Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / CMMC 2.0 Presentation by Craig Petronella

Transcript

CMMC 2.0 Presentation by Craig Petronella · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:14
  Good afternoon, everyone.
• 0:16
  My name is Craig Petronella.
• 0:18
  I'm an IT cybersecurity and compliance expert.
• 0:22
  I'm a CMMC certified registered practitioner with the CMMC ab.org.
• 0:28
  And I'll be your host for the presentation today.
• 0:31
  Today, we're going to talk about the cybersecurity maturity model certification or CMMC 2.0 for federal defense contracts.
• 0:42
  Who is Craig Petronella?
• 0:44
  That's me, your host.
• 0:45
  I'm in a long time cyber expert.
• 0:48
  I'm a tech enthusiast focused on the strategic alignment of people, process and technology to empower organizations to thrive in this digital age of information.
• 1:00
  Petronella technology group, or PTG provides security risk assessments, penetration testing, training and consulting services to help businesses reduce employees, improper handling of controlled unclassified information or CUI and federal contract information or FCI covered defense information, or C D I and personal identifiable information or PII.
• 1:32
  Fines and penalties for regulated breaches, cyber fraud, theft of credit card data.
• 1:40
  Good.
• 1:40
  Cyber hygiene is akin to a properly aligned spine.
• 1:44
  No one really pays attention to it, but those that do easily stand at the.
• 1:49
  Protecting data is paramount and those who actively and proactively do so tend to be the most successful businesses.
• 1:57
  It's really the foundation of your business.
• 2:00
  And it's rewarding to see my clients with Stan cyber attacks and win new contracts.
• 2:06
  Are you prepared solutions to cyber security must be aligned with people, process and technology, and need to be both scalable and sustainable.
• 2:17
  Cyber crime is a growing threat.
• 2:19
  Hackers are not going to wait for contractors, subcontractors, or vendors to get their cybersecurity whipped into shape.
• 2:27
  To start a cyber.
• 2:29
  Exfiltration of sensitive data by malicious actors around the globe is a threat to both national and economic security.
• 2:38
  The DOD is working with the defense industrial base or DIB to enhance protection of controlled unclassified information or CUI along the supply chain.
• 2:49
  What does this mean for your business?
• 2:51
  2021, saw a 69% increase in cyber attack related complaints to the FBI.
• 3:00
  How does this impact you?
• 3:01
  Comply today.
• 3:02
  The requirements to comply are five plus years old.
• 3:06
  Now the CMMC combines various cybersecurity standards and best practices.
• 3:12
  It maps these controls across three different maturity levels.
• 3:17
  The maturity levels build on each other.
• 3:19
  They range from foundational cyber hygiene to expert for a given CMMC level.
• 3:25
  The associated controls when implemented will reduce risks against a specific set of cyber threats.
• 3:32
  It's imperative for you to be compliant.
• 3:34
  Making a false claim is a serious offense with the false claims act.
• 3:40
  CMMC 2.0, what we know today.
• 3:44
  What is the CMMC the department of defense or DOD certification process that combines the various cybersecurity standards into one unified standard for cybersecurity.
• 3:56
  It measures the ability of members of the DIB or defense industrial base to protect data.
• 4:02
  We've got federal contract information or FCI and CUI or controlled unclassified information.
• 4:12
  Cybersecurity maturity model certification 2.0 CMMC has been simplified, but it's not going away.
• 4:20
  We've reduced it from five to three maturity levels.
• 4:24
  Maturity level.
• 4:25
  Now is now self certifying D FARS 70 12 and NIST 801 171 are still required today.
• 4:34
  No changes to the clauses of 70, 19 or 7020 sPRs or spurs self attestation is still mandatory.
• 4:44
  See DOD enforcement to be more aggressive from the DOD civil cyber fraud initiative creates more false claims act participants expect more aggressive requirements from the primes.
• 4:57
  Whistleblowers can report.
• 4:59
  Non-compliance.
• 5:01
  On the left side here, we have the CMMC model one, which showed that five different levels ranging from basic level one with only 17 practices, all the way up to level five, with 171 practices, that's been simmered down and reduced on the right side with CMMC model 2.0, we still have level one, the foundational, which is 17 practices.
• 5:27
  We're an annual self assessment is okay.
• 5:31
  Moving up.
• 5:32
  We have maturity level too for advanced, which is 110 practices, which are aligned with NIST SP 800-1 71.
• 5:42
  Tri- ennial third party assessments for critical national security information, annual self-assessments for select programs.
• 5:52
  And then moving up to maturity level three, we've got expert at 110 plus practices based on.
• 6:01
  And building on level one and two.
• 6:03
  So we still have to do the NIST 800-1 71, but now we add on the supplemental 800-1 72, and this is triennial government led assessments to be clear on maturity level two, there are no longer allowing this was a recent change then no longer allowing self-assessing.
• 6:23
  So you have to do self assessments on your own.
• 6:26
  However, you still have to have a third party assessment done at maturity level two and higher, higher.
• 6:34
  The third one is government led.
• 6:37
  So we have cybersecurity maturity model 2.0, the new requirements mirror.
• 6:43
  Very similar to NIST, 800-1 71.
• 6:45
  And now one 70.
• 6:47
  With CMMC 1.02, we had 20 Delta controls that were eliminated.
• 6:54
  We've eliminated a lot of the alternative levels and simmered it down from five levels to, two the maturity process has created a 50% to 100% level of effort for businesses.
• 7:05
  They were poorly defined and in the full year after CMMC was originally.
• 7:09
  released, the DOD never provided an example of a passing policy, a procedure or a plan.
• 7:15
  CMMC 2.0 level to align.
• 7:18
  800-1 71 CMMC 2.0, level three will include a subset of 800, 1 72 controls.
• 7:27
  The assessment changes for CMMC 2.0 level one, which is the self-assessment where we have the entity and the corporate officer at testation moving up to CMMC 2.0 level two.
• 7:40
  We've got the third party assessed.
• 7:42
  Which is prior, which needs to be awarded.
• 7:46
  You have to have that third-party assessment before you'll get a new contract award and you'll still have to do your own annual self-assessments.
• 7:53
  But, but again, they made that change where you have to do the third-party assessment as well.
• 7:58
  And you also have to have buy-in at the C levels for the corporate officer at the station.
• 8:03
  And then the 2.0 level three, you'll have to get that assessment done by the.
• 8:09
  Self-assessment at maturity level.
• 8:11
  One is self at the station.
• 8:13
  The third party assessment is required for maturity level two and limited plan of action and milestones or poems or waivers are allowed.
• 8:22
  These will only be temporary waivers though, and there'll be really difficult to attain the parameters for poems and waivers will be defined during the rule-making stage.
• 8:32
  Poems are allowed under 2.0, but only for a 180 day period.
• 8:37
  I recommend trying to not use poems at all, because poems are really like a band-aid.
• 8:42
  So why even haven't been able to begin with, try to just go straight and fix the problem.
• 8:46
  If you can.
• 8:48
  DOD certifications at maturity level three, have an increased responsibility and role contractors are encouraged to comply with heavily weightedness controls as soon as possible to be positioned for a delusion of CUI being released under coming, procure.
• 9:04
  Here's the deforest interim rule.
• 9:07
  Katie Arrington once said the COC certification is like your driver's license on the information.
• 9:13
  Super highway coming Le lay in of CMMC 2.0 has added new contracting requirements.
• 9:20
  We've got the 70 19, which advises.
• 9:23
  Contractors that they must maintain and report the 800-1 71 compliance in the spurs system.
• 9:29
  It also explains the three types of assessments or audits, which are basic medium and high 70 20 outlines the requirements of contractors to provide the government access to its facilities.
• 9:43
  If the DOD is renewing a contract or conducting a medium or highest.
• 9:48
  70 21 discusses integration of CMMC maturity levels.
• 9:51
  One through three, the interim rule, the supplier performance risk system or spurs, and the DOD assessment methodology or dote M score the SPRs or self-assessment effectively reinforces self access station of NIST 801 70.
• 10:12
  Have you completed your spur self-assessment yet because it was due on back on December 1st, 2020, currently it included most RFPs, not recommended that contractors wait, the DOD wants all subcontractors and primes to self attest as soon as possible CMMC will rollout after rulemaking, but until then you must complete the spurs.
• 10:38
  Self-assess.
• 10:39
  You need a guide and we are here to help you.
• 10:44
  The benefits of NIST and CMMC compliance are increased security, a competitive advantage, peace of mind and NIST 800-53 being NIST 800-1 71 compliant will significantly reduce the likelihood of a breach.
• 11:00
  And if you're breached, it will decrease the impact of the breach.
• 11:05
  Once you have put in the time, energy and money, it requires to be NIST 800-1 71 compliant.
• 11:11
  You gain a competitive advantage over other businesses who are not gain peace of mind and don't lose sleep.
• 11:19
  Wondering if you're going to lose your contract and your reputation because you failed to comply with NIST 800-53.
• 11:27
  You're that much closer to being.
• 11:29
  compliant, taking just a few steps will gain that much more of a competitive advantage.
• 11:36
  The PTG process, your journey is smooth and measurable.
• 11:40
  A supplier, a simple risk assessment produces a customized blueprint towards total compliance.
• 11:48
  Your people are encouraged to perform a risk assessed.
• 11:51
  Provided with policies that form a guided framework and train to use technologies.
• 11:56
  As the active principle in cybersecurity, you'll join a group of high-level DOD contractors working with very sensitive information that we've helped and kept in the flow of new contract awards with strategic AI driven tools.
• 12:11
  CMMC 2.0 takeaways.
• 12:14
  Poems have changed dramatically.
• 12:17
  They're only good for up to 180 days.
• 12:20
  Most heavily weighted of the 110 controls cannot be part of a poem.
• 12:25
  We suggest identifying those and commencing maturity prescription to comply with 800-1 71 is found in most one, almost 100% of DOD prime and sub contracts.
• 12:39
  When you sign a contract yourself, a testing compliance with both the far 52 dot 2 0 4 21.
• 12:47
  And the 2 5 2, 2 0 4 70 12 controlled unclassified information or CUI will become routine.
• 12:56
  In most procurements expect a flood of CUI to gain access to CUI.
• 13:03
  It will likely require the right maturity level or spurs score.
• 13:08
  DOD major primes will be some of the strictest enforcers of NIST, 70 12, 70 13 compliance.
• 13:16
  If you rely on a third party MSP that does not relieve you of the obligation and the compliance in any manner, you can't outsource that responsibility.
• 13:26
  We suggest having early meetings with your MSP to discuss the responsibilities and the roles, and we highly recommend that they're CMMC AB certified registered provider organizations and you work work with certified registered practitioner.
• 13:43
  With your DFR CMMC and NIST compliance, the MSA MSP should be compliant as well.
• 13:52
  What our clients say we've got five star reviews.
• 13:57
  We've been trusted to work with the largest corporations in the world.
• 14:03
  We've recently won the 20 21 UpCity award of excellence, as well as the better business bureaus, 2021 small business award.
• 14:14
  So what do we do next?
• 14:16
  Our recommendation is to review your system security plan against NIST 800-1 71.
• 14:22
  Perform a gap analysis and a risk assessment to identify your vulnerabilities in your system security plan.
• 14:29
  Poems or plan of action and milestones should be tailored to your gap analysis and put your score into the supplier performance risk system or spurs.
• 14:40
  Be sure to customize your policies, to align with any poem goals, implement PTG suggested pro-ams in sequential order to catapult your SPRs score upward.
• 14:52
  Revisit your system security plan, your POAMs and policies to ensure they're all in alignment, final adjustment of people, process and technology to mirror the alignment, maintain cyber synergy throughout the PTG, manage maintenance.
• 15:10
  You can succeed with our guidance.
• 15:13
  We suggest you talk right away to us.
• 15:15
  Please call us at 9 1 9-6 0 1- 1 6 0 1 or visit Petronellatech.com