Never Just a Business Leader | Dr. Sarbari Gupta

and I'm sure some greater vulnerabilities that are probably still being uncovered to this day and trying to identify some of those weaknesses that may exist must not be a very easy activity, especially across agencies that all do it different ways and they all have different interpretations and different perspectives on what security and cybersecurity means to them.

And I'm curious for a more technical audience, can you give us just a really quick high level or layman's terms explanation as to what the difference is between an RMF ATO and Zero Trust?

Okay.

RMF stands for Risk Management Framework.

So that's a framework that NIST had put together many years ago.

It's a five-stage process of documenting how you're implementing the various requirements for security, the different controls that NIST has put together.

ATO means that the agency has considered the various sets of security controls that apply to their systems.

They've documented their approach to implementing those controls.

They have been assessed in an independent way to ensure that the controls that they've implemented are operating as intended and that they're doing continuous monitoring, et cetera.

So that's the ATO process.

Now, Zero Trust is a much broader model of how you achieve security compliance.

So it's a little different.

There are five pillars and civilian side, seven pillars on the government, on the DOW side.

But compliance is not as easy as the RMF side because NIST has made it very, not easy, but it's more regimented that this is how you achieve compliance and this is how you get authorization.

For Zero Trust, there's no corresponding authorization that I'm aware of.

But it's a journey.

It's a very comprehensive approach to looking at cybersecurity.

And it's much more than technology, of course.

It touches every aspect of an organization.

It's just more strategic, more high level, I would say, Zero Trust, as opposed to the RMF, whether it's the NIST version or the DoD version, which is a little more intense.

From my understanding, at least on the surface, I think a lot of people are like zero trust.

OK, so we're just going to start not trusting anybody.

Great.

All right.

Perfect.