NIST SP 800-171 Controls: A Manufacturer Achieves 110/110 Score in a DoD Audit

Strict Timelines

The manufacturer was racing against the clock, with a rapidly approaching deadline to submit their bid for the DoD contract. The need to implement complex NIST SP 800-171 controls, conduct thorough assessments, and promptly address any identified gaps within this tight timeframe significantly amplified the pressure. This required not only a meticulous approach but also an efficient process to ensure every task was completed accurately and on time. The challenge was not just about meeting the requirements, but doing so effectively and efficiently under considerable time constraints.

Deployment of Cryptographic Modules

The manufacturer’s environment contained a complex mix of legacy systems and COTS platforms that complicated the integration of new cryptographic solutions. Determining whether encryption tools in use across the varied environment truly met rigorous FIPS validation standards was highly challenging. While the core encryption algorithms may have been compliant, thoroughly assessing whether things like key generation, protection, and management also adhered to FIPS was arduous, given the scale of the environment. The size of the manufacturer’s workforce made training all personnel on properly using new cryptographic tools difficult. 

Deploying Multi-Factor Authentication

Deploying multi-factor authentication (MFA) across the manufacturer’s diverse environment carried high costs due to the scale of systems and users affected. The manufacturer had a complex mix of legacy platforms and modern systems that complicated the integration of new MFA solutions. Modifying login processes on hundreds of endpoints and servers would be disruptive and require extensive testing. The size of the manufacturer’s workforce also made training all employees on using MFA appropriately a massive undertaking. The diverse user roles, devices, and locations further complicated smooth adoption. Implementing MFA in a way that minimally disrupted critical development work required carefully accounting for the manufacturer’s heterogeneous systems and large user base.

Training the Manufacturer’s Workforce

Providing comprehensive and engaging security awareness training to the manufacturer’s large and diverse workforce presented several difficulties. With hundreds of employees in various technical and non-technical roles, devising training that resonated across the organization was challenging. Some personnel saw security training as tangential to their primary job functions. Additionally, continuously training such a large employee base demanded significant resources for content creation, delivery, and effectiveness measurement. Given their varying skill sets, certain topics had to be tailored in a manner that avoids being rudimentary or advanced for various personnel. Keeping security awareness high across the workforce through regular training in the face of these obstacles was critical but required careful planning and creativity.

Putting Incident Response Measures in Place

Meeting the rigorous incident response standards outlined in NIST SP 800-171 and DFARS 7012 was challenging, given the complexity of the manufacturer’s environment and systems. The manufacturer’s mix of legacy systems and specialized development platforms complicated visibility into threats and the ability to mitigate events quickly. Defining comprehensive response plans that accounted for the nuances of diverse systems required significant time, expertise, and resources. Hiring and retaining qualified incident response personnel with expertise to handle incidents in complex technical environments was also challenging. The level of preparation, detection capabilities, analysis, containment, eradication, and recovery mandated by DFARS 7012 demanded a costly and tailored incident response program.

Documenting the Controls

Thoroughly documenting how all 110 NIST SP 800-171 controls were implemented proved challenging for the manufacturer. While technical security measures were in place, developing the policies, processes, and plans to govern control implementation across the enterprise was difficult. The manufacturer lacked resources dedicated to documentation and had few existing compliant policies to leverage. Motivating technical staff to complete documentation rather than focus on development work was also problematic. The scale of the manufacturer’s environment made accurately capturing control implementation in all the various systems a massive undertaking. Lacking centralized documentation made consistent control implementation and demonstration of compliance extremely difficult. Developing comprehensive, accurate documentation required diversion of resources from technical staff’s core functions.