If you didn't find what you were looking for, try a new search!
I was stunned to learn that Aerojet, a division of Rocketdyne, set legal precedent three weeks ago in the Federal District Court for the Eastern District of California. The heart of the matter is an allegation that Aerojet made false [...]
DFARS 252.204-7012 requires that, as a DoD contractor, your organization and your subcontractors must obtain certification of compliance. The deadline has now passed to meet DFARS compliance rules that put cybersecurity safeguards on what the U.S. government calls 'controlled unclassified [...]
Oli Thordarson, CEO of Alvaka Networks Alvaka Networks has a series of pages on various IT compliance regulations for sectors like HIPAA, PCI, DFARS and more. Many of these pages have web forms visitors can fill in for more information, [...]
DFARS 252.204-7012 Compliance & Remediation Services. Alvaka DFARS 252.204-7012 Compliance & Remediation Services deliver comprehensive DFARS readiness assessments, compliance remediation consulting and certification support. Learn how we can help you become DFARS compliant. [...]
December 31, 2017 is an important date for many in the DoD world. For those with contracts subject to DFARS 252.204-7012 it might feel like an overwhelming and impending date. I am sure this is another heavy responsibility thrown onto your plate with the expectation you get it done.
Kevin McDonald has just published his latest article of DFARS (Defense Federal Acquisition Regulations Supplement) at SearchCompliance.TechTarget.com. If you fall into this category, a recently implemented rule from the Department of Defense called the Defense Federal Acquisition Regulation Supplement (DFARS) [...]
Los Angeles, CA - Tonight I am reviewing our new DFARS Pre-Assessment Questionnaire that has just been updated for 2017. It is a very compact 30 questions in a four page document. It of course is not a full DFARS assessment, but it is step one of your process you must do before anything else on your DFARS compliance journey.
DFARS is the Defense Federal Acquisition Regulation Supplement. It is a supplement to the FAR that provides DoD-specific acquisition regulations that DoD government acquisition officials – and those contractors doing business with DoD – must follow in the procurement process for goods and services.
If you are an aerospace company, Department of Defense contractor or another type of organization that falls under....
Lawmakers on the Senate Armed Forces Committee claim that the Department of Defense is not taking strong enough action against defense contractors in regards to protecting Controlled Unclassified Information (CUI), which is putting all of that data at risk. Given [...]
NIST 800-171 Compliance Services. Alvaka peforms DFARS readiness assessments to provide for NIST 800-171 compliance by assessing your company's systems to determine if the correct procedures and methodology are in place to meet the DoD's requirements [...]
If you are a subcontractor to a prime defense contractor like Lockheed Martin, Northrop Grumman, Raytheon, Boeing, General Dynamics and others, you need to know about FIPS 199 and why doing a FIPS impact assessment is important to your DFARS [...]
Smoke testing is a term used to describe the testing process for servers after patches are applied. The process typically involves making sure servers are rebooted in the right order, making sure they have completely rebooted, restarting applications in the right order, and then testing to be certain everything is working properly when users return to work in the morning.
This typically takes 30 minutes per server, depending upon your environment.
PCs are not typically smoke tested, or if so, not all of them.
Estimating an average time for patching servers and PCs can be a bit tricky. It can vary from one month to the next, depending upon the number and complexity of the patches released by your software vendors. You must consider all versions of operating systems and have a complete inventory of all your application software to do this job correctly. Our experience has shown that manual patching of systems takes on average of about 1.5 hours each.
There are many variables to consider. Some are:
You want to enter in a fully burdened labor rate for this field. What that means is that you want to take the base hourly rate, plus 25-30% for employer payroll taxes, benefits, vacation/holiday time, etc.
For example, someone making $80,000 per year will typically work 52 weeks of 40 hours, or 2080 hours. $80,000 divided by 2080 is $38.46/hour. Multiply that hourly rate by 1.3, and you get $50.00/hour. Of course, rates of pay, taxes and benefits will vary from city, state and company; but 30% is usually a good number to use. Don’t forget to account for time-and-a-half or after-hours rates of pay if patching is being done in the late evening, early morning, or weekends (in order to avoid impacting user productivity).
This is a basic cost calculator for you to compute your typical monthly cost for patching your servers, PCs, laptops, tablets and associated application software. It also forms the basis for you to begin calculating your Return on Investment for software patching, or for comparison with alternatives to the manual process of patching operating systems and application software—such as Patch Management as a Service, also known as Vulnerability Management as a Service.
If you are presenting to management for a budget, and using this calculator as the basis for a Return on Investment (ROI), you will need to do more homework. An ROI measures as a ratio of the cost of investment against its expected benefit. For patching, calculating benefit can be very difficult to determine. How do you measure the cost of a system breach you have not yet had? You can estimate what expenses, penalties, and losses a company might incur when a breach occurs; but there is no certainty of a breach event and what those costs actually are. There are also regulatory compliance issues and/or potential fines for not patching, but those, too, can be vague. For calculating these potential risks and costs, it is advisable to enter into a discussion with your management team.
