Information Security Resources
3.3.3, Review and update logged events
Did you know that NIST SP 800-171's 3.3.3, Review and Update Logged Events, is a commonly and THOROUGHLY misunderstood requirement? Let's be blunt, 3.3.3 has NOTHING to do with identifying potential events that indicate a compromise. If [...]
3.3.1, System Auditing
Organization's struggle with documenting NIST SP 800-171's 3.3.1 System Auditing, especially when they are using Commercial Off the Shelf (COTS) software or cloud services. Like all of the other As the CMMC Churns Understand the Requirements series, [...]
All of the Assessment Types
All of the Assessment Types A PDF version of this "Greenhorn's Guide to All of the Assessment Types" can be downloaded here: https://peakinfosec.com/wp-content/uploads/2024/05/All-of-the-Assessment-Types.pdf A Conformity Assessment??? What is an assessment? If your organization is involved [...]
3.1.22, Publicly Accessible Content
Is your organization struggling with NIST SP 800-171's Security Requirement 3.1.22, Publicly Accessible Content? Did you know this is one requirement applies to normally out-of-scope components while the remaining 109 apply to internal components? This As the CMMC [...]
Identifying Inactive Accounts via Sentinel
WARNING: The following whitepaper on Identifying Inactive Accounts via an Azure Sentinel analytic and watchlist is provided as-is with no guarantees of accuracy nor sufficiency & adequacy to fulfill the assessment objectives for 3.5.6, "Disable identifiers after a [...]
3.10.6 Alternate Work Sites
Is your organization struggling to understand how to approach the NIST SP 800-171 3.10.6 Security Requirement for Alternate Work Sites? What is allowed and what an assessor may be looking for? In this CMMC Churns, we dive [...]
The Three Types of Evidentiary Objects
Did you know there are three general types of Examination Assessment Objects in NIST SP 800-171A? Well, we looked at all 879 listed Examination Assessment Objects in 171A and realized there are three main types. There is [...]
Your SSP Sucks, Seriously.
Sorry to tell many of you, your NIST SP 800-171 required System Security Plan (SSP) sucks. As the start of CMMC draws nearer, we are now seeing more SSPs by other companies and, well, they miss the [...]
Requirements have Relationships
I’ll bet you didn’t know the Security Requirements in NIST SP 800-171 have relationships. We see people just jumping into NIST SP 800-171 compliance helping organizations and even CMMC Certified Assessors failing to understand how one requirement [...]
Approve, the Forgotten Verb
Did you know one of the most prolific failures for an organization's self-assessments and those seeking certification during a conformity assessment under Cybersecurity is their documentation? Approvals. For some crazy reason organizations think draft documentation, settings that [...]
32 CFR Part 170 Word Document
Here is the MS Word version of the Draft 32 CFR Part 170, CMMC Program rule: PART_170—CYBERSECURITY_MATURITY MODEL_CERTIFICATION_PROGRAM
CMMC Rule, an Executive Summary
The new Cybersecurity Maturity Model Certification (CMMC) rule was published on 22 December 2023. While many of the "in the weeds" details are new and worthy of later discussion, this "As the CMMC Churns" video focuses on [...]
CUI Litmus Test
Find out about the CUI Litmus test if your organization struggling to identify CUI in your environment. Does your organization know the key tenets to identify CUI? If not, this As the CMMC Churns [...]
Assessors and Toddlers
Is your organization getting ready to undergo a formal Conformity Assessment for NIST SP 800-171? If so, you need to watch this video!!! You need to understand the similarities between Assessors and Toddlers. With the uptick in non-voluntary [...]
3.13.7 and Split Tunneling
Are you trying got understand the 3.13.7 and Split Tunneling Security Requirement in NIST SP 800-171 Rev 2 (and draft Rev 3?? Like all of the requirements, there are nuances in the actual Security Requirement, “Prevent remote [...]
NIST SP 800-171 Rev 3 Draft
DO NOT watch this if you are a Defense Industrial Base (DIB) Contractor. You have real work to do by implementing NIST SP 800-171 Revision 2 versus finding out about the NIST SP 800-171 Rev 3 Draft. [...]
4-Ways to Demonstrate Compliance
BREAKING NEWS from "As the CMMC Churns".... There are now 4-Ways to Demonstrate Compliance. The Cyber-AB, with DoD's implicit blessing, is now allowing Authorized C3PAOs to conduct formal NIST SP 800-171 Assessments for organizations both inside and [...]
Overengineering for CMMC
Are you Overengineering for CMMC? Has your business made the implementation of NIST SP 800-171 harder than it needs to be? Are your employees using one device for CUI work and another for normal work? If so, [...]
VM for Remote Workers
VM for Remote Workers underwent a massive shift due to COVID-19 that changed how the United States and the world operate. It impacted operations and drove changes under NIST SP 800-171/CMMC for remote access and remote workers. [...]
Tips about FIPS Part 2
Has 3.13.11, the use of FIPS-validated encryption, sent your organization through the Seven Stages of CMMC Grief? Does the use of FIPS-validated encryption have you befuddled? Tips about FIPS Part 2 continues address the most common DIBCAC [...]
Tips about FIPS Part 1
Has 3.13.11, the use of FIPS validated encryption, sent your organization through the Seven Stages of CMMC Grief? Does the use of FIPS validated encryption have you befuddled? This is Part 1 on Tips about FIPS to [...]
DIBCAC Gaps
Did you know the Defense Industrial Based Cybersecurity Assessment Center (DIBCAC) posted slides about what NIST SP 800-171 requirements were "Other Than Satisfied"? These are the DIBCAC Gaps. In this episode of As [...]
Apple MacOS and CMMC
Apple MacOS and CMMC??? Does your business use Apple MacOS devices? Do you also have to implement NIST SP 800-171 and be CMMC accredited? Good news!!! Apple MacOS devices can be setup to fulfill NIST SP 800-171 and [...]
Documenting Your Scope
Are looking to understand documenting your scope for your SSP? How does the NIST SP 800-171 Scope of Applicability and CMMC Assessment Scope fit in the SSP? In this At the CMMC Churns, we take the Scope [...]
Social Contact