As the CMMC Churns

Hello, and welcome to “As the CMMC Churns.” I’m Matt Titcombe, the President of Peak Infosec, an authorized CMMC 3rd Party Assessment Organization. This episode of “As the CMMC Churns” is “Organization-Defined Parameters. I know this is not a fun-filled, sexy, hot topic.
But it’s a critical one, especially as we’re all about ready to start transitioning to NIST SP 800-171 Revision 3.
So let’s talk about what organization defined parameters are, and as you all know, any point after this is now no longer scripted, so what happens is happening. So let’s have fun.
All right. So what is an organization-defined parameter or ODP?
And you’ll hear me just say ODP because that’s what we’re going to be talking about. So this is a variable part that was introduced in NIST SP 800-171 Rev 3 after it was first introduced in Rev 5. Again, we go through that cycle.
The federal government revises 800-53 as the overall security catalog. That flows into 171.
So when we get to 800-53 Rev 6, there’ll be 800-171 Rev 4. It’s kind of the process, the way we’re going. So they inserted in 800-53 that variable part, which is good. They made changes that make sense as a part of this, and it helps to clarify things for everybody so we all know what we’re looking at, what we’re really doing when it comes to context of this.
Now, the next question you’re going to ask is in this variable, well, how many are there? Well, okay, let’s talk about 800-171 Rev 3. There’s 510 assessment objectives.
Okay. Right there was a CMMC seven stages of grief, so don’t panic. Well, okay, maybe panic a wee bit.
Out of that 510, there’s 88 ODPs. So that’s specifically where is a C3PAO, or you’re defining exactly what that would be. Ninety-nine of those 510 then have dependencies upon those 88 ODPs. So if you don’t get those 88 right, you don’t get 99.
And then there’s a unrelated 323 assessment objectives that are just you doing stuff that you need to do.
Now, in comparison to Rev 2, out of that 320 assessment objectives, there’s 20 to 21 implicit ODPs. There’s one that was surprising was not classified as an ODP. I probably would have done one.
But how do ODPs work? All right. So let’s walk through this, and this will really help you understand the way ODPs work.
So at first, an ODP is that variable that’s going to be defined by NIST. So on the left column, you see what they need to do.
On the right column, you see the definition. And now this is coming out of 3.13.09 in 800-171 Rev 3 for network disconnection.
And we’ll use this example as we keep going through.
So they’ve defined that’s the ODP.
Well, the next step is the organization needs to define what it should be.
In this case here, the no longer 15 minutes is what the Department of War has defined currently as the definition for that ODP.
Okay?
So then that organization now is required to insert it into the control, which now means, okay, you now need to execute this and go through this process of no longer than 15 minutes of inactivity.
So we can see that blob gets blocked right into there.
And then you’re off and going and running to go and implement that security control, that paragraph three part right there, on all of your in-scope components.
And then document it and approve it and do all the other stuff that you need to do per your configuration management practices.
That’s the way the ODPs work. Pretty straightforward.
Now, the interesting part is ODPs, and we’re going to pull that requirement apart a little bit further, is in 800-171 Rev 3, they became explicit.
800-171 Rev 2, they were kind of implied.
So when we look at that same security requirement, you see that they’ve defined, and that A in front, by the way, tells you we’re looking at assessment objectives when you look at that Rev 3 column.
And then you see the A in brackets. So it’s the shift of the way they handle these. So you see that there’s a requirement there to define.
Now, this is an explicit pull-out.
The way this works is then Bravo was a requirement that existed in 171 Alpha Rev 1, but they merged that Bravo and Charlie into what is now in 800-171 Rev 3, A.03.13.09.
And now you see that ODP has now been blended into the control requirement. So we took what was implicit from Rev 2, and we basically made it explicit. So every time when you’re going through an assessment with a C3PAO against Rev 2, this is why we’re asking, where did you define that? Because it’s an implicit organization-defined parameter.
So who can define ODPs? Well, ultimately, NARA as the CUI executive agent per 32 CFR Part 2002 is the first right of ownership to define them.
Now, then the federal agency, for example, Department of War, has established the ODPs, and then the agency underneath them can then supplement or strengthen, and then whatever’s left over, they don’t specify for you or give you guidance to, then you get to decide what you want to do.
Now, the reality is DoD has already, or DoW, has already come out and published a guidance on this.
And so yes, they may be the federal standard. So let’s talk about what is now in the draft FAR CUI rule that may be published tomorrow after we publish this publication.
We may need to revise this one.
So the draft FAR clause in 52.240-7, Controlled Unclassified Information, paragraph (d)(3)(ii)(B), states that you’ve got to comply with the security requirements 800-171 Rev. 3, and the organization-defined parameters posted at the DoD CIO’s webpage, and that’s how you must comply. Now, likewise, we provided the link here to the Federal Registry draft CUI rule for this, so that way you’ve got that for your reference.
This is one of the core problems that we’ve got right now is that you’re going to find, as we dig into this a little bit here and then in subsequent As the CMMC Churns, where there are issues within those ODPs.
So on that note, let’s talk about those issues. Yes, they are there. Unfortunately, when DoD/DoW wrote these, they were written only for computers, servers, networking, and classic IT, and maybe cloud service providers.
Okay. They do not understand technology.
They do not understand the limitations that are out there.
They do not understand what they did.
They also did not account for mobile devices, Internet of Things, industrial control systems, and your operational technologies.
Yes, there are significant gaps in what they perceived when they wrote these. Now, when they drafted this, there was no provision whatsoever to say, “Oh, this applies only to this class. You’re responsible for figuring this out.” Because there’s no provision for that, and it’s just per that regulation, you go back to that FAR clause, you must apply them.
Crap.
This sucks.
Now the real issue is this may force you as the business to choose between real-world safety. There are some serious concerns with these when I come in working with clients that have got major industrial control systems and operational technologies from a safety point of view.
You take this beyond even the DIB to the–this gets applied to manufacturers that are working underneath medical devices and other things.
You may actually have other things that other laws and regulations that are now in contrast. So now you got to choose between your employee safety potentially and ODP compliance.
Yes.
They did not think about this beyond themselves, and there’s huge problems in there.
Now, so what do you do with those problems?
Well, first, you need to go through and analyze those ODPs against your industrial control systems, IoT, and OT components.
You’ll see related to this post, we have a draft 800-171 system design parameters plan for Rev. 3. Use that to document this. Use that to start to understand where you’ve got issues. Now, document those deviations and why.
Use that plan to document it. Make sure you’re identifying any Food and Drug Administration, OSHA safety requirements, anything else where other laws, regulations, and government-wide policy requirements are causing you to legally have to deviate.
And on top of that, document your technical platform limitations. One of the things we’ll talk about in a later Churns, for example, is the password complexity is mandated to be 16 characters. You can’t do 16-character passwords on an iPhone.
Come on, guys.
Document this as an enduring exception with your system security plan. And as applicable, submit a waiver request to the DoW CIO at that email address.
Please inundate them because that’s the only way they’re going to learn about their stupidity.
So let’s sum up.
ODPs were added to 800-171 Rev. 3 because they got added to 800-53 Rev. 5.
And they were implicit originally, but now they’re explicit, and as a part of that, they also got happy.
There is now 88 explicit ODPs. So we’ve basically quadrupled the number of parameters you’ve got to document and work in when you go to Rev. 3.
So DoW published its ODP standards, and they may become the new federal standard. So if you’re watching this and you’re thinking about how this applies to all of your other systems, universities for financial aid information, start considering this.
Now, those ODPs have significant problems when applied to mobile devices, industrial control systems, IoT, and operational technologies within the DIB, and even more so outside of the DIB.
And then ultimately, that was this as the CMMC Churns. So again, I appreciate you guys joining us for this Churns.
We will have more Churns items on the ODPs as we go forward.
Likewise, you’ll also find the information available for you regarding our plan within the post on this. Thank you.