A manufacturer was looking to bid for an upcoming lucrative DoD contract. However, they had to pass the CMMC 2.0 level 2 assessment because the contract involved handling lots of CUI. This meant the manufacturer had to implement the controls under NIST SP 800-171. While they had done a great job implementing the controls, they faced difficulties with some. The manufacturer faced difficulty implementing controls 3.2.1, 3.5.3, 3.13.11, and all the controls under the Incident Response domain. Unfortunately, some of these controls could lead to significant exploitation of the network or exfiltration of CUI. Therefore, they couldn’t be placed under the Limited Practice Deficiency Correction Program for CMMC assessment by a C3PAO. The IR domain controls were also required by DFARS 7012.

Failure to implement these controls could negatively impact the manufacturer’s cyber security and CMMC compliance efforts. They would likely fail the CMMC 2.0 L2 assessment by the C3PAO. It meant that the manufacturer couldn’t bid for the contract, as CMMC L2 certification was a prerequisite. Understanding all this, the they sought the assistance of Cleared System to help with the implementation of the controls above. They also needed the compliance experts to conduct a gap analysis and remediation to better prepare for the assessme

Objectives

  • To help the manufacturer implement controls 3.2.1, 3.5.3, 3.13.11, and all the controls under the Incident Response (IR) domain based on its unique environment and needs through tailored guidance and consulting.
  • To conduct a comprehensive gap analysis to identify areas where the manufacturer’s current practices did not meet the requirements of NIST SP 800-171.
  • To develop and implement a clear remediation roadmap that prioritizes the manufacturer’s implementation of controls to address all the gaps identified, ensuring the implementation of all NIST SP 800-171 controls.
  • To help the manufacturer prepare for the upcoming CMMC 2.0 L2 Assessment by a C3PAO by conducting self-assessments against all the NIST SP 800-171 requirements.

Challenges

Strict Timelines

The manufacturer was racing against the clock, with a rapidly approaching deadline to submit their bid for the DoD contract. The need to implement complex NIST SP 800-171 controls, conduct thorough assessments, and promptly address any identified gaps within this tight timeframe significantly amplified the pressure. This required not only a meticulous approach but also an efficient process to ensure every task was completed accurately and on time. The challenge was not just about meeting the requirements, but doing so effectively and efficiently under considerable time constraints.

Deployment of Cryptographic Modules

The manufacturer’s environment contained a complex mix of legacy systems and COTS platforms that complicated the integration of new cryptographic solutions. Determining whether encryption tools in use across the varied environment truly met rigorous FIPS validation standards was highly challenging. While the core encryption algorithms may have been compliant, thoroughly assessing whether things like key generation, protection, and management also adhered to FIPS was arduous, given the scale of the environment. The size of the manufacturer’s workforce made training all personnel on properly using new cryptographic tools difficult. 

Deploying Multi-Factor Authentication

Deploying multi-factor authentication (MFA) across the manufacturer’s diverse environment carried high costs due to the scale of systems and users affected. The manufacturer had a complex mix of legacy platforms and modern systems that complicated the integration of new MFA solutions. Modifying login processes on hundreds of endpoints and servers would be disruptive and require extensive testing. The size of the manufacturer’s workforce also made training all employees on using MFA appropriately a massive undertaking. The diverse user roles, devices, and locations further complicated smooth adoption. Implementing MFA in a way that minimally disrupted critical development work required carefully accounting for the manufacturer’s heterogeneous systems and large user base.

Training the Manufacturer’s Workforce

Providing comprehensive and engaging security awareness training to the manufacturer’s large and diverse workforce presented several difficulties. With hundreds of employees in various technical and non-technical roles, devising training that resonated across the organization was challenging. Some personnel saw security training as tangential to their primary job functions. Additionally, continuously training such a large employee base demanded significant resources for content creation, delivery, and effectiveness measurement. Given their varying skill sets, certain topics had to be tailored in a manner that avoids being rudimentary or advanced for various personnel. Keeping security awareness high across the workforce through regular training in the face of these obstacles was critical but required careful planning and creativity.

Putting Incident Response Measures in Place

Meeting the rigorous incident response standards outlined in NIST SP 800-171 and DFARS 7012 was challenging, given the complexity of the manufacturer’s environment and systems. The manufacturer’s mix of legacy systems and specialized development platforms complicated visibility into threats and the ability to mitigate events quickly. Defining comprehensive response plans that accounted for the nuances of diverse systems required significant time, expertise, and resources. Hiring and retaining qualified incident response personnel with expertise to handle incidents in complex technical environments was also challenging. The level of preparation, detection capabilities, analysis, containment, eradication, and recovery mandated by DFARS 7012 demanded a costly and tailored incident response program.

Documenting the Controls

Thoroughly documenting how all 110 NIST SP 800-171 controls were implemented proved challenging for the manufacturer. While technical security measures were in place, developing the policies, processes, and plans to govern control implementation across the enterprise was difficult. The manufacturer lacked resources dedicated to documentation and had few existing compliant policies to leverage. Motivating technical staff to complete documentation rather than focus on development work was also problematic. The scale of the manufacturer’s environment made accurately capturing control implementation in all the various systems a massive undertaking. Lacking centralized documentation made consistent control implementation and demonstration of compliance extremely difficult. Developing comprehensive, accurate documentation required diversion of resources from technical staff’s core functions.

Solutions

Strategic Prioritization

Cleared Systems adopted a risk-based approach, utilizing methodologies such as the Common Vulnerability Scoring System (CVSS) to systematically assess and prioritize controls. We conducted in-depth threat modeling using various frameworks to quantitatively rank control deficiencies based on risk severity. Our team leveraged quantitative risk assessments to determine the controls with the highest risk mitigation value. This approach allowed for the efficient allocation of resources to address controls posing the most significant threats to the manufacturer’s security posture.

Cryptographic Module Assessment

Our team performed in-depth assessments of cryptographic modules to ensure compliance with Federal Information Processing Standards (FIPS). We verified the correct implementation of cryptographic algorithms and key management techniques. Additionally, our team facilitated the integration of these modules with legacy systems and Commercial Off-The-Shelf (COTS) platforms, ensuring end-to-end encryption across the manufacturer’s network.

Efficient Multi-Factor Authentication (MFA)

We implemented MFA using a phased approach to minimize operational disruptions. Our team considered the heterogeneity of the manufacturer’s IT infrastructure, accommodating various systems, endpoints, and user profiles. To ensure successful MFA adoption, we provided role-based training tailored to different user groups.

Customized Security Awareness Training

Cleared Systems developed bespoke security awareness training modules tailored to the manufacturer’s workforce. These modules covered various cybersecurity topics, from basic cyber hygiene to advanced threat mitigation strategies. We designed the training to resonate with employees across different roles and departments, fostering a culture of continuous security learning.

Robust Incident Response

Our team introduced an incident response framework based on the NIST SP 800-171, NIST CSF, and DFARS 7012, incorporating incident response automation and orchestration. This advanced approach enabled real-time detection, containment, reporting, and eradication of threats. By implementing threat intelligence feeds and integrating them with Security Information and Event Management (SIEM) systems, our team ensured rapid response and reduced mean time to resolution.

Results

  • The manufacturer successfully implemented all 110 controls outlined in the NIST SP 800-171. This comprehensive implementation not only fortified their cybersecurity infrastructure but also significantly improved their compliance status. This was particularly crucial in light of the upcoming CMMC 2.0 Assessment. The rigorous preparation and successful implementation of the NIST SP 800-171 controls positioned the manufacturer favorably for this assessment, demonstrating their commitment to maintaining the highest cybersecurity standards.
  • The manufacturer achieved DFARS 7012 compliance through a robust incident response plan and NIST SP 800-171 controls. This enhanced their cybersecurity infrastructure and compliance status. If the manufacturer passes the upcoming CMMC 2.0 assessment, they’d be well-positioned to attain DFARS 7021 compliance. This showcases their commitment to maintaining high cybersecurity standards.
  • The manufacturer was able to thoroughly document and effectively manage the 110 NIST SP 800-171 controls. This meticulous documentation not only ensured compliance but also provided them with a streamlined and organized approach to control implementation and management. By achieving comprehensive control documentation, the manufacturer has a solid foundation for ongoing compliance, audits, and security enhancement. This reinforces their ability to secure lucrative DoD contracts with confidence.