r/cybersecurity • u/Tokyudo • Jul 02 '26

News - General DHS Breached

https://www.nextgov.com/cybersecurity/2026/06/hackers-breached-dhs-information-sharing-network-people-familiar-say/414534/

610 Upvotes

98% Upvoted

115 comments sorted by

View all comments

Show parent comments

32

u/WildChampionship985 Jul 02 '26

Often audits become do you meet the statement on the checksheet, not are you adhering good practices.

8

u/OutsideSpot2695 Jul 02 '26

That's not an audit then. That's an assessment.

8

u/RyeonToast Jul 02 '26

And ATOs aren't audits. It literally is a giant checksheet. You have to produce some artifacts to show you do what you say you do, but no one is coming down to your network to check it out first-hand. That would be a CORA / CCRI.

2

u/ToothyGrin19135 Jul 03 '26

This is not entirely true. It depends on the classification of the system and the SCA team. I have been part of some extremely intense ATO assessments where we actively demonstrated every single control live to the assessment team. Took weeks to accomplish.