1 / 8
- Identified
- Assessed
- 3Treatment
- 4Monitoring
- 5Closed
Next review by Marcus Lee
RSK-042In progress· Cyber
Ransomware encrypts engineering file shares containing CUI
A ransomware actor gains a foothold via a legacy CAD server (CTX-02) and encrypts the engineering file shares that hold CUI drawings for the F-35 bracket program. Loss of availability stops production engineering; exfiltration before encryption triggers DFARS 252.204-7012 72-hour reporting to DoD.
Treatment actionsTRT-042
3 of 5
DoneTRT-042.1Enable Veeam immutability on nightly jobsTO
In progressTRT-042.2Move weekly offsite copy off legacy NASTO
In progressTRT-042.3Deploy EDR to legacy CAD serversDW
DoneTRT-042.4Quarterly restore test with CUI sampleTO
DoneTRT-042.5Tabletop: ransomware + DFARS 72h reportDW
Linked records18
TRT-042Immutable backups + EDR on engineering file servers3 of 5 actionsIn progress
CTX-02Engineering uses legacy CAD servers on unsupported OS buildsInternal issueActive
3.8.9Protect the confidentiality of backup CUI at storage locationsCMMC-L2 · POA&MPartial
3.13.11Employ FIPS-validated cryptography to protect CUICMMC-L2 · POA&MPartial
A.8.13Information backupISO 27001Met
3.5.3Use multifactor authentication for local and network accessCMMC-L2Not met
3.8.9[a]The confidentiality of backup CUI is protected at storage locations. via 3.8.9Partial
3.13.11[a]FIPS-validated cryptography is employed to protect CUI. via 3.13.11Partial
3.5.3[b]MFA is implemented for local access to privileged accounts. via 3.5.3Not met
EVD-0296Veeam immutability + encryption config.pngexpired 2026-09-12Expired
EVD-0280BitLocker FIPS 140-2 certificate #3920.pdfuntil 2027-05-01Verified
EVD-0311Duo MFA enrollment report — Sep 2026.pdfuntil 2027-01-02Verified
FND-031MFA not enforced for local privileged access on 4 of 12 serversMajor NC · AUD-2026-03Open
POL-001Information Security Policyv4.2Published
PLN-003Incident Response Planv1.8Published
AST-0112eng-fs-01Server · CUIActive
AST-0108Siemens NX workstation poolEndpoint group · CUIActive
Activity
- Marcus Leecreated this risk from library scenario "Ransomware on file servers"Mar 2
- Marcus Leechanged statusDraftAssessedMar 2
- Dana Whitfieldset inherent score—4 × 5 = 20 CriticalMar 9
- Dana Whitfieldlinked control 3.13.11 as "mitigated by"Mar 9
- Priya Natarajanapproved treatment plan TRT-042 (Mitigate)Apr 2
- DWDana WhitfieldJul 14
Veeam immutability is on for the nightly jobs, but the weekly offsite copy still lands on the old NAS. Keeping residual at 2 × 4 until that moves.
- Dana Whitfieldchanged residual score3 × 4 = 122 × 4 = 8Jul 14
- Jamal Carterlinked finding FND-031 as "related finding"Sep 26
- AegisERMflagged evidence EVD-0296 as expiredSep 12
- TOTom OkaforOct 9
Re-exporting the Veeam config this week; @Dana the offsite job cut-over is scheduled for Oct 18.
DW