Does your business have CMMC-defined “Specialized Assets”? Are you struggling to determine how to apply NIST SP 800-171 requirements to them?
In this “As the CMMC Churns,” we take a look at “Specialized Assets,” or when broken down, government property, Internet of Things (IoT) devices, Operational Technology (OT), Restricted Information Systems, and Test Equipment and how to apply NIST SP 800-171 scoping to them and then tactics to secure them.
This episode builds on two previous Churns episodes:
1. How to apply the NIST SP 800-171 Scope of Applicability (https://peakinfosec.com/as-the-cmmc-churns/as-the-cmmc-churns-nist-sp-800-171-scope-of-applicability/)
2. The Three Descoping Methods (https://peakinfosec.com/as-the-cmmc-churns/as-the-cmmc-churns-the-three-descoping-methods/)
We also reference the NIST SP 800-171 and CMMC Level 2 Assessment Scoping Process Diagram at https://peakinfosec.com/information-security/compliance/nist-sp-800-171-and-cmmc-level-2-assessment-scoping-process-diagram/.
Key CMMC Organizations
- National Archives & Records Administration Controlled Unclassified Information (CUI) Homepage
- DoD CIO’s Cybersecurity Maturity Model Certification (CMMC) Home Page
- Cyber Accreditation Body (Cyber-AB)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) Contractor Resource Page
- Defense Industrial Base (DIB) Cybersecurity Portal
Key Regulations
Key Acquisition References
- 48 CFR § 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems
- DFARS Clause 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls.
- DFARS Clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.
- DFARS Clause 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements
- DFARS Clause 252.204-7020 NIST SP 800-171 DoD Assessment Requirements.
- DFARS Clause 252.204-7021 Compliance with the Cybersecurity Maturity Model Certification Level Requirements.
