establishing and monitoring the organization's cybersecurity risk management strategy

The importance of understanding and managing risks in the context of the organization's mission and stakeholder expectations

The potential impact of the NIST Cybersecurity Framework 2.0 on insurance premiums and risk management

The necessity of planning and risk management in preventing future cybersecurity incidents

The offer of a free mini NIST Cybersecurity Framework assessment by Winslow Technology Group

The discussion on how the NIST framework can complement other compliance frameworks like SOC 2 and FedRAMP

Transcripts

all right good morning everyone I am

Matt kazlowski I'm the VP of

Professional Services in cyber security

at the windso Technology Group and this

morning I am joined uh with Todd uh

senior sales engineer from Arctic Wolf

networks high at top the Winslow uh

webinar

Tower uh today we're actually gonna

cover the nist uh cyber security

framework 2.0 um so this framework has

been in the works for a bit of time it

is technically still in the uh the draft

state but it's pretty close to a a

finished product and we wanted to get

some information out um there's some

really great um updates to the framework

and um some some important information

there so Todd thank you very very much

for uh for joining us this morning um

yep yep good uh next slide there uh we

can talk about the agenda bit so we'll

just give you a brief overview of the

windso Technology Group um and our cyber

Security Solutions and and portfolio

here I'm gonna pass the uh the old mic

to uh to Todd um one of our senior sales

Engineers over at Arctic networks to

talk quite a bit about um the framework

it's going to be a pretty open uh open

discussion um if people have any

questions uh during uh the presentation

the best way to do that is drop them

right in the chat um this is a uh this

is a live presentation so um towards the

end we'll uh we'll group them all up and

uh and try to answer as many as we can

um if we're not able to we'll we'll

follow up with with y'all afterwards um

so that is that Todd you can hit the

next slide there sure um thank you um

just a a little bit about the windso

Technology Group so we are headquartered

um in walam Massachusetts right outside

of um beautiful Boston Massachusetts um

I'm actually in Connecticut right

between New York City and Boston um the

windso Technology Group has local

coverage from Maine through the

Carolinas um far out in Western

Pennsylvania and and down in uh in

Nashville too um where where we can um

have you know Regional local coverage

with with truly National reach um we

carefully vet our Partnerships like that

of Arctic Wolf to really provide um

gamechanging Solutions and Technologies

from the desktop to the data center uh

through our Professional Services cyber

security uh networking uh and cloud and

we we really try to identify unique and

and truly differentiated products and

services that provide uh effective

solutions that lead uh to um fantastic

uh outcomes for our customers uh next

slide please

St um so speaking of uh of outcomes um

on staff we at Winslow have a bench uh

of technical Engineers on our pre-sales

and postsales side that truly represent

hundreds of years uh of combined

technical experience we have four

OnStaff cissps and a truly truly

dedicated team of account Executives

that have a passion for technology and

outcomes and if there's one thing uh I'd

leave you with that characterizes the

windso Technology Group and Partnerships

with arctic wolf uh it's that customer

satisfaction and outcomes are our

measure of success like our mission

truly uh is take the passion and

expertise we have uh focus on outcomes

you know deliver on uh what you know our

customers like you need uh in the space

today and and one of those uh is you

know differentiated services with our

partner um arctic wolf so I'm really

happy to um to talk with Todd a bit

today uh about um about you know the NIS

cybercity framework 2.0 again draft

State uh we can talk quite a bit about

it and go from there you can go to the

next

slide do need to uh poke fun at uh

ourselves I guess a bit at the slide

because um if you're looking at this

you're noticing it's missing uh the

governance wheel uh we haven't had time

to uh to quite update this yet and the

framework still is I guess in a draft

state but um we'll we'll update it when

uh when we come out of draft I suppose

but a point being is at the windso

Technology Group in in Partnerships with

arctic wolf and and different services

that uh we uh deliver in including a

whole portfolio of of managed service

Services um we have a a fairly

comprehensive and complete uh portfolio

of products and services to help uh

customers of all shapes and sizes really

achieve um cyber security uh you know

security if you will uh really really

helping reduce risk and and managing uh

that risk to an acceptable level um we

can help with all aspects of the nist

1.0 or 1.1 framework which you're

looking at now um bunch of Technologies

you see layered there um and the 2.0 um

so one of the tools that uh winsel has

introduced um that you know I'm excited

for as this develop uh this framework

develops is a GRC tool so we have a

governance risk and compliance tool that

we're able to provide as a service with

Consulting and a variety of other um

riskmanagement uh components go into

that so A really exciting offering there

uh Dov Tales beautifully uh into what

Todd and I are going to speak about this

morning regarding uh the updated nist uh

cyber security framework uh Todd would

you um like to uh you know introduce

yourself and introduce arctic wolf a bit

yeah thanks Matt so Todd Mallet I'm one

of the sales Engineers or sc's here in

in the New England patch um I've been

here for around four years or so uh

previous to that kind of all over the

place uh infrastructure Centric um but

uh but been here for about four years

been a great run huge growth a lot of

that growth is due to Winslow um partner

of the year I think two or three times

something like that Matt but it's it's

been a lot one of our uh uh one of our

best Partners certainly in New England

and then actually in the United States

um so with that just very very quick

agenda um and before I get started we

encourage you guys to ask questions

we'll have a Q&A session after this um

so if you do have a question please post

it in chat and we'll try to get to as

many of them as we possibly can toward

the end of the call um but the things

that we'll be going through today are

obviously the update to n CFS uh what's

changed what's moved there's been a lot

of a lot of things that have been

augmented and and kind of tweaked within

this CFS the core construct is is still

there um but that second bullet point

the Govern function is really I think

the the newest thing and and almost

creates something of an overarching idea

around nist and and kind of plays to the

rest of the five controls that we're all

used to seeing for the last couple of

years um an enhanced emphasis on supply

chain so more and more as we you know

create kind of the global economy or uh

more vertical Integrations things like

that supply chain risks have become

something that's on Forefront of a lot

of companies mind certainly that I talk

to um and that you know directly relates

to miss but also if you've heard of or

are privy to cmmc um there's a lot of

controls specific to your vendors and

and also those that you're selling to if

they have any access to systems within

your environment even if they're uh you

know dedicated systems they still need

to have um some some level of security

so so you yourself as a company entity

are protected uh throughout your supply

chain engagements we'll talk a little

about the timeline line for roll out as

Matt has mentioned this is still in

draft state so what we're talking about

today is a little bit preemptive some

stuff could change but it's very very

late stage um this has been a long

process to create n 2.0 uh the questions

if you will or suggestions were due uh

116 November 6th of this year so the

question and answer portion is closed so

we should see something finalized in the

next couple of months and then we'll

kind of wrap it up with how to get

started um wisel has some offerings uh

that can certainly help you guys through

a nist assessment which Matt will talk a

lot more about as we get through the

deck um but that's kind of how we'll end

it you know what are what are the call

the actions what can you do to get

prepared for for 2.0 um if you're

already on 1.0 certainly a lesser lift

if you're just starting to look into n

compliance um as a framework that your

company wants to try to adhere to um

this will give you a great starting

point on on how to get going with

it so this is kind of what it looks like

this is a 50,000 foot view on 1.1 and

what 2.0 will look like uh nist

originally was started in 2014 finalized

in 18 um and that's kind of where we see

those traditional five different

controls identify protect attack respond

and recover as we move into 2024 over

the last you know 10 eight eight years

Etc since we've had a new draft of this

a lot has changed uh we've seen a lot of

increase in uh malicious attacks in

cyber crime losses we've seen uh the

landscape change and pivot away from you

know just the information age we moved

over to internet of things and now we're

stuck in and trying to cope with quite

frankly Ai and ml you know what is that

going to mean for us going forward from

a security perspective and I think

that's what 2.0 was really meant to try

to address and I think again when you

look at that overarching in inside wheel

uh govern I think that's why it was

created um and again I'm pretty excited

about this I know Matt is too because

govern is now going to get some tendrils

outside of it right it's going to have

you know those of you on the line I

assume the majority are within some form

of the it or with your companies but now

it's going to have you directly

interfacing with and having stakeholder

you know people talking through nist

with you what does this mean for the

company overall Mr sea level Miss sea

level um so I think there's going to be

a lot of additional stakeholders that

are going to take interest in nist um

and start paying attention to what it

means from an overarching company

perspective and again I think that's why

govern was was created

frankly side by side look so maybe this

is a 30,000 foot view of 1.1 and 2.0 um

you can see there were a number of

changes but but the overall number of

categories and subcategories actually

decreased so we went from five functions

in one one to six functions with the

addition of governments in 20 but then

we decreased the categories and the

subcategories the reason for this was

there was a lot of consolid ation

between some of the controls within

identify protect detect respond and

recover and they were Consolidated into

some of these additional controls uh

within govern and then more further

Consolidated within the uh the

pre-existing five controls that we saw

as we get a little bit more granular

into what these changes are this is a

very chaotic slide it made my eyes bleed

as I was making it but but this is what

it looks like so when you think about

the controls themselves here's what kind

of changed or was Consolidated or what

is brand new so we see a bunch of those

different controls certainly in govern

all brand new obviously but then we saw

some things drop from identify protect

and from respond and from an actual

subcontrol perspective here's what

happened so you're going to see a lot of

arrows starting to populate this slide

but nothing was truly eliminated from

this it just made it more intuitive and

more cohesive and again a lot of things

got moved up into that that overarching

govern uh category which like I said I

think is extremely important for the go

forward plan for anyone trying to adhere

to nist because it gets a lot of

additional Buy in from a company

perspective outside of outside of it

which is where nist was typically you

know landing and and where the

responsibility used to lie I think

that'll that'll be a big change for us

going forward and a welcom one because

at the end of the day when we're talking

about security everyone is part of the

security team um at any company

regardless of size or regardless of

vertical if you're unfamiliar with nist

this these are kind of what the controls

from an overarching perspective are

meant to do so identify is is supposed

to help you determine the current cyber

security risk to the organization it's

not actually about identifying an

inflate threat if you will it's about

identifying what within your environment

potentially has gaps has risks could

create some level of an impact to your

business should you experience an

incident of event a breach you know

whatever you want to call it but that's

really what identify targets protect is

what should you and could you be using

within your environment to safeguard

yourselves and really lessen the

likelihood that you'll experience an

incident in the first place so that's

what protect is all about what controls

policies products platforms uh vendors

Etc are you leveraging to preemptively

protect yourself and make it more

difficult for your environment to get

breached or infiltrated in the first

place detect is probably the most

self-explanatory one what do you have

within your environment that is

assisting you in detecting if something

wrong is going on within your

environment this is very very

multifaceted as you guys might imagine

nist refers to a lot of different things

within a within a corporate it

environment or or any environment for

example um but but what are you using to

detect it um you know we'll talk more

about what that looks like uh what a

holistic approach looks like versus what

kind of a point product approach looks

like those types of things um and then

responding so are you how are you taking

action once you do find a thing so if

something happens what is your plan do

you have a plan and planning is

something that is now very much

emphasized in 2.0 that's something that

we at arctic wolf and Winslow have been

talking about for quite sometime you

know if you don't have an IR plan it's

something you should seriously consider

implementing and there's different

processes in which an IR plan is either

good or bad so of course we want to

highlight the good but now it's in this

now it's really really talking about

having something tangible that you can

refer to that helps you and your company

kind of stop the scramble on what is

arguably the the worst day in your life

if you do experience some kind of a

catastrophic event um recover once again

moderately self-explanatory but but

quite convoluted there's a lot of things

that go into actual recovery of an

incident depending on what the impact

was you know was it stolen data was it

ransomware did it lock up your backups

which is you know a goal of a lot of

different actors to lock your backups

because once your backups are gone they

pretty much have you so what does it

look like from a recovery perspective

for your business and then finally the

last one the new one is establish and

monitor the organization cyber security

risk management strategy expectations

and policy so once again this is org

wide what do we as a company need to do

to create this cyber security risk

strategy um and a lot of these new

controls Consolidated controls moving up

into govern um we'll we'll talk about

that and we'll we'll emphasize that so

those are the six controls now of 2.0

kind of at a very high level we'll start

jumping into now um what the individual

changes of these controls and subc

controls and categories Etc kind of kind

of mean starting with identify um again

this is meant to help you identify and

determine what your overall risk profile

looks like in the 1.1 uh table that I

have there anything that's kind of

shaded in Gray has been moved um so the

four that you see shaded have been moved

over into Improvement or or moved over

into governance so there's been a lot of

moves and changes this is not a one for

one representation of all the moves and

pivots and changes just kind of a

condensed view for you but um in 2.0 we

do see a new uh new category just called

Improvement um and what Improvement is

really here to do is to help

organizations just drive toward

improvements overall in the

organizational cyber security plan you

know what procedures do we have in place

what do those activities within those

procedures look like you know kind of

helping you create a framework on on

what identify needs to look like so your

identification of your risks within your

environment become more comprehensive

and the more comprehensive knowledge you

have of your gaps and what your risks

are the better an arctic wolf and a

Winslow can help you address those you

know with with various Solutions like

arctic wolf and a myriad of other things

of course that go into an overall cyber

security

play so that's what we saw at least in

uh in identify but but but moving even

further into the Improvement category

there are four subcategories now within

Improvement um and the first word there

in the im- 01 is continuous right this

is not a oneandone exercise and I

there's no way that I can emphasize that

enough continuously understanding your

environment via you know your own

knowledge and research but also via

continuous monitoring and having someone

there to help identify gaps with you is

the first call out in this new identify

uh excuse me Improvement subcategory and

then it moves further into actually

testing things out right are you uh you

created a plan youve maybe identified

some risks but have you have you tested

have you done exercises do you know your

findings to be true or false um so so

it's calling that out directly here as

well uh Lessons Learned so creating some

kind of a journal log Etc on what you've

learned what procedures work what didn't

work what you need to you know rethink

perhaps um and then finally a cyber

security plan um that's effective that

is communicated maintained and approved

and I think the key word there is

probably communicated right so the

entire organization understands what

should and frankly what should not

happen during some form of of an event

has gone into that Improvement category

so it can all be laid out understood and

you have a A playbook that is ready to

be executed upon you know in the in the

instance that you have have a

problem so that's the bulk of what we

saw from the identity category uh

shifting or changing or being augmented

in some way um which brings us over to

protect so protect had a had a bunch of

changes as well as you might imagine

those three uh shaded and gray there um

have been Consolidated or moved or

tweaked once again into two additional

categories that are new for the protect

in uh NIS 2.0 so we see platform

security and we see technology uh

infrastructure

resilience so starting with platform

security um this is really talking about

Hardware software firmware operating

systems all of the things that make up

your environment um physical virtual

machines are managed consistently that

we understand how they're being managed

that there's a risk strategy again

encompassing them um to protect their

integrity their availability and of

course their confidentiality and then we

can see some of the new controls uh that

are that are provided into into those

subcategories we have some around

configuration management software being

maintained um again arctic wolf sees a

lot of these things and patching is is a

total pain for anyone dealing with

patching we understand that we can help

with that but I'm glad it's being called

out uh in in the way that it is now

Hardware certainly maintenance um we see

cves pretty much constantly for for

firewalls for example so staying on top

of those types of things um certainly

lowers your overall risk profile log

records are generated and made available

for continuous monitoring this is a big

one this is referring to 247 login event

monitoring um something that arctic wolf

plus Winslow are very very good at

providing and something that I still do

not see being done anywhere near enough

in the wild um so I'm again once again

I'm glad that this is called out as

specifically as it is within the protect

function um installation and execution

of unauthorized software are prevented

I'm guilty of this quite frankly I've

installed a thing or two on my work

machine once or twice um but this is

something that you know again I

shouldn't be doing nor nor do I these

days but um you know this is something

that mist certainly calls out as well

because if something gets installed and

for for example they installed an

application that included one of the

vulnerable log forj jres a year and a

half two years ago that could have

exploited an entire company uh if it was

done so on a business machine um and

then finally securing software

deployment practices so so how are you

guys pushing XYZ to your clients what's

the update cycle look like change

Windows all those types of things uh

making sure that those get

monitored moving over one more into the

technology infrastructure resilience

subcategory um this is all about

security Arch architectures are

maintained and managed with the

organization's risk strategy to protect

asset confidentiality Integrity

availability and organizational

resilience and we can see four different

changes here um Network and environments

are protected from uh unauthorized

logical access organizations's

technology assets are protected from

environmental threats uh mechanisms are

implemented to achieve resilience uh in

normal and adverse conditions and

adequate resource capacity to ensure

availability is maintained so as you're

kind of thinking through these you know

active passive type Technologies active

active even all of these types of

decisions and Frameworks can kind of

work into into these four new controls

that they've bundled under this

technology infrastructure resilience

header um which was further

consolidation most of these all existed

in some former fashion in one one um

they're just called out a little bit

differently you can see some of the

references to formally you know XYZ in

that Top Line um so you can see where

the pivots were made uh and where they

were kind of bundled if you will will

into this new technology infrastructure

resilience

subcategory finally or not finally

detect so detect is all about again

finding and analyzing cyber attacks so

we see detection processes being kind of

moved if you will and again re rebundle

into continuous monitoring and into

adverse event analysis I am personally

pretty excited about this because that

directly ties into quite frankly what

arctic wolf is and what arctic wolf does

so um our core construct if you will and

how we kind of came to Market 10 years

ago was the idea of manage detection and

response which focuses on continuous

monitoring and adverse event analysis um

I won't get too much into this slide

guys I don't want to make this a sales

pitch but just know that arctic wolf is

a managed security operations center

that is delivered as a service one of

the services that we offer is MDR and

MDR is quite frankly 247 log ingestion

from across your entire environment

integrating with a lot of different

third party productss you may already

own like crowd strike or Defender ATP

opad Duo o365 all that stuff combining

it with Telemetry that we're generating

our own via a physical sensor that's

deployed on your network and Via an

agent that is also deployed on all of

your endpoints Cloud desktop laptop or

server aggregated under a single

umbrella acting as a single source of

Truth and then looking through all of

the events that were uh receiving from

your environment looking for anomalies

indicators of compromise things that are

flagged by third party Integrations that

we have and then responding to them so

here's what we found here's what it

impacted within your environment here's

how we get rid of it let's go um so

again if I go back one slide and and

look at continuous monitoring and

adverse event analysis that is exactly

what arctic wolf does so we're excited

to see this called out in the way that

it is called out in 2.0 because the more

customers clients that are using Arctic

wol or frankly anything else that are

monitoring and you know actually

reacting to diverse events in a correct

and and quick way the less we're going

to see from a cyber losses perspective

and there's anary benefits to that too

right like your cyber insurance premiums

maybe doubling over the last 24 months

no one's really been a huge fan of that

maybe we'll start to see that Whittle

down you know as these cyber insurance

companies hopefully you know start

paying out less because we're getting

more in tune with what needs to be done

to properly secure

environments respond how am I taking in

action during a cyber incident obviously

arctic wolf can assist in that the the r

and MDR does stand for respond but we

saw some changes here as well response

planning and improvements as you might

imagine those have been uh pivoted again

or or moved over into more of the

governance subcategory which we'll talk

about in depth in a couple minutes um

but we've created the four categories

now within response we have Incident

Management analysis response reporting

and communication and mitigation and to

kind of you know expand on that a little

bit more you can see where some of these

moves were made um a few of them were

dropped as I had mentioned but they have

been moved into other subcategories uh

we have a couple different new ones four

of them um so analysis is performed to

determine what is taken during place of

an incident finding the root cause of an

incident oftentimes is critical to

understand what gaps you have and how to

fill those gaps um what actions

performed incident data and metadata

being collected again something that

that arctic wolf can certainly assist

with as well um and then lastly the

incident magnitude and is estimated and

validated so you know what did this cost

your company and again that's a

convoluted question too and I think

oftentimes when we think of the cost of

a breach let's say it's an average of $3

million we just think of that $3 million

as ransomware but you know the

ransomware portion if it was indeed

ransomware is is typically a a small

percentage of that overall loss because

you have operational loss you have you

know loss of of man and woman hours

going into whatever the solve for the

situation happened to be and then much

harder to quantify but you have

reputational loss um depending on how

you interface with your customers as

well whether that's B2B or whether

that's B to C there's a lot of

reputational loss that comes along with

that and that can linger for months or

years um depending on on what

happened recover so this is focusing on

restoring assets and operations the

picture there you're probably reading

that and hold my beer um one of my

favorite sayings but that is basically

saying that a lot of what they have

included now in 2.0 under the new

incident recovery plan execution and

communication really are telling you to

kind of just hold your breath for a

minute analyze the situation understand

exactly what happened and then truly

create a plan around your recovery

rather than just going you know bowling

a china shop trying to fix stuff and

scrambling and not documenting and

forgetting what got fixed and what

didn't get fixed you know stop Slow Down

plan and understanding exactly what it

is that you need to do versus again just

going crazy and trying to to scramble

and fix things which again you know from

an Arctic World perspective and I'm sure

Matt can validate this too on a Winslow

side the scramble is something that's

very very hard to stop because when you

have an incident that's of a magnitude

in which you need to respond rapidly and

quickly you've got your entire Team all

just doing something scrambling without

a lot of communication and again if you

read through the recover sections of

this uh which is kind right here that's

really where the focus is um slow down

take appropriate actions um have have

this organized and and kind of ready to

go and

understood um again I won't read through

every single one of these things but and

you guys are free to have this uh slide

deck as well at the end of this but um

that's really what the recover decided

to focus on I think a lot of the

controls that were already there were

good ones a lot goes into recovery

certainly um but I think having a focus

on making sure that it's well

orchestrated um and well understood SL

doent

is a is a welcome change to T yeah Todd

if you want me just to add some color to

that so we we do have uh an incident

response practice as uh as does Arctic

Wolf and oftentimes we've responded to

incidents together um I'll say um what

tends to happen uh for folks that don't

have a plan is uh twofold one is this

just overwhelming sense of oh crap what

do we do and you know we we have our own

runbook as as does Arctic Wolf we often

work together on um on the incident

response but but this overwhelming sense

of like what do we do now usually

followed you know was followed by like

panic and people start unplugging you

know Network ports and shutting this

down and it's actually um it can really

complicate like forensic investigation

because like ultimately you want to know

how they got in who got in what's going

on do we need to report this to the

authorities So like um in the absence of

a plan uh for Recovery uh we end up

seeing uh just Panic uh you know and and

uh you're right it's like slow down have

a bit of a plan together understanding

you know what's going on I'll tell you

the next piece of this that um you know

that's more of the it CIS admin

technical side if you will the more like

executive board side of this is um you

know our systems are down uh we're

paying people they can't work we're not

bringing Revenue in our you know systems

are offline how soon are we going to be

back online that is like the number one

question that you know comes up and and

just kind of like in our combined

experience just to be realistic with

everyone on the phone I would say an

average um when we get brought into an

incident and this is just again like

averaging everything out um the time

from you know phone call till some basic

restoration has happened just just in

our experience is about three days um so

that's like three days of downtime where

uh you don't really know what's going on

to have some semblance of a restoration

plan you know of course in in the

absence of having having something

planned up front and then um from there

uh we see actual restoration when when

it's not really planned out and um you

know we're just kind of figuring it out

as we go because because this part um

wasn't really thought of um Beyond kind

of like we'll recover from backup um it

usually takes two to three months uh to

recover systems and and in that time um

we've unfortunately experienced some

organizations where they start

questioning like the viability of their

business not because they were um only

attacked but because um their recovery

mechanisms and the recovery planning and

and what needs to happen to recover

their applications data and and overall

um operational State just wasn't really

thought about so um to your point to I I

actually love seeing more attention

being spent on this end of the framework

um and um and I I feel like with you

know cyber risk and and cyber security

incidence it's it's you know this is

like very cliche it's it's not a matter

of uh if it it will be a matter of when

um attackers using AI based you know

malware and AI based um attacks are are

real it's something that technical

controls may not be able to keep up with

uh hopefully they minimize the risk and

minimize the impact of of an incident um

but everyone's going to be faced with

recovery at some point so so like really

putting some emphasis in planning and

having the right policies and procedures

in place is uh is really really critical

and um I like seeing this being uh

spiked out a bit more um in the 2.0

framework yeah those are perfect points

I mean just if you read a couple of the

1. ons they they almost seem rudimentary

compared to how 2.0 gets a little bit

more you know finite on what the ask is

um you know if you look at the kind of

the backup um it's it's interesting

right that it wasn't included to to

begin with but um you know establishing

and understanding that the backups

you're restoring are actually good

Integrity right because in storing you

know re restoring a dirty backup just

wasted a day

D I'll tell you like Todd that is such a

good example because I've like

personally been on incidents where we've

restored um you know applications I'll

just say at a broad level they had

already been tampered with and they had

um some sort of a trip wire I'll say

built into it where um if you went back

as far as you know two weeks or three

weeks or whatever to restore it they had

already been in the environment that

long and in that case it it wasn't just

like the backup system that was flawed

it was like the Integrity of that system

and you know alongside that the backup

itself was totally compromised because

if you restored um if you restored that

backup itself it was tampered with um

and you know would essentially like

reinfect the rest of the environment

once it was restored so um I I agree I

think youed like the perfect word here

too where you're talking about like the

1. one seems rudimentary and like it is

I mean you look at it and it's like

we're looking at like big you know

crayons that we're drawing with with

like a

fist right versus uh perhaps the the

Precision of a of like a number two

pencil here so I think that's a great

great Point yep absolutely I think it's

gonna help a lot just for for everyone

trying to adhere to Nest I think

everyone should at least if you're going

to pick any framework if you don't have

you know a specific form of compliance

you're mandated to do it here to this is

a this is a great place to start and

honestly if you do start with nest and

then maybe via some pivot companywide

you are now privy to some form of

compliance you must adhere to if you're

doing this you've probably satisfied 70

80 90% sometime of the controls that

that other compliance refers to um so

I'm glad it's laid out the way it's laid

out now

yeah we'll jump into govern which is the

last one kind of the new kid uh and

again you know the one that I think

myself and and I'm I'm understanding

Matt is probably the most excited about

because it does specifically speak to

organization

awareness of an overall security

framework so um a bunch of new controls

here there's six subcategories within

the Govern section um again I won't read

every single one of these uh but I

certainly encourage you to do so but

we're talking about organizational

context uh an overarching risk

management strateg strategy I talked

earlier about the supply chain risk

management and this is a big deal right

if you are doing business again B2B and

you have systems that are being accessed

by whomever you're interfacing with they

become compromised you now have or at

risk at least of being compromised as a

relation of that uh you know perhaps

database that you're sharing or that

interface that you're sharing or

whatever happens to be so understanding

your risk around your supply chain is

something that's pretty critical um

roles responsibilities and authorities

again like I said this is going to bleed

outside of it in a very very welcomed

way where the rest of your organization

um should and could be a part of your

overarching security plan gaining

awareness for those of us in the it

realm um gaining Buy in uh and and

hopefully you know having a little bit

more um versatility in what you're able

to talk about present and and you know

try to fix your gaps with um so I think

this is a very good thing uh policies

processes procedures Etc um those are

kind of table Stakes but again they've

been moved into that govern category so

it becomes like I said earlier more of

an overarching idea and then oversight

you know who's who's the one ultimately

paying attention responsible for

uh validating Etc all of these different

strategies um that we that we putting in

place via the

n2.0 so to get a little bit more into it

just kind of kind of some questions to

you know ask yourself this is really

what govern is is getting you to do is

kind of create that conversation within

your organization around you know why do

we exist and what are we trying to

accomplish some of these are are kind of

no-brainers but you know what are our

internal and external stakeholders and

what are their needs and expectations um

you know if you're a if if you're a CFO

perhaps you know maybe it isn't

something that you're necessarily diving

into at a granular level certainly

you're approving projects but um maybe

this will give you a lot more Awareness

on you know what what nist is and why

cyber secur is important in the first

place um objectives capabilities you

know that your stakeholders depend on um

does Enterprise risk management include

cyber security is that actually a

control or a thought process within your

risk management plan overall

um what's your appetite for risk and

your tolerance for risk this is a super

interesting question that I get to ask

prospects every now and then when I'm

talking to them and the answers that you

get just very wildly um and some of them

are funny some of them are depressing

but but overall it's a very very

different story from whomever you're

talking to on what their their tolerance

for risk is um have you standardized on

methods for for calculating for

documenting for prioritizing your risks

again are these something that you are

paying attention to on a daily basis and

from my experience over the last four

years I can wholeheartedly answer the

majority of people I talk to the answer

is no um because I'll be in engagements

for you know a month long two month long

three Monon long conversation with a

prospect um and during that duration of

conversations with arctic wolf or maybe

they were budget constrained or they had

never been breached before so they

haven't felt the pain of of being

breached uh historically speaking and

then they get popped in the middle of

our conversations we're engaging you

know with Winslow we're deploying IR

we're doing all these things um and it

it becomes a question of you know had we

just gotten this done this would have

never happened um and often times the

the remediation tactics and the cost

implications and all of those other

things that come along with having a

breach are are far more expensive than

the solution would have been to prevent

uh The Happening of the of the problem

um and then finally again going back to

supply chain do we understand our

suppliers and partners what their

requirements are um and how do we

address supply chain risk so what I

highlighted at the bottom here is again

kind of the the overall idea this the

Govern function helps organizations

achieve and prioritize outcomes of the

other five functions in the context of

mission and stakeholder expectations um

so like I said earlier I think it's a

really good control I love that they

made it touch everything you know kind

of made this its own Inner Circle

meaning that it has its tendrils into

the other five pre-existing controls um

because governance is something that you

know really should be paid attention to

I think first and foremost to have that

understanding of what each one of these

controls means to the entire business um

not just to those of us in

it quick example we all remember the

solar winds breach um this was uh pretty

dramatic um it's often times been quoted

by the the CEO of Microsoft as being the

most sophisticated breach we have ever

seen um and that's true in some aspects

um but to kind of go through this a

little bit you know this was something

of a supply chain breach to a degree um

we saw this in early 2020 actually late

2020 excuse me that that year just

completely Blends for me um but you know

Implement zero trust and that's

something again that that we can

certainly assist with certain aspects

with Winslow can assist with a lot of

the other aspects um but but do active

audits you know understand what changes

you've been doing in your environment um

Implement Sim and log management those

were recommendations made after this

breach occurred um fine-tune your DLP so

do you even have DLP to fine-tune maybe

that's the first place that you would

need to look but should you have a dop

plan in place you know make sure it's

tuned make sure it's actually doing what

it needs to be doing um and penetration

testing and again this is something that

wissow can assist with test your

environment if you're not testing your

environment and you've put all these

controls in you've done the things you

have a a good environment on paper if

you haven't tested the thing then you

don't know how good it actually is and

not just it you don't know how good you

actually are right how you're responding

to it at a company level who you're

engaging with um all those types of

things need to be tested on a regular

basis and I think penetration testing

tabletops red team purple teams all

those types of things um should be

should be leveraged um as much as you

see fit uh to understand your

environment and what and what it looks

like in a in a actual real world type of

an incident so I said earlier at the

beginning of this slide this was called

oftentimes Again by the CEO of Microsoft

the most sophistic at breach we've ever

seen but kind of the fun fact some of

you probably know this some of you don't

but the server that was initially hacked

by The Bad actors within solar winds the

password was solar winds 123 so while

the breach became sophisticated the

initial compromise was anything but I

mean I'm not going to say that I would

have guessed this but if you're just

using a a password spray application

it's not going to take that long to get

to solar winds 123 um this comes down to

again again the government's part of

what we're talking about within nist

password policies enumeration

complexities reusage all those things

that we all in our minds think are table

Stakes are absolutely not table Stakes

human beings again are the number one

vulnerability that any company has

regardless of vertical size industry

segment anything so simple policies like

this again are things that we can assist

with helping on Winslow can certainly

help assisting on but nist or or any

other frankly Common Sense logic could

also assist on on helping as well Matt

do you have anything to add

yourbody yeah um I I feel like it's you

know it's weird to be um excited if you

will about this but um but I feel like

um I'm personally excited about it just

because of how often uh you know myself

and my team gets involved in incident

response and like I'd like my weekends

and holidays back too you know so um by

having a bit more risk management and

governance on the front and uh it

certainly uh certainly helps uh helps us

all out um one one tip I would uh you

know implore folks attending the webinar

is like um it is very difficult to do uh

governance you know risk and compliance

management out of excel um so while you

can download this framework and other

Frameworks out of you know Excel and and

work from there um it's a real

rudimentary way to do it it is very

difficult to um co-contribute track

changes and and do things of that nature

so I would uh I would implore people to

consider like a GRC tool um you know and

and some you know services to help

people understand and digest that um we

we offer one candidly um but there are

other uh GRC tools out there too so that

that would be part one um I think part

two is um it's interesting to see this

unfold because um I believe it's was out

of necessity uh that we had to or that

we got where we are right um attackers

were smarter well know about smarter but

we're more motivated I'll say you know

financially to take organizations down

demand Ransom so on and so forth um your

it your average it CIS admin is trying

to keep the lights on you know deploy

new software for the organization so on

and so forth um it is very difficult for

that you know individual or that team of

individuals to combat the ongoing um you

know threat of incidents and what that

led to was just deploying a bunch of

tools um because we needed to like plug

the plug the holes in the dam if you

will you know uh it's like the you know

european vacation right scene where

Clark grizwalds like plugging the holes

in the dam that kind of thing um so we

had to do that out of necessity and now

um you know we're able to come back and

say hey if if we were to do this right

or wrer um what would we do and it kind

of naturally leads itself to like well

Step One is um it's very difficult to um

manage by exception it's very difficult

to manage by by just saying like well we

got this happened we're going to do this

by reaction right um so what this says

is um let's hit the pause button like

you said earlier take a step back and

really understand what our risk is first

what is our risk of a ransomware attack

what's our risk if uh our Erp system is

offline for a week what's our risk if

our self-funded employee uh health care

benefits system is compromised I don't

know there's a whole bunch of things

like even simple stuff like

um organizations have you know what they

think is a really solid practice but

maybe someone in um Finance or payroll

or whatever you know was running payroll

reports they just innocently store that

payroll report for quote unquote backup

purposes on their laptop or a network

share that wasn't you know sanctioned uh

but it wasn't you know clearly

communicated by policy that we don't

store stuff uh like that that's

considered Pi we don't store that like

locally on our machines and there is no

um software DLP solution to like even

prevent that um which which would be a

step further so um I feel like um this

whole notion of governance and like

managing by policy really sets um a bar

and a framework for all organizations to

be able to have like a common you know

internal to that organization a common

set of um practices you know procedures

um and you know rules really uh to

conduct business and and really keep

that organization or better keep that

organization cyber safe and and and

really um managing risk um versus you

know just plugging holes in the dam if

you will so sorry I didn't mean to you

know steal the old show here but um but

I feel like this is um actually like a

much needed addition to the framework

and um you know Fantastics see kind of

like this development of the framework

and see it um evolve and and morph

overtime as uh as risks and and

organizations evolve as well yeah could

agree more man you're not stealing the

show you're you're adding to it so thank

you very much sure really good points

um so I think last slide for me actually

is going to be the the timeline so again

I had mentioned and Matt had mentioned

this is still technically in draft um

but if you look at this timeline a lot

of work has been done over the last uh

about about 12 months actually um

comments were due November 6 uh which

basically means you know hey we have

some last minute edits some last minute

things we want to see um so that was due

uh you know a couple months ago so we're

right in the middle here where we should

see this finalized I'm probably

extremely close to what we've just shown

you um in the next month or two is when

we expect this to be uh officially

drafted and and two. becomes uh official

and and slash nonraft

um so with that I'm going to Pivot back

over to Matt he's going to talk a little

bit more about what Winslow does from

their nist uh evaluation perspective you

know how that could help you guys going

forward um and then we'll get into Q&A

at the end here so Matt if you want to

take it with

your yeah absolutely so um thank you

Todd so if if folks have never um gone

through any sort of a framework review

or you know pop the hood if you will on

you know nist 1.0 1.1 or even took a

look at 2.0 that's uh that's actually

totally cool like we um at wtg are happy

to offer a no cost um mini nist cyber

security framework assessment if you

will um so it's a consultative interview

um we ask a bunch of questions around

each um family or function um of the

framework it's a great time for you to

be able to ask any questions that you

have um related to the framework related

to something going on in your

environment or just general security

with the uh with the security engineer

you have um on on the call uh at the end

of it you'll get a you know full report

with red green yellow uh different color

coding you'll have all of your responses

all the questions we asked um and so on

and so forth and we you know we're happy

to provide this at at no cost for folks

too so um if you're if you're interested

um in that um there's like a webinars at

Winslow TG um email address that that

you'll see like on the next slide and

we're more than happy to uh to do one of

these evaluations for

you perfect thanks Matt and I think uh I

think that was it thank you slide here

we go we got 10 minutes for questions I

think we nailed the timing

man so I don't know if anything came in

for questions I can't personally

see chat

but

here we

go so the question was and I don't know

if this if you guys can see this but

I'll just read it uh per the December

release of the proposed cmmc rule is

Arctic Wolf obtaining level two

certification and meeting fed ramp oops

now it's sliding on me sorry and meeting

fed ramp moderate or High Cloud security

as an ESP um I'll start with the cmmc um

yes we are Marching toward that and if

uh you read our current uh cmmc report

which was previous to the to the last

rev the December release um we're

satisfying uh the vast majority of

controls that are in cmmc level two or

helping complement uh other controls

that are in cmmc level two because if

you're familiar with cmmc you know that

certain portions of that are also

referring to things like physical

security and stuff that arctic wolf

would have no involvement in whatsoever

um so the answer would be yes uh we do

help complement satisfy uh a a vast

majority of CMM cl2 uh the next part of

this question was fed ramp fed ramp's an

interesting one I could spend a lot of

time answering this I'll answer it

somewhat generically arctic wolf has

five almost six socks distributed

globally um and the way that we handle

North American based customers is

exactly that North American meaning we

have three socks in the United States

and one sock in Canada presently if you

are a United states-based customer a you

only communicate with North

american-based arctic wolf employees and

your data locality is 100% United States

based can never Traverse to any other

country any other sock Etc we also never

ingest pii and if we do accidentally

ingest pii we have controls in place to

immediately delete expunge with zero

retention or recovery ability ities that

pii jumping back over to fedramp what

fedramp says is that you cannot have

non-us citizens looking at pii so now we

jump into gray area Canadian citizens

can see your logging information being

ingested from Arctic Wolf if you are an

American customer but it's not pii so

that said the decision now becomes your

decision frankly you know is non-pii

being viewed by Canadian citizens uh

acceptable because fed ramp doesn't

truly stipulate this itar doesn't truly

stipulate this again it is gray area I

do have customers that are fed ramp that

are itar we are GCC High certified so we

can play in that space very very easily

um and frictionlessly if you will um

sorry I know that wasn't actually a

short answer but that is the answer

presently currently we are working on

controls where the Canadian sock

Canadian if you will um can be segmented

out completely from those customers that

are fed ramp or itar that don't want to

play in a gray area uh and that would be

coming soon we do expect that sometime

hopefully in in fiscal

24 Let's see we did have another

one was that the only question another

question does nist framework overlap

well for companies looking to achieve

sock

to yeah and and Matt you know kind of

backed me up a little bit but I said

earlier if you're going to pick a

framework and you don't have to adhere

to one by mandate pick nist because what

nist is really preparing you for is

almost any other form of compliance now

is NIS 2.0 if you fully adhere to it

going to certify you for sock 2 no sock

2 has a lot of additional controls from

a confidentiality perspective from a

governance perspective from all these

other things and of course arctic wolf

is sock 2 type 2 um but nist will

absolutely set you up give you a huge

Head Start to Sock to cmmc to Hippa to a

lot of other things um Matt I don't know

if you want to expand on that at all

yeah I I would agree with that I um I

feel like there is overlap like the NIS

CSF whether it's 1.1 or 2.0 um certainly

um overlap or complement a sock 2 uh you

know program um the difference with sock

2 is it's it's much more geared towards

um service providers so there are

service provider specific um areas for

um sock 2 so uh it does overlap and

complement in a in a very good way uh

for organizations you know looking to

achieve sock 2 sock 2 does have um a bit

more service provider type um you know

you know controls or or functions in it

though um that that need to be

considered okay okay cool um we are on

the top of the hour Todd you did an

awesome job thank you very much for this

um very uh very informative um

interesting uh you know well presented

as usual so thank you Todd really I

really appreciate that and also really

appreciate arctic wolf for um you know

you know spending time and and um

allowing you to speak with us today

really um really appreciate that and the

the partnership we have with them um uh

no uh no no further questions so with

that um I'll just say thank you very

much everyone for uh for attending today

um if you have any questions related to

um n csf20 we're glad to answer that if

you are interested in um how we're

helping customers with with risk

management um one of our webinars from

last fall uh Winslow webinar actually

was around risk management so I'd

emplore you to take a look at that um

also in the um like upcoming uh

presentation and if you're um actually

an existing customer of Winslow um you

would have received the Winslow wire um

which actually talks about risk pilot

and our risk management platform which

includes a GC tool um so um if if

governance and your um you know journey

to uh nist 2.0 includes a GRC tool and

and you're interested in the governance

component um we're we're more than happy

and uh certainly capable to uh to help

you with that so thank you very much for

attending Todd thank you very much again

uh for yourself and thank you arctic

wolf for uh for participating in this

hope everyone has a really uh really

great day and we'll catch you next

time thanks everybody