The Definitive Guide to Compliance with the NIST 800-171 Mandate and Cybersecurity Maturity Model Certification (CMMC)
Because CMMC is to be rolled out gradually, there will be a period where both NIST 800-171 and CMMC will be in effect. Starting in September 2020, CMMC requirements will be included in some RFPs, and by 2026, all new DoD contracts will require CMMC.
Suppliers working under multiple contracts may be complying with NIST 800-171 on some contracts and CMMC on others. There is a direct correlation to NIST 800-171 requirements and Level 3 of CMMC.
No existing contracts will have CMMC requirements inserted into them. The potential for CMMC requirements is only with new future contracts. The certification to win a contract will be needed at the time of the award.
You should think of NIST 800-171 as the foundation for CMMC. There are 14 families of requirements in NIST 800-171 and across the 14 families are a total of 110 individual requirements. CMMC levels 1-3 encompass the 110 security requirements specified in NIST 800-171. There are 171 total practices across the five levels in CMMC.
CUI is defined as information created by the government, or an entity on behalf of the government, that is unclassified, but needs safeguarding. CUI is information that is sensitive and relevant to the interests of the US and potentially its national security, but not strictly regulated by the federal government. This is information that resides on your company’s internal systems. If you are a prime contractor (or a subcontractor), you may be logging into a portal and downloading information (such as a mechanical drawing) that is then stored on your internal systems. You may also see CUI referred to as “Covered Defense Information” — not to be confused with “Controlled Technical Information.”
CUI is Unclassified Information that is stored on “Covered Contractor Information Systems,” which indicates an unclassified information system that is owned (or operated by or for) a contractor and that processes, stores, or transmits covered defense information. In performance of a subcontract, if you anticipate operating a “covered contractor information system,” as that term is defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting, paragraph (a), then ask yourself:
NIST 800-171 provides a set of guidelines that outline the processes and procedures that companies need to implement in order to achieve compliance in regard to controls around CUI. In working with several DoD contractors, Corserva has also seen this information referred to as Covered Defense Information (CDI), formerly described as “unclassified Information which is collected, developed, received, transmitted, used, or stored by or on behalf of the contractor.”
As defined in the National Archives:
Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.
Examples of CUI include email, electronic files, blueprints, drawings, proprietary company or contractor information (such as sales orders and contracts), and physical records (such as printouts). It is important to understand that CUI security requirements are not restricted to digital files; CUI can include paper copies, which are specifically referred to as “printed from an information system which processes or stores electronic files transmitted or stored on servers, desktops, laptops, mobile devices, etc.”
Let’s say that during fulfillment of a federal contract, you receive an email with attached files from the agency with which you are doing business. That information (which is CUI) now resides on your company’s email system (potentially on that workstation’s hard drive) and must be protected. Likewise, if you develop proprietary information for the DoD or for a prime contractor, that information must be protected. If you receive printouts through the mail or by courier service, that information must be protected.
To comply with the NIST 800-171 mandate, companies must undertake a review, or assessment, of their critical systems as they relate to CUI. To become certified to CMMC, companies must select an approved C3PAO to perform an assessment.
Typical systems to include are end user workstations and laptops, servers, storage devices, and network devices such as routers, firewalls, switches, wireless access points (WAP), and printers. Physical security may also need to be addressed.
It can become complex very quickly.
The original NIST Special Publication 800-171 was broken out into 14 different security families of IT security requirements. (In CMMC, the requirements are called category domains and include 17.)
Who is authorized to view this data? How do you control access to the CUI that resides in your organization (within your systems and within your operations)?
Are people properly instructed in how to treat this info? When it comes to CUI, are your employees aware of the security risks?
Are records kept of authorized and unauthorized access? Can violators be identified?
How are your networks and safety protocols built and documented?
What users are approved to access CUI and how are they verified prior to granting them access?
What’s the process if a breach or security threat occurs, including proper notification? If there is an incident that puts data at risk, the DFARS 252.204-7012 clause stipulates that your partner must be notified.
What timeline exists for routine maintenance, and who is responsible?
How are electronic and hard copy records and backups safely stored? Who has access?
How are employees screened prior to granting them access to CUI?
Who has access to systems, equipment, and storage environments? For example, if you have one office with a front door and back door, what kind of security do you have? This could include locks, access control systems, and video monitoring systems. What is the physical environment like within your facility where the data is housed?
Are defenses tested in simulations? Are operations or individuals verified regularly?
Are processes and procedures still effective? Are improvements needed? Penetration testing and vulnerability assessments performed on an ongoing, regular basis are methods for measuring your security.
Is information regularly monitored and controlled at key internal and external transmission points?
How quickly are possible threats detected, identified, and corrected?
Within each of these 14 families are a set of basic security requirements and derived security requirements that must be assessed and verified. Across the 14 families, there are a total of 110 individual line items that must be verified. (For comparison, there can be up to 212 line items for NIST 800-53.)
The requirements for NIST 800-171 can be summarized into four main groups.
If you have a firewall solution in place, you may already have a lot of these areas covered.
Chances are good that you already have some mechanisms in place for ‘control,’ but you may not know what they are, and you may not have implemented best practices in this area. If you have audit records such as system or network device logs specifically focused on access to CUI, you might already be halfway there to meeting the controls requirements. To meet the NIST 800-171 mandate, the controls requirement dictates that you:
To meet the NIST 800-171 mandate, the monitoring and management requirement dictates that you:
A technical design that segregates systems used for CUI can be a cost effective method to achieve compliance. A defined IT system can limit the scope of work to be done.
To meet the NIST 800-171 mandate, the end user practices requirement dictates that you:
There should be comprehensive documentation that describes how CUI is controlled by every department within the company. Computer usage policies and internet usage policies are also helpful.
To meet the NIST 800-171 mandate, the security measures requirement dictates that you:
A lot of cloud based backup solutions do not meet the NIST 800-171 requirements. There are native capabilities within many software systems that, when configured properly, can address these security requirements.
At this point, you might feel as if your head is spinning. But the key points to remember for how to meet the NIST 800-171 requirements are: controls, monitoring/management, end user practices, and security measures. Becoming NIST compliant is not a one-time activity, it’s an ongoing process where you continuously:
Think of it as working towards a goal. Becoming NIST compliant involves documenting a plan, and then working to that plan.
