BCWSC/26/1600 CMMC & NIST 800-171 Panel
Properties
- tags
- CMMC, Security/CUI space
- 4:00 - 4:45 CMMC & NIST 800-171 Panel
- BCWSC/26
- Meta
- Panelists
- Person/Roy Wattansin
- Person/Michael Hilborn
- Person/Erik Yost
- (MIT) CUI space
- Person/Andy Rivers
- Abstract
- If you support research at your university, you have likely heard about CMMC and NIST/800-171.
- This panel discusses the current state of protecting research data, current progress and pain points, and where the next year may take security practitioners.
- Panelists
Intro
- CyberSecurity Maturity Model Certification. It's the DoW's way of knowing you have conformed to NIST 800-171.
- there's been increasing
- Person/Michael Hilborn
Person/Erik Yost
- if it's CUI ,
- with funding constraints and the breadth of opportunity in the CUI world, they can build out a remote environment. they started with 10 Investigator/Principal
how have you prioritized handling each one of these
- Person/Roy Wattansin
- Microsoft Azure is like a managed service provider (MSP) that configures the secure enclave house
- they looked at three different vendors
- they interviewed and did their own due diligence
- they wanted something they could trust
- there are a lot of different scenarios
- we are just talking about online security
- but with CMMC you should also have physical security
- Person/Michael Hilborn
- NIST/800-171 has over 100 different things in 14 different domains
- the way we go about this, we're all engineers
- we try to do the amount that has the most impact
- we are in fortunate position, because we can collaborate with HUIT and HBS IT
<!-- secretlint-disable-line -- verbatim public panel transcript, not first-person --> - so the most impact is infrastructure
- prioritize system integrity
- network integrity
- data encryption
- electronic and digital level
- at user and organizational level
- we prioritize account management
- between those two things we cover a lot of ground
- Person/Erik Yost
- it's policies and technical aspects
- for MIT, the technical stuff was easy
- but the policy stuff was very hard
- when to initiate background checks, when to confirm US background status
- for lincoln labs, people stuff is easy for them, but technical stuff is a nightmare, becasue everything is cmmc level 2 there, every printer, every computer
- they will do physical environment after c3io (did I hear this right)? comes through
- are policies being followed as they are supposed to be
- Person/Andy Rivers
- Person/Erik Yost
- Person/Roy Wattansin
- Person/Roy Wattansin
how have you handled the culture of things?
- Person/Erik Yost
- Person/Michael Hilborn
- support from management is important for the culture
- the original question
- What NIST/800-171 is good information security hygiene
for your self-attestation, how good is good enough?
- Person/Roy Wattansin
- DFARS = Defense Federal Acquisition Regulation Supplement
- there are three levels of CMMC
- MSP = managed search provider ...?
- every week, they look at the documents, get the right people to sign it or approve it
- it's a combination of rinse and repeat
- everything they see on paper, they need to see equivalent technical controls
- Person/Michael Hilborn
- always room for improvement, you never get to good enough
- for self-assessments, you have a combination of assessments
- through university itself
- third party come in and do neutral assessment
- what follows from those assessments is, you identify what the gaps are
- you put into motion ways to address those gaps
- put it in project planning for whole year
- C3PAO = CMMC Third-Party Assessment Organization
- Person/Erik Yost
- Person/Andy Rivers
- Person/Roy Wattansin
has anyone moved to CMMC level 2?
Q&A