Defending your CUI/CDI infrastructure with an improved Security Operations Capability
DFARS/NIST compliance is hard
We are hearing more and more from our customers every day that they are being required to attest to their DFARS compliance status and all indicators are that these requirements are continuing to expand to civilian agencies as well. The most common NIST SP 800-171 security control requirement gap we find with our customers is the lack of a security operations capability.
A solid security operations capability is the foundation for a strong cyber security posture and helps you meet more than 70% of the NIST SP 800-171 security requirements. Many organizations understand the importance of cyber security in their day-to-day business operations but struggle to implement the necessary security controls and team to maintain a secure CUI/CDI infrastructure.
To properly secure an organizations IT Infrastructure, on top of installing and managing firewalls and endpoint security, they need to implement a solid security operations capability that has the people, processes and tools that can remove vulnerabilities, maintain configurations, detect threats and unusual activities as they occur in their infrastructure. Unfortunately, for many organizations when they are looking at improving their security operations capability, they are looking at just the tools and there are cost effective tools in the market place. However, the tool is only part of the solution, I would argue that organizations need the defenders (People and Processes) more so than just the tool. Tools in the hands of untrained staff, will be unused, unwanted and will not provide the benefit of a turnkey solution.
Outsourcing can be your first choice to meet DFARS/NIST Requirements
Many organizations are outsourcing this very specialized skill set to a team of cyber security experts who are defending and responding to many security events for many customers every day, is a very cost-effective way to defend your CUI/CDI infrastructure. For example, we developed InfusionPoints’ Virtual Network and Security Operations Center 360° (VNSOC360°) with US Government Contractors in mind;
- We have the people, processes, and tools to defend your CUI/CDI infrastructure;
- All of InfusionPoints’ staff members are US citizens with strong background investigations;
- We have developed a set of proactive troubleshooting and incident response processes which meet all DFARS/NIST requirements; and
- Operations are conducted 24/7/365 in Western North Carolina.
Our state of the art VNSOC360° facility, leverages the best of breed decision support tools that assist our VNSOC360° analysts and provide information for our processes to better prioritize security events as they occur.
InfusionPoints’ VNSOC360° capabilities map to NIST SP 800-171 controls
| Security Control | Directly Meets NIST SP 800-171 controls | Supports NIST SP 800-171 controls |
|---|---|---|
| Firewall Management | 3.1.1, 3.1.3, 3.1.12, 3.1.14, 3.1.16, 3.1.17, 3.1.20, 3.1.22, 3.13.1, 3.13.2, 3.13.4, 3.13.5, 3.13.6, 3.13.7, 3.13.8, 3.13.9, 3.13.13, 3.13.14 | 3.13.11, 3.14.2, 3.14.4 |
| Audit and Accountability | 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.4.3, 3.4.9, 3.14.1, 3.14.3, 3.14.6, 3.14.7 | 3.1.1, 3.1.2, 3.1.3, 3.1.8, 3.1.12, 3.1.21, 3.1.22, 3.4.7, 3.6.1, 3.6.2, 3.6.3, 3.12.3, 3.13.1, 3.13.2, 3.13.3 |
| Threat and Vulnerability Management | 3.2.1, 3.2.2, 3.2.3, 3.11.1, 3.11.2, 3.11.3, 3.12.1, 3.12.2, 3.12.4, 3.14.1, 3.14.2, 3.14.4, 3.14.5 | 3.7.4 |
| Incident Response | 3.6.1, 3.6.2, 3.6.3 | |
| Configuration Management | 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.13, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.5.6, 3.5.7, 3.5.8, 3.5.9 | 3.13.2, 3.13.3, 3.13.7, 3.13.16 |
Bottom line, US Government contractors need to improve their cyber security posture and DFARS 7012 compliance, by deploying the right tools, training your people how to use the tools properly, and developing the processes necessary to incorporate the tools into an overall DFARS/NIST Cyber Security Program…Or better yet, hire an expert team of professionals to support your needs.
