Sen. Ron Wyden, D-Ore., chairman of the Senate Finance Committee, on Tuesday wrote a letter to the heads of the Federal Trade Commission and the Office of the Director of National Intelligence highlighting the need for top-level security clearances for FTC officials, specifically those who perform investigations into data privacy and security cases.

Wyden noted in the letter that his office learned that only four FTC personnel have Top Secret/Sensitive Compartmented Information clearance and that the commission has not taken part in classified discussions on cyber threats.

“The FTC should promptly request TS/SCI clearances for its Chair and the other Commissioners, other senior leadership, and some of the staff in the FTC’s Division of Privacy and Identity Protection,” the lawmaker wrote in the letter.

“The DNI should expand its cooperation with the FTC and invite FTC staff to classified briefings. The DNI should also identify for the FTC the kinds of datasets that are being or are likely to be targeted by foreign hackers,” Wyden added.

According to the legislator, China and other foreign governments have been involved in efforts to gain access to personal data of U.S. citizens through legal and illegal approaches and giving the FTC with visibility into security threats could help counter foreign hacking efforts.

In the ever-evolving cyber security landscape, moving to a more secure zero trust system is key for protecting data, according to Keith Nakasone, federal strategist at VMware.

The concept of zero trust is built around the idea that trust cannot be assumed and thus must be continuously verified to ensure the security of critical information.

“To stay ahead of cyberattacks, agencies need to accelerate the adoption of modern technology approaches like zero-trust architecture that enables them to decommission legacy systems,” urged Nakasone.

Following a May 2021 Executive Order, zero trust architecture standards, which include improvements to multi-factor authentication, consistent monitoring of who can access what data, modernizing encryption methods and implementing more thorough data organization and classification must be met by federal civilian executive branch agencies by the end of September 2024.

“Public sector agencies possess troves of information and data that make them prime targets for cybercriminals,” stressed Nakasone. Additionally, he emphasized the impact of cyberattacks on U.S. citizens who rely on many government services, such as social security, passports and emergency management.

Nakasone also commented on the importance of maintaining employee knowledge on policies regarding data security and the use of the DevSecOps model, which embeds security into the lifecycle process of IT and acquisition, to strengthen cloud security.

If you’re interested in learning more about how federal agencies are bolstering their cybersecurity practices, join the Potomac Officers Club for its Cybersecurity in the Modern Intelligence Community Forum on Nov. 16. Register here.

The Cybersecurity Assessor and Instructor Certification Organization, a newly launched unit of the Cyber AB, has launched an official examination to verify assessors’ knowledge of the Department of Defense’s Cybersecurity Maturity Model Certification.

The Certified CMMC Professional examination is aimed at ensuring that certified assessors are qualified and ready to support certified third-party assessment organizations that will evaluate defense contractors’ compliance with the cybersecurity standards, the Cyber AB said Tuesday.

“With the launch of the official CCP exam, we are validating that those individuals who achieve the CCP certification have a standard and consistent working knowledge of CMMC as a whole and how it is implemented in the context of assessments,” said Kyle Gingrich, interim executive director of CAICO.

The organization held a beta exam from August through September to assess how well test items can validate the knowledge a candidate must demonstrate to secure certification.

CAICO was launched in September and functions as an independent legal entity that provides training, professional exams and certification of CMMC instructors and assessors.