Has your business been Hacked?
Follow our Hacked Protocol
If you are certain that you have been hacked, you should follow our protocol:
- Change passwords on all online accounts you still got access to and secure these as fast as possible.
- Ensure that you have secured your main email account, changed the password, implemented a recovery email, and enabled Two-Factor Authentication.
- Let all your friends and family members know that you have been hacked to ensure that they are not scammed by the hackers pretending to be you.
- Do an assessment of which accounts have been hacked and what information the hackers have received about you and your network.
- Do not create a new profile or account on the same platform you were hacked using the same credentials like email or phone number. This makes it much harder to recover your account.
Have I Been Pwned?
‘Have I Been Pwned?’ is an easy-to-use tool for checking your email addresses’ security. | Source: Have I Been Pwned?
5 things your company needs to know about CMMC
The Department of Defense recently announced that contractors who provide products and services for the defense supply chain will be required to comply with the Cybersecurity Maturity Model Certification (CMMC) process beginning in 2020. This new security standard is designed to ensure that contractors have appropriate security measures in place and begin to prioritizing security with equal weight compared to quality and safety. Because CMMC compliance will be critical to winning business with the Pentagon, DoD contractors need to understand what CMMC is all about.
CMMC was designed in the interest of national security, to protect our nations valuable assets from being distributed on the Dark Web.
What is the Dark Web?
“The Dark Web is the invisible, hidden part of the World Wide Web commonly used for the buying and selling of recreational drugs, for totalitarian societies (such as ISIS) to communicate with the outside world, operating organized crime syndicates, human trafficking, corporate espionage, identity theft, illegal trade and media exchange for pedophiles and terrorists.”
– Wikipedia
CMMC Certification Levels and Controls
Representing a unified cybersecurity standard for DoD contractors, CMMC combines a selection of security controls from NIST SP 800-171A, SP 800-181B and potentially other frameworks such as NIST SP 800-53 and ISO 27001. CMMC compliance will be certified by third-party auditors, rather than through self-certification as was allowed for NIST SP 800-171. To address the range of DoD contractors, CMMC comprises five levels of cybersecurity ranging from basic cyber hygiene at Level One to advanced security operations at Level Five for highly sensitive defense assets.
CMMC’s risk-based framework allows a more nuanced application of DoD cyber defense requirements based on the amount of Controlled Unclassified Information (CUI) being handled or processed.
Katie Arrington, the special assistant to the Assistant Secretary of Defense for Acquisition for Cyber in the Office of the Under Secretary of Acquisition and Sustainment in DoD, has stated, “If we were doing all the necessary security controls, we wouldn’t be getting exfiltrated to the level that we are. We need to level set because a good portion of our defense industrial base doesn’t have robust cyber hygiene. Only 1 percent of [Defense Industrial Base (DIB)] companies have implemented all 110 controls from the National Institute of Standards and Technology. We need to get to scale where the vast majority of DIB partners can defend themselves from nation state attacks.”
Choosing the appropriate CMMC level is critical and all defense contractors must achieve at least Level One certification. Contractors failing to meet any item required for a level certification will be certified at the level below it. For example, failure to meet all required security controls for Level Three would result in a certification for Level Two, effectively barring a contractor from bidding on an RFP with Level Three or higher.
CMMC Third-Party Audits
Under previous NIST SP 800-171 regulations, DoD contractors had the option to self-certify. Any security gaps that were identified were noted in a Plan of Actions and Milestones (POA&M), allowing a contractor to continue to provide products and services without achieving compliance with all 110 security controls. With CMMC, self-certification is no longer an option. In addition, POA&Ms are no longer allowed, which means contractors have to address weaknesses in order to achieve compliance and certification. The DoD plans to engage a non-profit organization to certify third-party auditors in late 2019. Once CMMC auditors are certified, they will be responsible for conducting third-party assessments of DoD contractors beginning in mid-2020.
CMMC Timeline
DoD is moving quickly to roll out CMMC. The current timeline for CMMC indicates that contractors will need to be certified by late 2020 in order to bid on contracts. In order to prepare, contractors need to determine where they stand regarding NIST 800-171 controls and the CMMC level they want to achieve as soon as possible. CMMC requirements might encompass controls from other frameworks i.e. NIST 800-53, ISO, etc. but 800-171A and 800-171B controls make up the core and thus a good starting point. Even a relatively short delay may jeopardize achieving CMMC certification by the deadlines set by the DoD or those established by your internal business development team.
CMMC Practices Per Level:
CMMC Budget Concerns
Recognizing that the cost of implementing security controls represents a barrier for small and even mid-sized defense contractors, DoD and other federal and state agencies are considering how to provide financial assistance for some CMMC compliance and certification costs. Targeting small and mid-sized DoD contractors, several financial support resources have been discussed or announced.
Kevin Fahey, the assistant secretary of Defense for Acquisition in the Office of the Under Secretary of Acquisition and Sustainment, gave permission to Katie Arrington to inform DoD vendors that security is an allowable cost.
The Small Business Cybersecurity Assistance Act, recently introduced in the Senate by Marco Rubio (R-FL) and Gary Peters (D-MI), would provide cybersecurity education to SMBs at Small Business Development Centers (SBDCs) that are funded by Small Business Administration (SBA) grants.
Some states offer cybersecurity assistance programs for small businesses. These programs are typically coordinated through the state’s Manufacturing Extension Partnership Program (MEP). For example, Maryland’s program covers 75 percent of remediation costs up to $10,000, based on the results of a gap analysis.
CMMC Expertise & Tools
Effective CMMC compliance efforts require access to security control expertise and easy-to-use compliance tools to organize and track progress. Failure to plan and coordinate compliance efforts can result in excessive costs, distractions to core business, and lost revenue opportunities.
Coordinating with contract, business development, and solution teams early in the process results in a smoother path to CMMC compliance.
Summary
DoD’s CMMC cyber compliance program rolls out in January 2020 and all defense contractors need to prepare. DoD prime and subcontractors can take proactive steps to minimize the time and effort required for CMMC compliance by engaging guidance from compliance experts and become CMMC compliant with fewer disruptions and less cost.