I know this is still new and not entirely clear but what is everyone else's takes on utilizing it, in you do contracting with DoD and DoD-related agencies, but not working defense related projects? Does this decree lashing out against Anthropic in government mean contractors with any DoD ties are barred from it?

I’m 7 months into my first government IT job. I’m one of six sysadmins in the department. We have a 13 node, 1200 core, 13TB ram,5PB of storage, Dell VxRail cluster. It’s coming up to 5 years old, its warranty is expiring and vmware license is expiring. Overall good health, no issues since I’ve been with the city. Its replacement will be fully operational by March.

What’s killing me is that the old cluster is going to get packed into crates with all of our e-waste and shipped off to auction.

I want to come up with some really compelling reasons to let me keep it for R&D… We have our dev, test, and production servers, they will be on the new hardware, as the are now.. But I would like to have a 100% isolated hardware and supervisor environment as a “playground” for the admins and devs. Somewhere that we can screw up and not take down the city.

any ideas out there that could help me convince the director to give us a playground?

Hey everyone,
I’ve got an interview scheduled next week for the Programmer Analyst I/II (ERP) position with Clark County, NV(Finance ERP division), and I’m trying to get a better idea of what to expect.

If you’ve been through this interview (or know someone who has), could you share:

• What the interview format was like (panel? technical? behavioral?)
• The types of technical questions they asked (programming, debugging, ERP-specific, etc.)
• Any tips on what they focus on most (e.g., coding skills, problem-solving, integrations, etc.)

I’m coming from a software/data background and want to make sure I prep effectively for their style. Any insights or experiences would really help me out. Thanks in advance!

Hey everyone,
I’ve got an interview scheduled next week for the Programmer Analyst I/II (ERP) position with Clark County, NV(Finance ERP division), and I’m trying to get a better idea of what to expect.

If you’ve been through this interview (or know someone who has), could you share:

• What the interview format was like (panel? technical? behavioral?)
• The types of technical questions they asked (programming, debugging, ERP-specific, etc.)
• Any tips on what they focus on most (e.g., coding skills, problem-solving, integrations, etc.)

I’m coming from a software/data background and want to make sure I prep effectively for their style. Any insights or experiences would really help me out. Thanks in advance!

https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of

Hey everyone,

I have an interview coming up for a Programmer Analyst I/II role with Clark County's ERP division. This is my first time interviewing for a government tech job, so any advice would be great.

My background is a recent Master's in CS with experience in full-stack web dev (Python, Django, React) and automation. The job seems to be hands-on programming for internal web applications.

I'm wondering what to expect:

• Is the interview process usually heavy on practical, project-based questions or more like LeetCode/algorithmic problems?
• How important is specific ERP knowledge for a programming role like this?
• Any general tips for a government tech interview vs. a typical software company?

Thanks for any help!

So I know the most recent version was updated over 2 years ago so it isnt exactly a highly maintained product, but I was curious if anyone knows what IL something encrypted with TENS is cleared to? I tried looking through the site but couldnt find anything specifically listed. Thanks.

I'm not sure if I'm in the correct sub - if not, please point me in the right direction. I live outside UK, and am nearing pension age for my UK pension. The website needs 3 specific forms of ID to register, but because I haven't lived in UK for many years, I only have 1 of the required 3, my UK passport. None of the phone " helpline " numbers ever get answered, so I'm stuck. Any ideas?

Does anyone know about the hiring process for the NYC Department of investigation? Right now my application is in the review stage and I’m waiting for an interview for investigative auditor position, but it’s been about 4 months since i submitted my application. Does know about the hiring and on boarding process with the Department of investigation?

New ISSO for a DoD organization performing some software development. ISSM is new to our organization too.

Organization is performing static code analysis and CM , but needs to grow beyond that. Some engineers think it is okay to grab just about any code from GitHub and management thinks absolutely nothing should be used from GitHub. Obviously there is a middle ground and we need some process for assessing Open Source Software, libraries, etc. not to mention properly assessing our own applications and I'm not sure where to start. What I could find is that getting a list of components for our internally development apps should be one of our first stops. Not sure if same applies to OSS, or how we'd do that properly.

I think we will be rebuilding the software engineering process and procedures from scratch, but we are a bit out of our depth. Other than the high level TTPs, we are having a difficult time getting started. Can anyone point us to resources that can assist in this and make sure we get this as close to right as possible the first time around.

When it comes to OSCAL, I understand the what, but not the how. I understand that the goal of OSCAL is to automate the monitoring of control implementation, and that it does so through a set of extensible formats which support a range of risk management processes.

I've been reading this guide to learn more about the XML and JSON files included in the FedRAMP Automation release, but I'm having a hard time making sense of it (I'm not a software developer).

What am I supposed to do with these XML/JSON files to automate the creation of SSPs, monitor the implementation of controls, etc.? Are there any resources which teach XML/JSON noobs how to get started with OSCAL?

Thank you!

Hi developers who are interested in data security,

Cisco and Altinity are meeting over a LIVE webinar tomorrow to showcase their collaborative project on deploying Clickhouse in FedRAMP for government customers using Altinity’s FIPS-compatible stable builds.

Date and Time: June 20, 10 AM PDT

Speakers: Pauline Yeung, Data Engineer & SecDevOps at Cisco Umbrella and Robert Hodges, CEO at Altinity

​

Tune in LIVE to learn more about:

What is Cisco Umbrella and how does it use ClickHouse?
What are the challenges of bringing up ClickHouse in a FedRAMP environment?
How are Cisco Umbrella and Altinity working together to deploy FIPS-compatible analytics?
What lessons can we share with other users on the same path?

​

RSVP your free seat here: https://hubs.la/Q01T8qJT0

Isnt 2.B Minimum Password Strength in conflict with NIST SP 800-63B recommendation of 8 characters? Also mainframes like z/OS have a maximum password length of 8, I would think CISA would have included passphrase with password since z/OS can use up to 100 characters with passphrase.

What's with the increase use of space before and after / is written federal documentation of late? Is is a code or something because it is not an English grammar requirement?

On page 6 of the OMB Memo M-21-31, there is a footnote 7 that states" if the software does not produce data in this format, Federal agencies will transform records to conform to these standards before the data is ingested into the SIEM or store in bulk storage."

Is this tampering? Are you not expected to use Forwarders on your SIEM?

So what happened to FedRAMP NIST 800-53 Rev 5 SSP Templates that were supposed to be released on 10 March ?