Did you know one of the most common failures in an organization’s self-assessments and in those seeking certification under Cybersecurity is their documentation?
For some crazy reason, organizations think draft documentation, settings created by IT, or none at all is enough to meet the requirements per NIST SP 800-171A and CMMC guidance.
At the core of this general misunderstanding lies organizations’ missing the verb “𝐚𝐩𝐩𝐫𝐨𝐯𝐞” in:
• 3.4.3, Track, review, 𝐚𝐩𝐩𝐫𝐨𝐯𝐞 or disapprove, and log changes to organizational systems.
• 3.4.5, Define, document, 𝐚𝐩𝐩𝐫𝐨𝐯𝐞, and enforce physical and logical access restrictions associated with changes to organizational systems.
Heck, it even shows up in 3.1.3, “Control the flow of CUI in accordance with 𝐚𝐩𝐩𝐫𝐨𝐯𝐞𝐝 authorizations.”
To make matters worse…yes, worse… when an assessor is given unapproved documentation for a requirement, the requirement is 𝑵𝑶𝑻 𝑴𝑬𝑻.
This episode of As the CMMC Churns looks at the underlying NIST SP 800-171 requirement relationships and, more importantly, how you can go about approving your system configuration documentation.
Key CMMC Organizations
- National Archives & Records Administration Controlled Unclassified Information (CUI) Homepage
- DoD CIO’s Cybersecurity Maturity Model Certification (CMMC) Home Page
- Cyber Accreditation Body (Cyber-AB)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) Contractor Resource Page
- Defense Industrial Base (DIB) Cybersecurity Portal
Key Regulations
Key Acquisition References
- 48 CFR § 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems
- DFARS Clause 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls.
- DFARS Clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.
- DFARS Clause 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements
- DFARS Clause 252.204-7020 NIST SP 800-171 DoD Assessment Requirements.
- DFARS Clause 252.204-7021 Compliance with the Cybersecurity Maturity Model Certification Level Requirements.
