“To Enclave or not to Enclave, that is the question…”
In this “As the CMMC Churns,” we look into “enclaving.” We also look into the most common pitfalls businesses do when making an enclaving decision–falling back into thinking this is an IT problem.
This episode builds on two previous Churns episodes:
- How to apply the NIST SP 800-171 Scope of Applicability (https://peakinfosec.com/as-the-cmmc-churns/as-the-cmmc-churns-nist-sp-800-171-scope-of-applicability/)
- The Three Descoping Methods (https://peakinfosec.com/as-the-cmmc-churns/as-the-cmmc-churns-the-three-descoping-methods/)
Key CMMC Organizations
- National Archives & Records Administration Controlled Unclassified Information (CUI) Homepage
- DoD CIO’s Cybersecurity Maturity Model Certification (CMMC) Home Page
- Cyber Accreditation Body (Cyber-AB)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) Contractor Resource Page
- Defense Industrial Base (DIB) Cybersecurity Portal
Key Regulations
Key Acquisition References
- 48 CFR § 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems
- DFARS Clause 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls.
- DFARS Clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.
- DFARS Clause 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements
- DFARS Clause 252.204-7020 NIST SP 800-171 DoD Assessment Requirements.
- DFARS Clause 252.204-7021 Compliance with the Cybersecurity Maturity Model Certification Level Requirements.
