DefenseLogix Blog https://www.defenselogix.com/blog/ Articles on security leadership, audit readiness, email security, CMMC, and AI governance. en-us Wed, 23 Sep 2026 12:00:00 +0000 The Morgan Stanley Leak Wasn't a Hack. That's the Problem. https://www.defenselogix.com/blog/morgan-stanley-email-leak-dlp/ https://www.defenselogix.com/blog/morgan-stanley-email-leak-dlp/ Wed, 23 Sep 2026 12:00:00 +0000 Data Protection An accidental email containing a live deal pipeline shows why access control alone is not enough, and why classification, DLP, encryption and endpoint controls have to work together. CMMC Level 2 readiness after the Phase 2 suspension. https://www.defenselogix.com/blog/cmmc-level-2-after-phase-2-suspension/ https://www.defenselogix.com/blog/cmmc-level-2-after-phase-2-suspension/ Tue, 22 Sep 2026 12:00:00 +0000 CMMC The Department of War suspended CMMC Phase 2 on July 13, 2026, but Level 2 self-assessment and NIST SP 800-171 obligations remain in force. Five readiness gaps affect whether a contractor's affirmation will hold up. MANAGE: Where AI Risk Management Earns Its Keep https://www.defenselogix.com/blog/nist-ai-rmf-manage-function/ https://www.defenselogix.com/blog/nist-ai-rmf-manage-function/ Tue, 01 Sep 2026 12:00:00 +0000 AI Risk Management The MANAGE function of the NIST AI RMF explained: risk prioritization, deployment gates, AI incident response, vendor monitoring, and decommissioning. MEASURE: Working Is Not the Same as Trustworthy https://www.defenselogix.com/blog/nist-ai-rmf-measure-function/ https://www.defenselogix.com/blog/nist-ai-rmf-measure-function/ Tue, 18 Aug 2026 12:00:00 +0000 AI Risk Management The MEASURE function of the NIST AI RMF explained: TEVV, bias and fairness testing, adversarial evaluation, drift monitoring, and documenting tradeoffs. MAP: Why Many AI Failures Are Context Failures https://www.defenselogix.com/blog/nist-ai-rmf-map-function/ https://www.defenselogix.com/blog/nist-ai-rmf-map-function/ Tue, 04 Aug 2026 12:00:00 +0000 AI Risk Management The MAP function of the NIST AI RMF explained: intended use, AI system documentation, stakeholder impact analysis, and risk identification, including generative AI risks. GOVERN: The AI RMF Function That Decides Whether the Other Three Matter https://www.defenselogix.com/blog/nist-ai-rmf-govern-function/ https://www.defenselogix.com/blog/nist-ai-rmf-govern-function/ Tue, 21 Jul 2026 12:00:00 +0000 AI Risk Management The GOVERN function of the NIST AI RMF explained: accountability, AI policy, risk tolerance, AI inventories, and third-party oversight, and the gap between paper and practice. What Is the NIST AI Risk Management Framework? A Plain-English Field Guide https://www.defenselogix.com/blog/what-is-nist-ai-rmf/ https://www.defenselogix.com/blog/what-is-nist-ai-rmf/ Tue, 07 Jul 2026 12:00:00 +0000 AI Risk Management The NIST AI Risk Management Framework (AI RMF 1.0) explained: the four functions, the seven trustworthy AI characteristics, and how to start using it. Moving to DMARC enforcement without disrupting legitimate email. https://www.defenselogix.com/blog/dmarc-enforcement/ https://www.defenselogix.com/blog/dmarc-enforcement/ Tue, 30 Jun 2026 12:00:00 +0000 Email Security Many organizations publish a DMARC record at p=none and never advance it. A sequenced approach, grounded in aggregate reports and sender alignment, allows a domain to reach enforcement with controlled risk. AI governance for regulated organizations: inventory, tiering, and oversight. https://www.defenselogix.com/blog/ai-governance-regulated-organizations/ https://www.defenselogix.com/blog/ai-governance-regulated-organizations/ Tue, 19 May 2026 12:00:00 +0000 AI Risk Management An acceptable use policy alone does not establish AI governance. Regulated organizations need an AI system inventory, a risk-tiering rule, and an approval process aligned with the NIST AI Risk Management Framework. Audit evidence: designing controls that produce their own records. https://www.defenselogix.com/blog/audit-evidence-controls-that-produce-records/ https://www.defenselogix.com/blog/audit-evidence-controls-that-produce-records/ Tue, 24 Mar 2026 12:00:00 +0000 Audit Readiness Audit findings frequently trace to missing operating records rather than weak control design. Building evidence into routine work prepares an organization for SOC 2 Type 2 examinations, HIPAA reviews, and NIST-based assessments. A 90-day plan for a fractional CISO engagement. https://www.defenselogix.com/blog/fractional-ciso-90-day-plan/ https://www.defenselogix.com/blog/fractional-ciso-90-day-plan/ Tue, 10 Feb 2026 12:00:00 +0000 vCISO The first quarter of a fractional CISO engagement should establish accountability, document the organization's obligations, and put core processes into operation. This plan outlines the priorities for each 30-day phase. The NIST AI Risk Management Framework: Safeguarding Your Organization in the Age of Artificial Intelligence https://www.defenselogix.com/blog/securing-the-future-how-nists-ai-risk-management-framework-protects-organizations/ https://www.defenselogix.com/blog/securing-the-future-how-nists-ai-risk-management-framework-protects-organizations/ Wed, 26 Feb 2025 12:00:00 +0000 AI Risk Management AI introduces risks that traditional risk management approaches may not address. The NIST AI Risk Management Framework gives organizations a structured way to identify and mitigate them.