Do you have a a federal contract?
If you do not have a contract from the government or a contract funded from a larger Government award you can not have FCI
If you do have federal funding you have FCI if you touch any information not meant for public release.
How big a solution do you need?
To meet the Safeguarding of Covered Contractor Information Systems required by FARS Clause 52.204-21. You can protect your entire network and company premise.
You may find it more affordable to sequester FCI to a specific device, like a company provided laptop and use a protected file sharing solution.
Do I even have FCI?
FCI is any data not meant for public release. So if you can download it from a public website, google it, or if the data is presently FOIable it is not FCI.
Do you have policies on employees accessing different parts of your company?
Level One Acess Control Practices 1.001
Much of your #cmmc level one compliance can be met with a well written access control policy. The FARS 21 Clause requires you to, " Limit information system access to authorized users, processes acting on behalf of authorized users, or devices"
These policie address your account management and describe how you identify users, and limit their authorization. You also have rules on how to add new equipment like printers.
A CMMC assessor will want to see an access control policy. They will want to talk to whoever manages the list and networks. This maybe an IT contractor. They may want to test how you add a new user or employee to the system.
A {company name}registered professional can help you write an access control policy.
Do you only give data to people who need it?
Level One Access Control 1.002
Much of your CMMC Level One compliance revolves around common sense. Only let people who need to use data have access to that data. The FARS 21 Clause requires you to, " Limit information system access to the types of transactions and functions that authorized users are permitted to execute."
Basically you need to define access priviledges. How you do this should be documented in your access control policy. If you use O365 or G Suite you have this ability to define groups and roles. If you want to share data outside your organization you may want to use a secure and encrypted file service.
Again contact {company name} if you need help crafting a an access control policy that has evidene of your compliance. Check out {company name} for an encrypted file sharing solution
What do I do with personal devices and home networks?
Level One Access Control AC.1.003
You will need to make decisions about personal devices. You either have to provide devices to employees like lap tops and cell phones or use mobild device management. The other solution is to allow no off site access or of the clock work. The Fars 21 clause requires you to limit,"use of external information systems"
Even if you provide devices you should use Mobile Device Management to protect FCI.
If you need employees to access FCI from home or remote you need a VPN. This is a virtual private network. You will need to document in your access control policy.
A CMMC assessor will want to see your access control policy, they will want talk your network adminstrator or IT consulantant and test your VPN
Can I use my IT Consulting Firm?
Level One Access Control AC.1.003
Many small businesses rely on IT firms. They often connect your network to their external systems. As the Government contractor iit is your responisbility to ensure any IT contractor protects your FCI.
Your CMMC assessor will want to see clear policies about FCI boundaries between yoru company and the IT contractor.
Many times IT contractors have full access to your network. For this reason CyberDI suggests only using vendors who hold a CMMC Level Three certificate. You could also sequester FCI in a file sharing system such as {company name} to only share FCI with authorized users.
Do you limit who can publish or make stuff public at your company?
Level One Acces Control AC1.004
Another common sense CMMC control. Would you let anyone just publish info on your website? The FARS 21 clause requires you to,"Control information posted or processed on publicly accessible information systems."
You have to be careful with stuff like websites and press releases when you touch FCI.
A CMMC assessor will want to see rules about who gets to publish data and information to public channels. A {Company Name} CMMC Registered Professional can help you write your Access Control policy so it contains the required observable evidence.
Does everyone have a unique username and password?
Level One Identification and Authentication IA. 1.076
Controlling data means knowing who logs in when. This begins by having unique user names and passwords. You can not save money by sharing credentials when it comes to FCI. The FARS-21 clause requires you to, "Authenticate (or verify) the identities of those users, processes, or devices." before they can touch sensitive data
It is important to know the difference between authentication and authorization. Authentication follows the Popeye (or Slim Shady) rule: I Am who I says I am. Authorization is the permissions assigned to an authenticated user.
A CMMC assessor will need to verify if every user has a unique identifier for all systems that touch FCI. This can include user names and stuff do identify computers like a MAc address or internet users thorugh Internet Protocol addresses. If you use software you may need to document the API token generation used for authentication. APIs are like secret handshakes between computers. They will only talk if tokens match.
You need to document your user authentication process. Much of this just needs to refer to your software such as Microsoft or Google documentation. A {company name] Registered Professional can help.
Do you know how to find records of who logged into what?
Level One Identification and Authentication IA. 1.077
One you know you authenticate each use you need to know when they log in and what device they are using. To cpmply with FARS 21 you need to have this information as a, " prerequisite to allowing access to organizational information system."
For many small businesses this maybe data kept by a IT consulting company. Once again we recommend using only IT consultants persuing a CMMC level Three certification
A CMMC assessor will look for a mchanism to support your authentication. It is important you use multifactor authentication and not just two factor authentication. Most modern computer systems support MFA. Ask your CMMC Level 3 Certified IT Company for help.
Do you shred everything that did not contain food or liquids?
Level One Media Protection MP.1.118
It is good company policy to err on the side of shred everything. If you have a locked room just for prining and storing FCI keep the shredder there.
Do you have a plan for destroying old electronic data?
What happens when employees leave? Do you erase usb thumb drives if they can transmit FCI?
It is good company policy to err on the side of shred everything. If you have a locked room just for prining and storing FCI keep the shredder there.
A {company name} Registered Professional can walk you through the NIST SP 800-88 guidance on destroying media.
Do you lock the doors?
Level One Physical Protection PE.1.131
Sounds silly but the CMMC Level one requires basic physical protections you may take for granted. The Fars 21 Basic safeguarding isn't safe if people have physical access to your site or your networks.
If you store FCI this needs to be in a place, such as a room or a locked cabinet where the public or unauthorized staff can not access.
Your physical access will require some advanced security such as electronically or visually checked badges and keycards.
A CMMC Level One Assessor will test your physical access authorizations and examine written policies.
Do you let the public wander around your company aimlessly without an escort?
Level One Physical Protection 1.1.32
Of course not. Just write this down in a policy as observable evidence for compliance. Keep visitor logs. There are plenty of fancy solutions but a paper sign in still works. Remember DFARS-21 requires you to, " Escort visitors and monitor visitor activity and maintain audit logs of physical access"
A CMMC assessor will look for your visitor escort policies. If you use electronic solutions they may test these.
Do you make vistors sign in?
Level One Physical Protection 1.133
Another common sense protection of the FARS 21 clause that requires you to, "maintain audit logs of physical access."
A CMMC assessor will look for your visitor logs. Even paper logs will do but you may want to consider a solution that captures a physical image.
Badges? Do we need stinkin' badges?
Level One Physical Protection 1.134
If you use access cards these need to get into spaces that protect FCI these need protection too. The DFARS 21 clause states, "Limit physical access to organizational information systems, equipment, and the respective operating environments." If you do not protect the tools that allow you to do this you have no protection.
So if you use badges or even use a photcopier code for machines authorized for FCI duplication you need to protect these and desascribe how you protect these in an access policy.
If you padlock access to the yard don't do dumb stuff like write the combo on the side of the wall are on the lock.
A CMMC Assessor will want to see an inventory of your access control devices. They may check your doors. In fact you should prepare an iventory of all your electronic dveices and have it ready for an assessment.
Do you have filters and tools to block and monitor stuff on your Internet?
Level One System and Communication Protection SC.1.1.175
Just like you need to lock and monitor your physical boundaries with doors and locks you also need to protect the boundaries of your networks and communication systems like email. In fact the FARS 21 clause requires you to monitor, "at the external boundaries and key internal boundaries of the information systems.""
A CMMC assessor will look for communication protection policies. You also should have a professional network expert diagram how FCI flos in your system. They will also want to know how your system is configured.
This is one of the most complicated of the Level One CMMC practices. You really should use a CyberDI Registered Professional to draw your network diagram. You can not do the monitoring on your own. {Company Nmane} recommends using a qualfied vendor a cybersecurity solution
Do you split your network servers so stuff for the public is in one place and private company stuff in another?
Level One System and Communication Protection SC.1.176
The cybersecurity world has a phrase for when we sepersate different types of data using the Demilitarized Zone (DMZ) as a metaphor. This just means having a system to meet the FARS 21 requirement of, "implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks"
A CMMC assessor will test many systems and hardware. if you use an IT consultant make sure they are on the pathway to achieving CMMC Level Three classification. This is not a requirement, but recommended as good practice when using vendors to protect FCI.
You will have to monitor these systems. Once again CyberDI recommends using {software solution} for system monitoring.
Can employees ignore the "Update Now" notification and click, "remind me tomorrow" forever?
Level One System and Information Integrity SI.1.210
Do not rely on humans to complete timely updates. You need to automate these systems so you can, "Identify, report, and correct information and information system flaws in a timely manner."
If a computer is not updated you can not identify flaws in a timely manner. You need to track updates and when you find flaws in your system there must be way to report these. flaws.
A CMMC assessor will want to see configuration management policies, device imaging policies, and they may test how you install and approve software You should document all of this with a {Company Name} Registered Professional.
Do you buy or pay for malware or virus protection?
Level One System and Information Integrity SI.1.211
You need protection from bad things on the web. In facts the FARS 21 clause calls for, "protection from malicious code at appropriate locations within organizational information systems."
Designate locations mean places where data enters and exits your system like email, servers, and firewalls. Most businesses can not do this on their own and use software solutions from enterprise software and third party IT consultants.
A CMMC assessor will want to test all the things. More things than we can fit here. You may want consider {company name} as a cybersecurity solution to help you out.
Do you know how your Enterprise Solutions update malware and virus protection?
Level One System and Information Integrity SI.1.212
No point in protecting boundaries, places that should block access, test the "DMZ," or designated locations of FCI without updates. In facts the FARS 21 clause declares, "Update malicious code protection mechanisms when new releases are available."
Configuration managment is hard. You can't do it. Even if you use commercial off the shelf solutions you should use an IT professional. In terms of Obervable Evidence work with the consulant to write policies.
A CMMC assessor will test information integrity policies, want to see network diagrams, see how you monitor false positives, meaning that important deal getting lost in your spam folder. You can not do this alone.
Do you use a major email Enterprise solution? Do you know where the spam and phishing policies live?
Level One System and Information Integrity SI.1.213
Almost all email tools have policies and systems that have enough observable evidence to meet the FARS 21 requirement of, "Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed."
You may have the tools, but do you know where to find them. The Enterprise solutions maybe enough for compliance but do not confuse compliance with security. If you care about protecting FCI we recommend using someone such as {company name}
