The Cybersecurity and Infrastructure Security Agency (CISA) has released the Remote Monitoring and Management (RMM) Cyber Defense Plan, the first proactive document collectively developed by industry and government partners.
A key part of the RMM plan is to advance cybersecurity and reduce supply chain risk for small and medium critical infrastructure entities through collaboration with RMM vendors, managed service providers (MSPs) and managed security service providers (MSSPs).
The JCDC RMM Cyber Defense Plan is built on two foundational pillars:
Of particular note, the Computer Technology Industry Association (CompTIA), the IT industry’s non-profit trade association and advocate, endorsed the plan and said it had input into its development.
Wayne Selk, CompTIA vice president, cybersecurity programs, and executive director of the CompTIA Information Sharing and Analysis Organization, said it is important that the “unique experiences and perspectives” of MSPs and MSSPs were taken into account in the RMM plan.
"These firms provide information technology and cybersecurity services to approximately 90 percent of U.S.-based small and medium-sized businesses, who themselves account for about half the nation's gross domestic product.”
Cyber threat actors can gain footholds leveraging RMM software into managed service providers (MSPs) or manage security service providers (MSSPs) servers. Infiltrations can have a domino effect to impact small and medium-sized organizations that are MSP/MSSP customers. For instance, the high profile SolarWinds Orion attack of December 2020 leveraged MSPs to hit government agencies and hundreds of businesses.
How the RMM Plan Addresses Risk
THE RMM plan builds on the Joint Cyber Defense Collaborative’s 2023 Planning Agenda that addresses the following risks:
The JCDC RMM Cyber Defense Plan supports JCDC’s three core functions:
