In this episode, Nathan Sirois from Balsam Technologies talks about CMMC self-assessments, NIST SP 800-171, and why Massachusetts defense suppliers should review cybersecurity gaps, vendor access, documentation, and compliance responsibilities. He also explains how organizations can move from an initial assessment to practical safeguards and documentation.
John Maher: Hi, I’m John Maher, and I’m here today with Nathan Sirois, Support Engineer at Balsam Technologies, a managed IT services company based in Gloucester, Massachusetts, offering cybersecurity, IT infrastructure, network support, cloud migrations, data backup, and more. Today we’re talking about CMMC Self-Assessments and NIST 800-171: What Massachusetts Defense Suppliers Need to Know. Welcome, Nathan.
Nathan Sirois: Hey, John. Thanks for having me.
Understanding CMMC and NIST SP 800-171
John: Absolutely. Nathan, for business owners who are unfamiliar with these terms, what are CMMC and NIST SP 800-171 revision 2, and what Massachusetts businesses should be paying attention, including smaller companies that supply larger defense contractors?
Nathan: So the CMMC standards are basically standards that are being implemented nowadays for anyone in the manufacturing industry that’s handling controlled unclassified information related to any sort of government work or government contracts. And over the last couple of years, the NIST framework has been developed for the CMMC standards that are now going to be required in the next coming year or couple of years for anyone manufacturing for the Department of Defense or other government contract related work.
And so when you’re facing these sort of standards, you’re going to need some assistance in getting compliance set for these pretty strenuous standards that the Department of Defense is requiring for most organizations in the manufacturing space.
What a CMMC Self-Assessment Involves
John: Okay. What does a CMMC self-assessment actually involve and how can a business determine which requirements apply to its contracts and whether a self-assessment is the appropriate path?
Nathan: So what it actually involves is basically there’s a 110 point, I wouldn’t say “survey”, but an actual set of standards that your organization is reflected against and compared against for whether you’re in compliance or not for the CMMC requirements that the government has for you. Now, for your organization to actually be CMMC compliant, you only need to pass for 88 of those standards or points. There’s different points assigned to different types of cybersecurity improvements.
So with any organization trying to figure out how to get certified and fully compliant, it’s important to take into account which standards are directly knocking you down for points and how to actually gain those points back so that you can be fully compliant. And then once you’ve actually implemented that full compliance for your organization, you need to receive an actual formal audit from a third party to verify that you are CMMC compliant.
Common Cybersecurity and Documentation Gaps
John: And when you start working with a defense supplier, what cybersecurity and documentation gaps do you most often uncover and what might a business be overlooking?
Nathan: So the largest place that we tend to see issues with the CMMC standards especially falls under external access. So if you have some government contracting that you’re doing and you’ve got contacts that might have external access to your systems, maybe some of them are compliant, maybe some of them aren’t. And so, we tend to find that there’s a lot of issues, especially with that and taking into account who your vendors are, how they’re accessing your systems if they are, and making sure that those specific areas and loopholes are closed off beyond just for compliance, also for your own business’s safety and to avoid any compliance issues for you not having vendors that meet the CMMC standards.
So that’s probably the largest area that we tend to focus on for the business’s wellbeing. And then there’s generally for most CMMC audits that we conduct and implement for anyone that approaches us needing compliance, there’s about probably 50 to 60 of the 88 points that are pretty standard, harmless either backend compliance or cybersecurity implemented changes that we can make for you, or just ones that are going to have a minor impact on your actual organization.
At the end of the day, being fully compliant, it does require a little bit of complications to your organization and there’ll be a little bit of overhead that is needed now to meet government standards, but it’s well worth it for the safety and to make sure that you don’t lose any valuable contract work that you’re doing for any sort of Department of Defense or government organization that requires those standards.
Moving From Gap Analysis to Cybersecurity Readiness
John: Sure. Balsam Technologies recently announced expanded support for cybersecurity readiness and organization led self-assessments like these. How do you help a client move from identifying gaps to actually implementing safeguards and preparing documentation? And what are some of the responsibilities that still remain with the client?
Nathan: So with actually identifying gaps for clients, we conduct regular cybersecurity assessments. And what that involves is not only just a basic audit of your systems and what needs to be protected, but we do direct penetration testing, which means that we’re using programs that are designed to be able to figure out all the loopholes for the specific products or software that you’re using, hardware vulnerabilities that are known across the internet, and just basically anything that a hacker would have access to potentially due to just vulnerabilities that haven’t been assessed or repaired by whatever manufacturer or product producer that you’re using for certain items in your organization.
So in addition to conducting all of that penetration testing, probably the largest element of the auditing that we end up doing for the client and helping them with is actually forming a full WISP, which is a Written Information and Security Protocol set of standards, which for any larger organization or even smaller clients, or people just looking to become compliant, it’s really important that you have a written out set of standards for…say I end up having a phishing email that comes through, I was prepared, but I clicked on something I shouldn’t have, now I’ve been hacked and there’s ransomware on my device or our servers or something and we need access to them. What do we do? How do we respond?
It might seem pretty cut and dry that, “oh, well, we’re going to work with our IT provider and we’ll see if we can get access and just do whatever we can to actually get the hackers out.” But what most organizations don’t really understand is it’s not all going to be big hacks like that. And to actually prevent those hacks from happening, it’s really important that you do have a written up security policy for your entire organization so that hopefully you can avoid any sort of actual threats getting into your organization just by the standards that you’ve agreed to prior to facing any actual threats.
What a WISP Covers in Cybersecurity Planning
John: So the WISP book will kind of walk through these different scenarios. If this happens, this is what you should do. If this happens, then do this. And it’s just a set of standards that you’ve implemented for the clients so that they know what to do in certain situations.
Nathan: Yeah. And in addition to that, it’s also a set of ongoing operating procedures for the organization. So it’s not just we get hit with a hack in this way or somebody lost data in this way, what do we do? It’s also like how are we going to be maintaining our data? How are we going to be staying secure? What are the different protocols and sets of software that we’re going to have standard throughout our organization to protect ourselves?
So it’s a pretty large breadth of things that are covered under a WISP for most organizations. And really without outside assistance to help your org with that, it’s really hard to develop a robust WISP on your own when you may not even know how to conduct an audit of certain areas of your business or you don’t know what areas of it fall under something that should be WISP related. So those are all the things that go into it.
Prioritizing CMMC Compliance for Smaller Businesses
John: For a smaller business concerned about the cost or time or the disruption involved, what should the first step be and how do you help prioritize the work that needs to be done in order to comply?
Nathan: So like I mentioned before, with any sort of compliance that you’re going to undergo or auditing, there will be some amount of disruption. The reality of it is that you’re trying to put procedures and protocols in place that are going to directly disrupt the hacker or somebody wanting to have some sort of malicious impact on your business. And ultimately there has to be additional guardrails and boundaries that you’re putting in to protect against that.
Now, like I mentioned with the CMMC audit, there is 110 points available, you only need 88. And depending on your organization, you might have certain standards that are less disruptive to your organization or more. If you’re a manufacturer that does machining and you’re constantly having a lockout policy, let’s say on your Table 1 device, and that’s just super obnoxious for whoever you have working there and it’s directly impacting the level of, or maybe the quality of, the product you’re able to output or the quantity.
And so maybe you don’t want to have that as a standard in place, but you could also have some sort of fully automated manufacturing thing where you’re not requiring… Somebody isn’t required to keep turning on a device, and off, and it’s fine if it’s just sort of running in the background and going for you. And so maybe that’s one standard that you’d want to put in place and get those points.
But regardless, for anyone just looking for the baseline CMMC standards, it is pretty important that you have somebody go through it with you just because 110 possible points is a lot of different changes you can make to your organization. And depending on certain changes you make, it can negatively impact others. You are able to get the full 110 points and have that full set of security standards in place.
But for most organizations, there’s really no need to have that full point rating as that extra couple of points. It could have a lot of impact on your organization for actual time loss and just headaches. So definitely worth taking a full look into the whole audit before you start making any changes and start with a strategy.
John: All right. Well, that’s really great information, Nathan. Thanks again for speaking with me today.
Nathan: Yeah, happy to speak with you, John.
John: And for more information, you can visit the Balsam Technologies website at balsamtechnologies.com or call 978-281-3339.