Risk Management

The cybersecurity sector is moving towards Continuous Threat Exposure Management (CTEM), shifting from static vulnerability assessments. This dynamic approach is crucial for government agencies managing industrial control systems and IIoT, incentivizing procurement teams to seek solutions that enhance real-time risk evaluation and prioritization.

The Cybersecurity and Infrastructure Security Agency (CISA) has released new guidance aimed at helping federal civilian agencies securely adopt and manage open-source software (OSS). This guidance highlights the importance of the C4 Framework, which will be critical for assessing the trustworthiness of OSS and ensuring compliance with recent executive orders.

As Germany enforces mandatory cybersecurity training for executives, companies face potential penalties for non-compliance. The NIS-2 directive aims to elevate cybersecurity standards, emphasizing personal liability and risk management for leadership in affected industries.

Several Minnesota municipal water utilities recently reported cyber incidents affecting operational technology, underscoring vulnerabilities in critical infrastructure. This highlights an urgent need for enhanced cybersecurity measures and procurement opportunities for contractors in the sector.

The USDA's Farm Service Agency (FSA) alerts agricultural producers about critical deadlines for disaster assistance programs in August 2026, including the ASCF and SDRP. These programs play a vital role in providing financial stability to producers grappling with rising costs and natural disasters, necessitating prompt engagement with FSA offices.

The Federal Reserve Board's Office of Inspector General has pinpointed critical deficiencies in the insider risk management program. This presents opportunities for contractors specializing in risk management solutions and cybersecurity services as the Board commits to implement recommended improvements by late 2027.

The European Union and South Korea have initiated the enforcement of their AI regulations, creating significant compliance challenges for telecommunications and technology providers. Companies must prepare for heightened scrutiny and penalties associated with non-compliance in their AI deployments.

Government agencies focus on strengthening SAP security within their cybersecurity strategies to prevent data breaches. This increased attention emphasizes the need for procurement teams to seek vendors with specialized knowledge in both cybersecurity and SAP governance compliance, signaling opportunities in the market for such solutions.

The U.S. Army Installation Management Command is hiring a Program Manager for Vendor Threat Mitigation to reduce risks from adversarial commercial support in Africa. This role is crucial for securing military operations and offers a competitive salary for qualified candidates with security clearance.

ESET has reported 11 vulnerabilities in UEFI shim bootloaders signed by Microsoft, allowing attackers to sidestep UEFI Secure Boot. This discovery poses significant risks for government and critical infrastructure, necessitating immediate firmware updates and patching to ensure security. Cybersecurity contractors must prioritize these updates to protect their systems.

Government cybersecurity leaders are assessing the integration of AI for automating vulnerability reports. Although AI could enhance efficiency, there are significant concerns regarding the reliability of its outputs, which may impact decision-making processes at the executive level.

The use of Software Bill of Materials (SBOM) services is becoming a priority for federal agencies like **NIST** and **CISA** as they integrate these tools into their cybersecurity strategies. This trend offers procurement professionals insights into growing federal demand for enhanced software transparency and supply chain risk management capabilities.

CISO Global has automated and expanded its FedRAMP-certified TiGRIS platform to address complex compliance needs of federal clients. The integration of generative AI capabilities positions TiGRIS as a critical tool for contractors looking to enhance compliance operations and reduce risks in line with evolving federal standards.

U.S. critical infrastructure sectors are increasingly vulnerable to cyber-physical threats, necessitating procurement of advanced cybersecurity solutions. Contractors specializing in operational technology modernization are uniquely positioned to assist agencies in mitigating these risks.

Government and industry procurement professionals must adapt to new security questionnaire demands. Shifting focus beyond SOC 2 assessments, organizations are urged to integrate comprehensive security controls, ensuring better vendor risk evaluation and compliance verification.

Governor Kevin Stitt of Oklahoma expressed strong concerns regarding a proposed multimillion-dollar settlement related to a long-standing lawsuit against poultry producers. The settlement, if approved, may lead to regulatory uncertainties impacting family-run farms and the agricultural sector in the state.

Three ex-negotiators from DigitalMint and Sygnia received four-year prison sentences for their involvement in ransom schemes affecting major U.S. organizations. This event exposes insider threat vulnerabilities in cybersecurity contracts, prompting a reevaluation of vendor selection and oversight strategies across the sector.

Vanta has achieved FedRAMP 20x Class C certification for its Government Cloud platform, improving access for federal agencies. The certification supports IT modernization efforts and enhances compliance for contractors and resellers focused on cybersecurity and risk management.

The National Institute of Standards and Technology (NIST) released Special Publication 800-18 Revision 2, providing updated guidance on developing crucial system security and cybersecurity supply chain risk management plans. This revision emphasizes automated, machine-readable formats, offering significant procurement implications for federal agencies and contractors in aligning practices with federal standards.

The Intelligence Advanced Research Projects Activity (IARPA) has rejected a proposal from a small business and university due to significant risks associated with technical execution and scheduling. This decision underscores the importance for contractors to emphasize risk management strategies in their submissions to align with IARPA's demanding evaluation framework.

FedRAMP 20x is shifting federal cybersecurity compliance from point-in-time audits to continuous, automated monitoring. This transition is crucial for contractors in governance, risk, and compliance engineering, granting new avenues for providing advanced compliance technologies.

The Cybersecurity and Infrastructure Security Agency (CISA) is evolving its approach to federal cybersecurity by implementing an integrated defense system. This shift emphasizes the need for contractors with capabilities in cybersecurity integration and compliance, opening new procurement opportunities.

Recent findings reveal a significant vulnerability in the libssh2 SSH library, impacting many government systems and IoT devices. Agencies must expedite patch implementation and assess vendor capabilities to mitigate security risks associated with this flaw.

Security threats in supply chains from Africa to Southeast Asia disrupt operations and increase costs. Procurement professionals are urged to enhance visibility and build coalitions to address vulnerabilities and ensure continuity.

The UK has imposed sanctions on HTX due to its facilitation of Russian sanction evasion. This move necessitates increased scrutiny and adaptation within procurement strategies for blockchain and crypto service vendors.

The government is closely examining vendor adherence to **ISO 27001:2022**, specifically focusing on **Control 8.29**. This mandate requires comprehensive risk-based security testing integrated into the software development lifecycle, influencing procurement strategies and vendor selection in government contracts.

iKargos has launched a cutting-edge trade risk management platform aimed at mitigating supply chain vulnerabilities linked to geopolitical risks and regulatory compliance. This solution will support government contractors and procurement teams in ensuring supply chain resilience while complying with OFAC and BIS regulations, amidst increasing enforcement of sanctions.

The National Institute of Standards and Technology (NIST) has awarded Tharros a task order under its $125 million CAPSS contract. This contract enhances federal capabilities in cybersecurity by developing educational resources and automating tools aligned with Cybersecurity Framework 2.0, indicating strong demand for innovative cybersecurity solutions from contractors.

The USDA's Farm Service Agency is granting landowners the chance to increase base acres from June 1 to August 31, 2026. This initiative is significant for procurement professionals as it may drive demand for agricultural services and enhance risk management support for farmers.

CISA has rolled out an enhanced nomination process for reporting Known Exploited Vulnerabilities (KEVs), aimed at improving cybersecurity defenses. This initiative will significantly impact procurement by necessitating greater focus on vendors' vulnerability management practices in alignment with federal compliance standards.

The Tasmanian Government is in discussions with 14 sawmilling companies for wood supply contracts from 2027 to 2040. However, pending reforms to the EPBC Act pose risks of compensation liabilities and fiscal challenges if agreements are made before securing clarification on environmental regulations.

Supply chain executives are developing strategies to address disruptions from geopolitical conflicts, such as those in the Strait of Hormuz. Key approaches involve risk assessments, manufacturing flexibility, and partnerships to protect against rising costs and supply shortages.

TeamPCP's release of the SHAI_HULUD malware source code raises alarm bells for procurement professionals. The incident highlights the urgent need for enhanced security measures in CI/CD pipelines and software development environments across government agencies and contractors.

The USDA's Farm Service Agency and the University of Nebraska-Lincoln will host a webinar on January 30, 2025, to educate commodity crop producers about the Agriculture Risk Coverage (ARC) and Price Loss Coverage (PLC) programs. The event aims to enhance understanding and participation, reflecting ongoing federal investment in agricultural revenue risk management.

The global cybersecurity consulting market is expected to reach **$119.1 billion** by **2034**, largely due to increasing regulatory requirements and evolving cyber threats. Federal agencies like **CISA**, **DHS**, and **NIST** will likely intensify procurement of compliance and risk management consulting services, opening significant avenues for leading contractors in the field.

The Australian Securities and Investments Commission (ASIC) has urged organizations, including government contractors, to improve their cybersecurity measures due to escalating AI-driven cyber threats. This could indicate increased scrutiny and compliance needs for contractors and market participants, necessitating robust defenses against evolving cyber risks.

The National Institute of Standards and Technology (NIST) has released a draft update to its Positioning, Navigation, and Timing (PNT) cybersecurity profile to align with the revised Cybersecurity Framework 2.0. This revision addresses emerging threats in GPS reliability, AI risks, and supply chain vulnerabilities, urging federal agencies and contractors to adapt their cybersecurity measures accordingly.

Failure to secure an Authority to Operate (ATO) threatens government contract continuity and workforce stability. Understanding the risks involved with the Assessment and Authorization (A&A) process is essential for procurement professionals to safeguard their contracts against disruptions.

Government agencies are shifting their cybersecurity focus to include behavioral science, recognizing its importance in mitigating human risks. Procurement professionals are urged to seek solutions that foster a trust-based culture, moving beyond traditional compliance. This strategic change may alter requirements and evaluation criteria in upcoming contracts.

The Cybersecurity and Infrastructure Security Agency has mandated federal agencies to address a critical vulnerability in Ivanti's Endpoint Manager Mobile by May 10, 2026. This requirement underscores the importance of cybersecurity measures and may impact procurement strategies for related technologies.

Cyber insurance providers are raising identity verification standards significantly. Renewals now require detailed metrics, influencing premium costs and underscoring the need for improved cybersecurity practices among government contractors.

The Vulnerability Garden initiative has unveiled a centralized catalog detailing named cybersecurity vulnerabilities, aiding agencies in risk assessments. This resource allows contractors to align their solutions with identified threats, improving acquisition strategies.

The Bleeding Llama attack has compromised a video game platform, exposing vulnerabilities in software supply chains. This incident underscores the urgent need for enhanced cybersecurity measures within government procurement processes and could influence future contract requirements for vendors. Organizations are encouraged to revise their risk assessments and improve their monitoring strategies.

The **Oklahoma County Jail Trust** has finalized a **$7 million** settlement concerning the 2021 death of inmate Brad Leon Lane, with costs being split between insurance and increased property taxes. This decision will significantly influence future procurement strategies within detention center operations, focusing on improved risk management and vendor oversight.

Maryland has terminated its Phase 2 contract with Kiewit for the Francis Scott Key Bridge, citing excessive cost proposals. This creates new opportunities for contractors while reshaping the landscape of the state’s $5 billion infrastructure undertaking, emphasizing the critical need for competitive pricing amid federal-state collaboration.

The NIST's National Cybersecurity Center of Excellence has launched a critical cybersecurity initiative focusing on operational technology (OT). This project aims to address visibility challenges in OT environments, creating significant procurement implications for vendors offering cybersecurity solutions tailored for critical infrastructure.

Cybersecurity firms are adapting their penetration testing sales strategies due to low buyer awareness. Procurement professionals need to shift their timing and approaches, prioritizing educational outreach to increase demand and engagement with potential clients.

The Supreme Court has revived a lawsuit against Fluor Corp. regarding negligent supervision during an Afghanistan incident. This ruling highlights increased legal risks for defense contractors, prompting them to reassess contract terms, risk management strategies, and liability exposure in military operations.

The demand for professionals with Information System Security Officer (ISSO) experience is rising as they transition into critical cybersecurity roles such as governance and compliance management. Agencies and contractors can harness this trend to enhance their security posture and meet compliance requirements through strategic hiring and training initiatives.