FedRAMP is one of the most popular topics on our website and blogs. One big question we often receive from Cloud Service Providers (CSP), is how can a FedRAMP authorization impact their business.
Cloud Service Providers and FedRAMP
FedRAMP is a program that enables cloud services providers (CSPs) to meet and demonstrate the security requirements embedded with FISMA and the NIST publications so that an agency may outsource with the confidence that its cloud service provider is meeting those requirements.
The DoD unveiled its proposed Cybersecurity Maturity Model Certification (CMMC) to prevent supply chain attacks
Cyberattacks on the U.S. government’s vast network of contractors and subcontractors pose a serious threat to national security, and the DoD is taking action. The agency tasked NIST with developing a set of guidelines addressing advanced persistent threats against contractors who handle high-value data assets, and it recently unveiled plans for its own set of standards, the Cybersecurity Maturity Model Certification (CMMC).
What is the CMMC?
The CMMC will be developed in partnership with Johns Hopkins Applied Physics Lab and Carnegie Mellon University Software Engineering Institute. The goal is to combine a number of existing cybersecurity control standards, such as NIST 800-171, NIST 800-53, ISO 27001, ISO 27032, and FedRAMP, into one unified standard.
In addition to assessing a contractor’s implementation of controls, the CMMC will also assess the maturity of the company’s institutionalization of cybersecurity practices and processes. Assessments will be conducted by third-party auditors, and companies will receive a score indicating the maturity and sophistication level their controls. There will be five CMMC levels, ranging from “Basic Cybersecurity Hygiene” to “Advanced.”
The DoD has indicated that the CMC will be a dynamic framework so that it is able to adapt to new and emerging cyber threats. A neutral third party will be responsible for maintaining the standard.
How will the CMMC affect DoD contractors?
DoD prime contractors have been held to higher cybersecurity standards since 2017, but typically, those primes outsource some of their work to subcontractors, who then have subcontractors under them. It’s these contractors, at tier two or below, that the CMMC is primarily aimed at. Many times, they are small companies that do not have robust cybersecurity defenses, which is why hackers target them. However, while the DoD has stressed that all areas of the federal supply chain must be secured, they have not yet gone into specifics regarding how the CMMC will flow down to subcontractors.
The DoD wants to implement CMMC in January 2020, include CMMC level requirements in RFIs by June 2020, and include them in sections L and M of RFPs by September 2020. CMMC levels will be used as a “go/no-go decision.”
The CMMC level required will depend on the nature of the CUI (controlled unclassified information) the contractor will be handling or processing. However, all companies conducting business with the DoD will be required to be CMMC certified, even if they do not handle CUI.
Recognizing that smaller subcontractors may be on tight budgets, the DoD is striving to make CMMC certification affordable. Additionally, IT security will be an allowable expense on contracts moving forward, so companies can modify their rates to reflect the new standards.
Early preparation for the new requirements will be the key to success. Now is the time to reevaluate your data environment, cybersecurity policies and procedures, and compliance processes. Since the CMMC will be partially based on NIST 800-171, ensuring that your company meets at least those standards will make the CMMC certification process smoother.
The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.
Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.
IT Compliance and Cybersecurity: Understanding the Differences
IT compliance and cybersecurity are often used interchangeably, even within the cybersecurity and compliance fields. This is the basis for the completely incorrect and dangerous notion that achieving compliance automatically equals being secure.
While there is some overlap, and the two fields complement each other, IT compliance and cybersecurity are not the same, and being compliant – with HIPAA, FedRAMP, PCI DSS, or any other framework – is not the same thing as being secure.
What is cybersecurity?
Cyber security is the protection of computer hardware, software, systems, networks, and data from cyberattacks. It is a very broad field that encompasses an enterprise’s policies, processes, end user education, and technical controls to address the following areas:
Application security – securing software and apps
Information security – securing data, including customer data, employee data, and confidential business information
Network security – securing the ports and databases within a network
Operational security – classifying information assets and determining the controls needed to secure them
Cyber incident management and response
What is IT compliance?
There is much overlap between the goals of IT compliance and cybersecurity, which is the root of the confusion. They both address securing hardware and digital assets. However, unlike cybersecurity requirements, which are developed internally, IT compliance requirements are mandated by a third party, such as the government, an industry regulatory body, or a client.
Organizations operating in the healthcare industry in the U.S. must comply with HIPAA, a federal law
Organizations around the world that wish to accept major payment cards must comply with PCI DSS, a set of standards mandated by the major credit card brands
The U.S. federal government requires organizations that wish to sell cloud services to federal agencies to comply with FedRAMP
Many private-sector businesses require their cloud services vendors to release an SOC 2 attestation
The takeaway is that enterprises implement cybersecurity controls for their own protection; they undergo IT compliance audits to satisfy a third party.
What are some additional differences between cybersecurity and IT compliance?
While many IT compliance standards, such as FedRAMP and SOC 2, are quite rigorous, they are not meant to provide full cybersecurity protection on their own. There’s no way they could.
The cybersecurity threat landscape is dynamic; it changes on a daily basis. IT compliance frameworks change very slowly, typically annually or less often.
Every organization’s data environment and risk profile are different. No IT compliance framework could comprehensively address every possible eventuality at every organization.
Additionally, some IT compliance regulations, such as the GDPR and the California Consumer Privacy Act, focus more on data privacy (giving individual consumers control over the data enterprises collect from them) than cybersecurity (protecting enterprise assets).
IT compliance complements cybersecurity
With the costs of IT compliance skyrocketing, some enterprises view compliance quite negatively, as a list of line items that must be checked off to conduct business in a certain industry or with certain clients. However, IT compliance complements enterprise cybersecurity and provides numerous benefits.
Compliance with certain standards, such as FedRAMP and SOC 2, is seen as a “gold standard” of data security by companies seeking to purchase cloud services, and compliance with the GDPR is seen by some consumers as a testament to a company’s commitment to data privacy. The process of undergoing a compliance audit also helps companies identify issues with their cybersecurity and data governance that may have otherwise gone undetected. Finally, IT compliance frameworks provide a good starting point for enterprise cybersecurity.
The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.
Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.
