Latest / CMMC Compliance Guide / How to Identify and Fix Your NIST 800-171 Weak Spots

Transcript

How to Identify and Fix Your NIST 800-171 Weak Spots · CMMC Compliance Guide

0:21
SPEAKER_03: Hey there! Welcome to the CMMC Compliance Guide Podcast.
0:25
SPEAKER_03: I'm Austin.
0:26
SPEAKER_03: And I'm Brooke from Justice IT Consulting, where we help businesses like yours navigate CMMC and NIST 800-171 compliance.
0:33
SPEAKER_03: We're hired guns getting companies fast-tracked to compliance, but today we're here to give you all the secrets for free, so if you want to tackle it yourself, you're equipped to do so.
0:43
SPEAKER_03: Let's dive into today's episode and keep your business going.
0:46
SPEAKER_03: on track.
0:47
SPEAKER_03: Today's question is simple, but high stakes.
0:49
SPEAKER_03: Are you really NIST 800-171 compliant?
0:51
SPEAKER_03: You might think so, but there are a few controls that contractors overlook all the time, and that can put your contracts and reputation at risk.
0:58
SPEAKER_03: Brooke, from what we've seen from past DibCAC assessments, what's the biggest misunderstanding contractors have about NIST 800-171?
1:08
SPEAKER_02: Probably really the biggest one is scoping.
1:11
SPEAKER_02: And we've kind of talked about this before, but people don't get their scope quite right.
1:16
SPEAKER_02: They include too much or try to scope it too narrow and then have data leakage or however you want to phrase that.
1:26
SPEAKER_02: They didn't take everything into consideration.
1:28
SPEAKER_02: So scoping is the biggest thing.
1:29
SPEAKER_02: Folks have a tendency to have a problem with that.
1:35
SPEAKER_02: Hopefully you find that out rather soon and you don't get too far through an assessment or anything before they kick it back and say, this
1:45
SPEAKER_03: is not going to work.
1:47
SPEAKER_03: So if you're sitting at home trying to figure out if you've gone too far, what is a general rule of thumb that they might could go by to see if they've done a little too much or too little on their scoping?
1:58
SPEAKER_02: Well, really a general rule of thumb to do your scoping properly.
2:02
SPEAKER_02: This is whether you're going to design a new system, whether you have something in place, or you have something in place and you're going to try to design a system.
2:09
SPEAKER_02: However it works out, the first thing you need to know is is what kind of data, what kind of CUI you're trying to protect.
2:17
SPEAKER_02: That's key in this, right?
2:19
SPEAKER_02: Because if you don't know, you may get some of the controls a little not quite right.
2:23
SPEAKER_02: That's a key thing to know.
2:24
SPEAKER_02: But really for scoping guidance, once you know that, it's best to draw a data flow diagram.
2:29
SPEAKER_02: I'm pretty visual, so I can draw a diagram or you can put it in, well, I was going to say Visio.
2:34
SPEAKER_02: That might be old school these days.
2:36
SPEAKER_02: I don't know, but I use Visio a lot.
2:40
SPEAKER_02: So Visio or something like that.
2:42
SPEAKER_02: I think PowerPoint is a...
2:43
SPEAKER_02: anything but like I said hand drawing I mean I always hand draw all my network diagrams and everything anyway because I normally draw it redraw it, redraw it till I get it right.
2:54
SPEAKER_02: And then I go put it in Vizio or whatever you want to put it in.
2:58
SPEAKER_02: But yeah, the program when you want to use is fine, but you know, hand-drawn is great to get the understanding started.
3:05
SPEAKER_02: Going down that rabbit hole, but it's not necessarily the tool.
3:09
SPEAKER_02: But when you start doing your data flow diagram, it's easy to take that at a high level and say, oh yeah, we get it from the internet and we download it into our system.
3:19
SPEAKER_02: You know, that's our data flow diagram.
3:21
SPEAKER_02: Specifically, how do You go list out all the actual systems you go to, you know, Lockheed's portal.
3:28
SPEAKER_02: You go to whoever's portal, download it from that portal, or you get it through secure email or whatever it is.
3:35
SPEAKER_02: Each one of those is a system.
3:37
SPEAKER_02: Write all those down.
3:38
SPEAKER_02: Write down all the systems.
3:40
SPEAKER_02: Draw out all the systems that you have in place, like Microsoft 365, SharePoint, then email, SharePoint.
3:48
SPEAKER_02: Whatever you have on-premise, you have your file system, your server shares, you have maybe an ERP or an MRP or something like that, or some other kind of database.
3:59
SPEAKER_02: You have some other applications that use it.
4:02
SPEAKER_02: So you've got to list all those systems, all those applications out, and then draw out where your data, your CUI flows to.
4:10
SPEAKER_02: Once you take all that into account and draw it out, it begins to make a little sense.
4:16
SPEAKER_02: And if you draw it, it looks like one big giant spaghetti, a bowl of spaghetti, which is probably about right.
4:22
SPEAKER_00: But
4:23
SPEAKER_02: once you draw all that out, then you can say, you know what, we need to simplify this.
4:27
SPEAKER_02: This is the way it looks currently.
4:29
SPEAKER_02: This is what I want it to look like, and you can then design that.
4:35
SPEAKER_02: But you've got to draw that data diagram, data flow diagram first, and take everything into consideration.
4:41
SPEAKER_02: All your portals, all the applications, all the systems you have, take all that into consideration.
4:46
SPEAKER_02: Also take into consideration, do you send it to some of your subcontractors?
4:51
SPEAKER_02: You've got to pay attention to flow down, right?
4:55
SPEAKER_02: So if you send it to some contractors, how do you get it to them?
4:58
SPEAKER_02: So you've got to make sure you keep your controls in place when it leaves your batteries as well.
5:05
SPEAKER_02: And then, not that this is part of the data flow diagram, but there's flow down and so contractors are going to have to meet that as well.
5:15
SPEAKER_02: So it's good to know that your subcontractors are client as well.
5:19
SPEAKER_03: So when I think about operationalizing this a little bit, I think of there's three main buckets.
5:24
SPEAKER_03: Where does it come from?
5:25
SPEAKER_03: It's a source, right?
5:26
SPEAKER_03: So if you could map that out, um, you know, is it customers, what customer portals, um, is email, et cetera.
5:32
SPEAKER_03: And then second is where does it reside while it's here with us, whether it's on a machine or a computer or the file server or the ERP system, wherever that may be on your systems and, um, in software.
5:45
SPEAKER_03: And then three, where does it travel to?
5:47
SPEAKER_03: Where does it, right?
5:48
SPEAKER_03: And what modes or pieces of software or communication channels there?
5:52
SPEAKER_03: So it's kind of three main buckets.
5:54
SPEAKER_03: And from there, you might need to bring everyone, programmer, CNC operator, the general manager, the sales person, you know, whoever, you might need to bring them all around a table and put those three buckets on a whiteboard.
6:08
SPEAKER_03: And then you can map it out.
6:09
SPEAKER_03: You don't probably just want the quality guy or the owner or the GM just assuming and putting us together.
6:14
SPEAKER_03: You probably need everyone contributing to that.
6:16
SPEAKER_03: That is a very good point
6:17
SPEAKER_02: because I know that as an IT guy and working with some GMs and owners and whatnot, some CEOs or CFOs or whoever, what we think is happening isn't always what's actually happening.
6:32
SPEAKER_02: So yes, you need to get some of the people that actually do the work and actually know what's going on, actually have done it and can tell you this is the way we do it.
6:41
SPEAKER_02: And a lot of times you end up going, yeah, we didn't realize they were doing it that way.
6:48
SPEAKER_02: So it certainly helps to know all that, yes.
6:51
SPEAKER_02: So you say a simple thing, just draw a data flow diagram, and it really can get pretty entailed, but simply you need to have a data flow diagram.
7:00
SPEAKER_02: and know where that data goes that you're trying to protect.
7:05
SPEAKER_02: It can be a little complicated trying to figure it all out.
7:08
SPEAKER_02: That's a very needed first step.
7:11
SPEAKER_02: I guess that would actually be the second step right after knowing what kind of data it is that you're trying to protect.
7:19
SPEAKER_03: So let's get into specifics.
7:21
SPEAKER_03: What are some of the top NIST 800-171 requirements that contractors miss or get wrong?
7:27
SPEAKER_03: So for multi-factor
7:28
SPEAKER_02: authentication, MFA, what we see a lot that people do is they make sure it's in place for remote connections like VPN or something like that and also for admin sessions which is absolutely needed for those it's also needed for network connections to CUI which means if it's going over your your local network if you're connecting to your server over a network which you likely are unless you're working specifically on your desktop or laptop on that hard drive.
8:05
SPEAKER_02: If you're going across the network to access that data, it's across the network and you have to have MFA in place to protect that.
8:12
SPEAKER_02: MFA, multi-factor authentication.
8:14
SPEAKER_02: So that's one of those things that is misunderstood.
8:18
SPEAKER_02: Next would be risk assessments.
8:20
SPEAKER_02: Risk assessments need to be done on a periodic schedule, annually for instance.
8:27
SPEAKER_02: And you need to follow up a risk management framework and methodology, and you need to document everything you do for that risk assessment.
8:38
SPEAKER_02: So that's another thing that people get wrong or don't follow through with is those risk assessments.
8:47
SPEAKER_02: Another thing would be logging.
8:49
SPEAKER_02: A lot of people make sure things are logged.
8:51
SPEAKER_02: A lot of people think you absolutely have to have a SIM.
8:56
SPEAKER_02: necessarily have to have a SIM, but you need to protect.
8:58
SPEAKER_02: The way the controls are written is that it really makes it a lot easier if you use a SIM.
9:05
SPEAKER_02: A SIM will help you very easily fit all those controls.
9:11
SPEAKER_02: But it doesn't require SIM for logging, but You have to make sure that you specify what is supposed to be logged.
9:20
SPEAKER_02: And then you have to make sure that's logged.
9:21
SPEAKER_02: Make sure the logs are protected.
9:22
SPEAKER_02: That'll hold nine yards.
9:24
SPEAKER_02: If you use a cloud sim, that's a whole other ballgame.
9:27
SPEAKER_02: A sim is a...
9:30
SPEAKER_02: A sim, there's a...
9:32
SPEAKER_02: It's not a TLA.
9:34
SPEAKER_02: I guess that would be a...
9:37
SPEAKER_02: FLF, four-letter acronym.
9:39
SPEAKER_02: SIEM is a security information and event management tool.
9:45
SPEAKER_02: So it gathers all your logs from all the different sources you could gather them from, so your servers, your firewall, workstations, Microsoft 365, GCC High, you know, and whatever other tools that you can integrate into it.
10:06
SPEAKER_02: is really what you
10:08
SPEAKER_03: need to put in.
10:09
SPEAKER_03: And it more or less conveniently checks all the boxes for the logging.
10:14
SPEAKER_03: It
10:14
SPEAKER_02: does conveniently
10:15
SPEAKER_03: check those boxes,
10:16
SPEAKER_02: yes.
10:18
SPEAKER_02: You know, it helps in management.
10:21
SPEAKER_02: It helps in alerting.
10:22
SPEAKER_02: It helps secure those logs, the whole nine yards, I guess.
10:28
SPEAKER_02: But the key to that is you need to make sure you're logging the things that need to be logged, make sure that's defined.
10:34
SPEAKER_02: A lot of people don't realize if it's defined, you need to write it out and say, this is what we're logging.
10:41
SPEAKER_02: This is what the logs are supposed to have in them.
10:44
SPEAKER_02: And then you have to verify and make sure that that's what's actually in the logs.
10:48
SPEAKER_02: So making sure you do that is, again, that's a part of documentation.
10:54
SPEAKER_02: So a lot of people know, of course we log things.
10:57
SPEAKER_00: Well,
10:58
SPEAKER_02: what's in those logs?
11:00
SPEAKER_02: stuff.
11:02
SPEAKER_02: But you've got to know what's in those logs and you've got to make sure that you define all that.
11:06
SPEAKER_02: Just make sure that, again, it's documented.
11:08
SPEAKER_02: Make sure that you've defined what's supposed to be in the logs and that you actually are logging the things that you say you're logging.
11:17
SPEAKER_02: I think you'd mentioned supply chain oversight as well.
11:21
SPEAKER_02: You're always supposed to verify that your suppliers, that anybody that you handed off that CUI to or any part of that CUI, that they are compliant as well.
11:32
SPEAKER_02: You've always supposedly, you're always supposed to do that.
11:35
SPEAKER_02: It wasn't done very much.
11:37
SPEAKER_02: So they specifically called it out and said, yes, you are supposed to, it is your job to make sure that your suppliers, your vendors, anybody you subcontract to that touches that CUI, they have to be the same level as you.
11:53
SPEAKER_02: Now, it may be that they only, if there's documents that are portion marked, and I don't know about level one and level two, I guess level one really would be a FCI, but it could possibly be that you're not passing down a CUI and it's on the FCI.
12:07
SPEAKER_02: You're level two, They need to be level two if you're level three.
12:11
SPEAKER_02: Likely they need to be level three.
12:13
SPEAKER_02: Really, if you're level three, but you have some information that's level two, that you know is level two, then they need to be at level two, is what I understand.
12:25
SPEAKER_02: For instance, Lockheed, they're going to be level three.
12:29
SPEAKER_02: So actually, anyway.
12:32
SPEAKER_02: But they, not all of their suppliers for the F-35, have to be level three.
12:40
SPEAKER_02: Some level three, I'm sure.
12:41
SPEAKER_02: Most of them level two, and then I'm sure there are some people that do some off-the-shelf stuff.
12:48
SPEAKER_02: Now that we've made that clear as mud, basically.
12:51
SPEAKER_02: But the rule is flow down.
12:53
SPEAKER_02: If you send them CUI, they need to be the same level as you are.
12:58
SPEAKER_03: How does documentation play in to compliance misunderstandings?
13:02
SPEAKER_02: I don't know.
13:02
SPEAKER_02: Have we ever talked about documentation before?
13:04
SPEAKER_02: No, never.
13:06
SPEAKER_02: So, you know, there's a small portion of these controls and the objectives that are technical, and most of this is process and documentation, right?
13:21
SPEAKER_02: But there's a ton of documentation.
13:24
SPEAKER_02: If it says...
13:26
SPEAKER_02: list you've got to have a list of folks you know if it says define you've got to have uh something written out a policy written out you have to have policies anyway but you have to have policies you have to have your plans uh procedures written out there's just a ton an absolute ton of documentation that needs to be written out not just your ssp not just your policies for each of the families that uh you know access control and awareness and training and all that but every everything you have to have all your policies and then you have to have You know, your procedures, this is how we do these things, you know.
14:00
SPEAKER_02: Beyond that, to be able to pass an assessment, you have to have all your proof, right?
14:07
SPEAKER_02: And so, yes, we've done this, and here is proof.
14:11
SPEAKER_02: Here's my documentation that shows how, you know, our SEM is set up or how Active Directory is– this GPO is set, stuff like that.
14:23
SPEAKER_02: You have to have all that proof in there as well.
14:25
SPEAKER_02: So there is an absolute
14:26
SPEAKER_03: ton of documentation.
14:27
SPEAKER_03: You might have to write your SSP, your POAM, and then write the policies and document form of how you're going to set up your network.
14:39
SPEAKER_03: And then you might have to, once you show them that, actually show them the network that's set up that would match the documentation, how it's set up, the network being set up, You know, maybe some technical people watching, like security groups, an active directory or something.
14:55
SPEAKER_03: That's not good enough.
14:56
SPEAKER_03: It needs to be in a document, preferably in a GRC tool or something, right?
15:01
SPEAKER_03: But not required.
15:02
SPEAKER_03: GRC tool makes it a lot easier.
15:04
SPEAKER_03: I can tell you that.
15:05
SPEAKER_03: A lot easier.
15:06
SPEAKER_03: The reason I bring that up is because not every assessor that we...
15:11
SPEAKER_03: come across, but it seems like a lot of them might prefer for you to have a GRC tool.
15:17
SPEAKER_03: So if you're looking at quick wins, laying fruit on making the job easy for the assessor, which would probably make the assessment easier, which might lend to you passing an assessment better, you might want to look at getting one.
15:32
SPEAKER_03: Absolutely.
15:34
SPEAKER_02: GRC tool makes it a lot easier.
15:37
SPEAKER_02: It'll make an assessor's life easier.
15:39
SPEAKER_02: Assessors love to see a GRC tool in place, especially if it's all fleshed out, you have everything in there that you already need, then they have access.
15:52
SPEAKER_02: You can either export everything and get it to them or you can give them access Depends on the assessor, I think, probably.
16:01
SPEAKER_02: You know, we use Future Feed, and they just came out with Assessor Role, I should say.
16:05
SPEAKER_02: Anyway, so you can...
16:08
SPEAKER_02: assign an assessor, create their account, and assign them the assessor role, and it'll give them read-only access to everything in there because they had specifically asked the Future Feed guys to put that in place because they didn't want to be accused of getting in and changing anything.
16:26
SPEAKER_02: Anyway, so they've created that.
16:27
SPEAKER_02: The point is, though, that a GRC tool makes life a whole lot easier for you and the assessor.
16:34
SPEAKER_02: But the assessor will appreciate that.
16:37
SPEAKER_02: And it's certainly not going to hurt your chances, I would think.
16:40
SPEAKER_02: No, unless you have it set up very poorly.
16:43
SPEAKER_02: But if you have that set up very poorly, then it's probably likely there's a lot of other stuff that's done poorly.
16:50
SPEAKER_02: So it's either going to take you...
16:54
SPEAKER_02: 150 years to get through the assessment, or you won't pass it.
17:00
SPEAKER_02: But a GRC tool,
17:01
SPEAKER_03: completely flesh it out, will help you with that assessment.
17:05
SPEAKER_03: And the reason I bring that up is because we're big on, I guess we can't say proven best practices, because there's a minority of people who have gone through assessments and been certified.
17:19
SPEAKER_03: But at this point, we can have accepted best practices or what everyone's saying, assessors mainly, they would wanna see.
17:28
SPEAKER_03: And so we're big on taking a playbook that is the least path of resistance to get you to certification.
17:38
SPEAKER_03: So whether it's with us or someone else like GRC tool is part of that.
17:43
SPEAKER_03: We're going out on the Oregon Trail.
17:45
SPEAKER_03: You can certainly make your own path Or you could buy a map from the guy at the trading post of the routes that people died less on.
17:55
SPEAKER_02: I don't know that I've had the CMMC assessment process compared to the Oregon Trail before, but that's pretty good.
18:03
SPEAKER_03: Yeah, I mean, I was just thinking about it.
18:05
SPEAKER_03: I remember playing that game as a kid.
18:07
SPEAKER_03: I think everyone did, and it's kind of like that.
18:10
SPEAKER_03: It's fraught with adversity and danger.
18:14
SPEAKER_03: There sure is a heck of a way to make it easier.
18:17
SPEAKER_03: And that is to build on those that have gone before you or listen to the people that you're going to be beholden to and make your job a little easier.
18:29
SPEAKER_03: Just to tack on to that,
18:30
SPEAKER_02: you know, that's one of the things that you want to look for when knowing who to trust is folks that are, you know, provide registered practitioner in a registered practitioner organization, an RP and RPO.
18:47
SPEAKER_02: They get registered through the Cyber AB.
18:51
SPEAKER_02: That's very minimum, and to tell you the truth, the bar is pretty low for that.
18:57
SPEAKER_02: The next really good step is a CMMC-certified professional.
19:02
SPEAKER_02: And there's a lot of folks, including us, who have gone through that training, because it basically teaches you how to do an assessment.
19:10
SPEAKER_02: And so that is, it's been eye-opening for for us, for some of our folks who have gone through it.
19:20
SPEAKER_02: So that's great.
19:23
SPEAKER_02: CCAs can help out a lot, although there's going to be a lot of them that are very, very busy right now.
19:33
SPEAKER_02: But yeah, look for those kinds of things.
19:35
SPEAKER_02: And people have been doing this for a while and understand it have been and working
19:42
SPEAKER_03: through this process.
19:44
SPEAKER_03: I didn't intentionally do this, but it seems like a good setup for our next topic that we wanted to get into, which is some contractors say that the guidance is vague.
19:56
SPEAKER_03: Why does this create
19:57
SPEAKER_02: issues?
19:58
SPEAKER_02: Some of these NIST controls, they leave some flexibility, and they're pretty prescriptive, but there's a little bit of flexibility there to...
20:08
SPEAKER_02: to adapt these to your own system and cover these controls how you see fit.
20:17
SPEAKER_02: So that flexibility, even though it's pretty prescriptive, there is a good bit of flexibility there.
20:30
SPEAKER_02: So that flexibility, leads to some misinterpretation.
20:34
SPEAKER_02: Really, where you need to start is looking at the NIST 800-171A, which is the assessment template.
20:43
SPEAKER_02: It says when you're going to assess someone, this is how you do it.
20:48
SPEAKER_00: You
20:48
SPEAKER_02: do this, you do this, and you interview, you test, all this kind of fun stuff.
20:55
SPEAKER_02: So it goes through the whole thing, and so you need to go through that and look at that.
20:59
SPEAKER_02: If things are still unclear...
21:02
SPEAKER_02: You can see where these controls come from.
21:06
SPEAKER_02: And, you know, for instance, some of them reference NIST 800-53, which is a government document.
21:13
SPEAKER_02: And that government document is what governments have to follow.
21:19
SPEAKER_02: Instead of NIST 800-171, they follow NIST 800-53.
21:24
SPEAKER_02: But a lot of the controls reference back to that and to some other areas.
21:29
SPEAKER_02: So once you read that document, that documentation is based on, that'll usually clear it up pretty good.
21:36
SPEAKER_02: You know, there is still room for some flexibility and some misinterpretation or some seeing things a little differently.
21:45
SPEAKER_02: And that's okay.
21:49
SPEAKER_02: But you know, if your assessor sees something differently than you do, you can make your case.
21:57
SPEAKER_02: You really need to make sure you're on solid footing.
22:02
SPEAKER_02: And really, if you're on solid footing, the assessor is probably going to understand and go, I see what you're doing and I see that it does meet these controls and these objectives.
22:14
SPEAKER_02: But if you don't read the assessment guide and you don't look at any of the supporting documentation, then yes, some of these can be misinterpreted.
22:23
SPEAKER_02: So
22:24
SPEAKER_03: another thing I wanted to bring up, a mindset issue a lot of people have around compliance and the fact that it's not a one-time event.
22:32
SPEAKER_03: You see this a lot.
22:33
SPEAKER_03: Typically, people think that they can just get some things done, do some paperwork, and be done with it.
22:42
SPEAKER_03: And additionally, what that leads to is, okay, well, why does this cost money?
22:49
SPEAKER_03: a lot of money.
22:50
SPEAKER_03: I might pay for my ISO audit or something and it's just done and we revisit later.
22:58
SPEAKER_03: Why does this have such a high carrying cost in terms of whether it's software tools, security licenses, GCC and Microsoft license upgrades?
23:13
SPEAKER_03: Why is it like this?
23:15
SPEAKER_03: You have a a lot of frustrations and confusion around that being the case.
23:21
SPEAKER_03: And that it's not a one and done project.
23:23
SPEAKER_03: Can you speak to that?
23:24
SPEAKER_02: People
23:24
SPEAKER_03: getting these ITAR
23:26
SPEAKER_02: or ISO audits, you know, and that leads to a lot of misunderstanding too, because they think, oh, well, this is just another one like those, you know, it ought to cost two, three, four, five, six, seven, eight,$10,000, whatever, and we're done,
23:40
SPEAKER_01: you know.
23:41
SPEAKER_02: Come in for a couple of weeks and, They're done, right?
23:45
SPEAKER_02: They write up some things that we need to do and everything's good.
23:48
SPEAKER_02: Well, this is not like that.
23:50
SPEAKER_02: So, and we've had people say, you know, I just want you to put it in place, you know, and we'll take care of it, you know.
23:58
SPEAKER_02: Well, which is fine.
24:00
SPEAKER_02: And we can do that.
24:02
SPEAKER_02: But what needs to be understood is that this whole nest, excuse me, Sorry to say 1-800.
24:10
SPEAKER_02: It's not a phone number.
24:13
SPEAKER_02: So this whole NIST 800-171 thing and CMMC is not a one and done.
24:18
SPEAKER_02: It's written for management, ongoing management, ongoing compliance, ongoing monitoring.
24:25
SPEAKER_02: It's written for that.
24:27
SPEAKER_02: I mean, it's all throughout it.
24:28
SPEAKER_02: So if you bother to read it, you can see that, right?
24:33
SPEAKER_02: So we just let people know that, hey, look, this is...
24:38
SPEAKER_02: what I just said, it's made for ongoing management, monitoring, and maintenance.
24:43
SPEAKER_02: There's no putting something in place and being done with it.
24:46
SPEAKER_02: It's like a, and really, to tell you the truth, any IT, this is not necessarily, this is not strictly IT, of course, but there is a technical component, but in IT, people just want stuff put in.
25:02
SPEAKER_02: They don't want to have to manage it, they don't want anything, and that's that is really doing a disservice because there's no updates being done, there's no monitoring being done.
25:10
SPEAKER_02: I can't tell you how many times that we've been called in to somebody new to help out with something, and we go to look at their backups, and we're like, you know, your latest backup you have is eight months old.
25:23
SPEAKER_02: It's been backing up, and they set it up to backup.
25:27
SPEAKER_02: Yeah, but it failed here.
25:29
SPEAKER_02: And it's been failing ever since.
25:30
SPEAKER_02: Did you check it?
25:31
SPEAKER_02: Well, no, we didn't check it.
25:33
SPEAKER_02: So that's what this is written for.
25:36
SPEAKER_02: It's for ongoing maintenance, monitoring, ongoing care and feeding.
25:42
SPEAKER_02: And so that's what this whole thing is about.
25:45
SPEAKER_02: And so you've got to understand that.
25:49
SPEAKER_02: It can't just be one and done.
25:50
SPEAKER_02: Now, somebody like us can come and put everything in place for you, but then you have to go manage it and that's fine as long as you take care of it and all that kind of fun stuff.
26:03
SPEAKER_02: But somebody has to manage that, whether it's you, whether it's Fred down the street, That might not work, but anyway, no matter who it
26:11
SPEAKER_03: is, somebody has got to take care of it.
26:13
SPEAKER_03: And that would take form of approved patches written down, confirmed that it took place, that it was installed.
26:20
SPEAKER_03: That would take form in the fact that there is record of a log being reviewed and a result, whether it's remediation or otherwise, happening.
26:32
SPEAKER_03: That would take place in someone looking at the antivirus system that you have and doing necessary steps there looking at potential false positives that would look like someone going on all the computers performing maintenance and then logging and recording it right so those those are actions that have to happen you would have to use someone existing on your staff and give them those new additional duties hire someone internally to fill that that those new shoes or hire it out to a contractor to complete them for you but regardless they have to happen
27:08
SPEAKER_02: absolutely uh and you know to step back from technical a little bit you know what about your uh authorized user device and process list you know the work exactly yeah isn't that an active directory no it's not it's That could be part of it, but that's your identification, not your authorization list.
27:27
SPEAKER_02: So who reviews that?
27:29
SPEAKER_02: How often do you do it?
27:30
SPEAKER_02: Is it documented?
27:32
SPEAKER_02: What about...
27:34
SPEAKER_02: your sign-in sheet for people visiting your facility.
27:37
SPEAKER_02: Do you have those?
27:39
SPEAKER_02: Do you keep them?
27:41
SPEAKER_02: Where do you document them?
27:42
SPEAKER_02: What happens with those?
27:44
SPEAKER_02: That's ongoing.
27:46
SPEAKER_02: What about vulnerabilities?
27:50
SPEAKER_02: Is there somebody that watches for vulnerabilities to come out?
27:53
SPEAKER_02: Is there any kind of documentation?
27:56
SPEAKER_02: There's all sorts of stuff that has to happen on a scheduled basis or a routine basis.
28:01
SPEAKER_02: It's scheduled also, but on a routine basis.
28:04
SPEAKER_02: the whole ongoing therapy.
28:06
SPEAKER_03: Right.
28:07
SPEAKER_03: And there's a lot of low-hanging fruit.
28:10
SPEAKER_03: Things like Susie at the front desk can now be in charge of the sign-in sheet and she records it a certain way and that's an easy offload to an existing role.
28:18
SPEAKER_03: And she's in charge of if somebody doesn't sign in, she goes and tackles them.
28:21
SPEAKER_03: Right.
28:22
SPEAKER_03: But then there's a whole slew of new traditional duties that are not easily assigned to existing seats.
28:31
SPEAKER_03: Correct.
28:33
SPEAKER_03: And that's mandated by the compliance itself.
28:36
SPEAKER_03: So we bring all that up, not necessarily to scare you, although it may, but really to get at the point of how this episode started out, whether or not you're actually an S-800-171 compliant.
28:48
SPEAKER_03: And those are...
28:49
SPEAKER_03: some gut checks that you can do to yourself to determine whether or not you might be compliant so um really what we're trying to do is generate a little self-assessment for yourself so that way you are empowered to know whether what camp you might be in there right and so if uh you checked Yes to all those boxes.
29:10
SPEAKER_03: All that all sounds like stuff I'm doing.
29:12
SPEAKER_03: Fantastic.
29:12
SPEAKER_03: You are doing phenomenal.
29:15
SPEAKER_03: If anything like that sounded like maybe not, I want to make sure we provide some actionable takeaways that those people can go forth with and do to maybe get themselves from not compliant today to a little bit further down that path.
29:32
SPEAKER_03: So what are some actionable takeaways that a listener at home might do to...
29:38
SPEAKER_03: to get more compliant.
29:40
SPEAKER_02: Technically, first things first is what I mentioned earlier, is to identify your type of CUI you're trying to protect in the data flow diagram, right?
29:50
SPEAKER_02: But really, the next step is to do a full gaps analysis.
29:55
SPEAKER_02: Make sure that you know where you're at right now.
29:58
SPEAKER_02: And truly where you're at, not just, oh, yeah, yeah, sure, we do that.
30:02
SPEAKER_02: But you've got to go through every single one of the 320 objectives and and say, do I meet this or do I not meet it?
30:11
SPEAKER_02: How do I meet it?
30:12
SPEAKER_02: What is lacking if I don't meet it?
30:15
SPEAKER_02: Go through every single one of those.
30:17
SPEAKER_02: And by the way, if there's five, for instance, if there's five assessment objectives underneath one control, then if you meet four of those and you don't meet one, it's not complete yet, that control is not met.
30:37
SPEAKER_02: So, I mean, it's that simple.
30:40
SPEAKER_02: You've got to meet all those assessment objectives underneath the control for that control to be met.
30:47
SPEAKER_03: But, yes.
30:48
SPEAKER_03: Sorry to hop on that train of thought is, I believe, and you're going to have to correct me, but the Existar website has an SPR self-assessment website.
31:00
SPEAKER_03: tool or PDF or Excel sheet I think that's available that you could use for free to assess yourself and I think There's something available from NIST maybe as well, like how to conduct a self-assessment and GAPS assessment.
31:19
SPEAKER_03: Isn't there a couple of resources out there that they could go just download for free without putting their information in?
31:24
SPEAKER_03: Yeah, absolutely.
31:25
SPEAKER_03: I mean,
31:25
SPEAKER_02: there's all sorts of spreadsheets out there that you can download.
31:30
SPEAKER_02: And the best thing to do really, if you're starting out trying to figure out where you're at, is to download that NIST 800-171-A.
31:39
SPEAKER_02: That's the assessment guide.
31:42
SPEAKER_02: And so do that.
31:43
SPEAKER_02: The level two assessment guide is level one and level two for CMMC.
31:49
SPEAKER_02: But you download that assessment guide and go through it and fill out, you know, do I meet this objective?
31:56
SPEAKER_02: Do I meet that objective?
31:57
SPEAKER_02: And go through every single one.
31:59
SPEAKER_02: And then from that assessment, from that gaps analysis, Then you can say, these are all the ones I don't meet.
32:11
SPEAKER_02: And then you start grouping them together and you list them out.
32:14
SPEAKER_02: Here's my POAM.
32:14
SPEAKER_02: I got to finish all these, right?
32:16
SPEAKER_02: And so that's your POAM, your plan of action and milestones.
32:20
SPEAKER_02: And so it's your plan to get everything done, right?
32:22
SPEAKER_02: So you list out all that.
32:25
SPEAKER_02: You try to group those together into projects.
32:31
SPEAKER_02: And from there, you can start guesstimating outcomes.
32:34
SPEAKER_02: Estimating, estimating your amount of time and effort involved in each one of these, the cost involved.
32:40
SPEAKER_02: Estimating is just a confident estimate, by the way.
32:45
SPEAKER_02: Yes, yes.
32:46
SPEAKER_02: So you can divide it out then.
32:48
SPEAKER_02: Once you have your POAM divided up into projects and you know your time involved, the effort amount involved, the complexity, the cost, and the priority on each one of these, And maybe you look at these and you add up the number of points it's going to add for each one of these projects you complete.
33:12
SPEAKER_02: And so you know where your SPRS score goes each time that you complete something.
33:17
SPEAKER_02: So that may be something important for you to do.
33:19
SPEAKER_02: But once you get that project list created, then you can start cranking out those projects.
33:26
SPEAKER_02: Get some quotes, get prices to it, and start doing that.
33:30
SPEAKER_02: But really, it starts with a good gaps analysis.
33:33
SPEAKER_02: Everything can be built out from there.
33:35
SPEAKER_02: And do it by assessment objective, not just by control.
33:41
SPEAKER_02: You can do it by control, but you're still going to have to take each of the objectives into account anyway.
33:47
SPEAKER_02: Save your brains and processing power and go by objective.
33:50
SPEAKER_02: Yeah, just go through each one of those.
33:52
SPEAKER_02: But yeah, that's what I would suggest is that that gaps analysis is going to be key.
33:58
SPEAKER_02: Another thing that you really need to do, say what can they do today to get started, aside from the Data inventory, basically, like I said, and the data flow diagram.
34:10
SPEAKER_02: You do your gaps analysis.
34:12
SPEAKER_02: Very important to do that by objective, assessment objective.
34:16
SPEAKER_02: It's also important to make sure that you have decision makers involved in this.
34:21
SPEAKER_02: It can't just be your IT guy.
34:22
SPEAKER_02: It can't just be a quality guy saying, hey, here's all this stuff, and here's all this stuff we've got to spend money on, because the C-level guys are going to be going, we need to spend all that money.
34:34
SPEAKER_02: Surely we don't, you know?
34:37
SPEAKER_02: So you really need to have some decision makers involved so these projects have legs and so you can get it done.
34:45
SPEAKER_02: Because that's very important.
34:46
SPEAKER_03: Otherwise it just becomes a justification like...
34:51
SPEAKER_03: sort of situation.
34:53
SPEAKER_03: Why do we have to spend this much?
34:55
SPEAKER_03: But if you put someone that's a decision maker to go in, then it's like, okay, we have to because...
35:02
SPEAKER_03: If they're involved in
35:03
SPEAKER_02: that project, involved in drawing all that out, then it's pretty much assumed that you've got to go through this, you've got to get it done.
35:12
SPEAKER_02: If you want to become compliant, there's always the
35:13
SPEAKER_03: option not to,
35:14
SPEAKER_02: right?
35:14
SPEAKER_02: Right, right.
35:15
SPEAKER_02: And the other thing along with that to keep in mind, again, is what we just talked about, is that it This is ongoing.
35:24
SPEAKER_02: You'll do this if there's any changes.
35:26
SPEAKER_02: You're going to have another poem.
35:28
SPEAKER_02: This is an ongoing process.
35:32
SPEAKER_02: There's several things that have to be completed periodically and managed ongoing.
35:37
SPEAKER_03: Well, Brooke, do you have anything else for us?
35:40
SPEAKER_03: I think that pretty well covers it for this episode.
35:42
SPEAKER_03: Okay.
35:43
SPEAKER_03: Awesome.
35:43
SPEAKER_03: We'll be at DivCon June 2nd or 3rd, I think.
35:47
SPEAKER_03: Google it.
35:48
SPEAKER_02: It's June 3rd through 5th.
35:50
SPEAKER_02: DivCon in...
35:51
SPEAKER_02: Oklahoma,
35:51
SPEAKER_03: the beautiful big city bright lights of Oklahoma City.
35:54
SPEAKER_03: If you want a shirt, Documentation, documentation, documentation shirt.
35:58
SPEAKER_03: I promised Brooke that we wouldn't put his face on there, so sorry.
36:03
SPEAKER_03: We couldn't give him away if you did that.
36:08
SPEAKER_03: But we'll have the shirts, so stop and see us there.
36:12
SPEAKER_03: We'd love to meet you.
36:15
SPEAKER_03: Otherwise, if you have questions about what we covered, please reach out to us.
36:18
SPEAKER_03: We're here to help fast track your compliance journey.
36:21
SPEAKER_03: Text, email, or call in your questions.
36:23
SPEAKER_03: We'll answer them for free.
36:25
SPEAKER_03: He You can find our contact information at cmmccomplianceguide.com.
36:32
SPEAKER_03: Stay tuned for our next episode.
36:34
SPEAKER_03: Until then, stay compliant and stay secure.
36:37
SPEAKER_03: Like, subscribe, and share.