NIST 800-171 Compliance Explained

If your company is part of the federal supply chain, you likely need to comply with NIST 800-171. NIST 800-171 compliance applies to contractors for the DoD, GSA, NASA, and other federal and state agencies; universities and research institutions that accept federal grants; consulting firms with federal contracts; manufacturers who supply goods to federal agencies; service organizations that provide services to federal agencies; and these organizations’ subcontractors.

What Is NIST 800-171?

NIST 800-171 is based on NIST 800-53. Complying with 800-171 automatically puts you in compliance with the majority of 800-53. NIST 800-171 is the first government security mandate to apply to both primes and subcontractors.

NIST 800-171 was created to address how government contractors should handle Controlled Unclassified Information (CUI), which is information that is not classified but still sensitive. What information is classified as CUI is defined by each individual federal agency, which must provide details to the National Archives and Records Administration. As a general rule of thumb, data that is considered sensitive under other regulations, such as credit card numbers or Social Security Numbers, would be classified as CUI.

What Are the Requirements for NIST 800-171 Compliance?

NIST 800-171 outlines 110 security controls grouped into 14 “families” of security requirements, including basic and derived requirements:

• Access Control: Limiting system access to authorized users and limiting user access to the types of transactions and functions they are allowed to execute.
• Awareness & Training: Ensuring that your staff knows how to handle CUI in compliance with NIST 800-171 and cyber security best practices.
• Audit & Accountability: Creating and retaining system audit records to identify unauthorized access.
• Configuration Management: Change management and maintaining secure configurations.
• Identification & Authentication: Identifying and authenticating system users and devices.
• Incident Response: Create a plan to respond to breaches and test it.
• Maintenance: Ensuring secure system maintenance.
• Media Protection: Securing hardware, such as portable storage devices, and paper records containing CUI.
• Personnel Security: Avoiding insider threats.
• Physical Protection: Limiting physical access to CUI.
• Risk Assessment: Conducting vulnerability scans and other risk assessments.
• Security Assessment: Monitoring security controls to ensure continued effectiveness.
• System & Communications Protection: Securing organizational communications.
• System & Information Integrity: Identifying and addressing cyber threats.

NIST 800-171 compliance must be continuous. NIST 800-171 compliance isn’t just about passing an annual audit; organizations must maintain their controls year-round.

Is It Too Late to Comply with NIST 800-171?

The deadline for DoD contractors to fully comply, or at least have a “system security plan” in place, was December 31, 2017. While the December 31 deadline was specifically aimed at DoD contractors, all federal contractors must comply with NIST 800-171. If you are not compliant, you risk losing your federal contracts.

Many small and mid-sized organizations missed the December 31 deadline, often because they felt they did not have the resources to comply. However, it is not too late. If you begin compliance efforts now, should your prime contractor, subcontractor, or DoD contracting officer inquire about your status, you can demonstrate that you have a plan to comply and are making progress with it.

Don’t let fears of time and cost stop you. Continuum GRC’s IT Audit Machine (ITAM) greatly simplifies the compliance process and significantly cut the time and costs involved, putting NIST 800-171 compliance within reach of small and mid-sized organizations.

Continuum GRC has also partnered with Gallagher Affinity to offer small and mid-sized federal contractors affordable packages that combine cyber and data breach insurance coverage with NIST 800-171 and DFARS 800-171 compliance services.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Not only is PCI DSS compliance mandatory, it’s also the starting point for solid payment system cyber security

PCI DSS compliance is mandatory for any organization that accepts or processes payment cards, yet shockingly, a recent study by SecurityScorecard found that over 90% of U.S. retailers fail to meet four or more PCI DSS requirements.

Compliance with PCI DSS is not something to be taken lightly. If you are found non-compliant in the wake of a breach, the potential penalties are severe. The credit card companies that mandate PCI DSS compliance could levy fines amounting to tens or even hundreds of thousands of dollars; if you are unable to pay the fines, you will no longer be able to accept their cards.

Additional fallout could include:

• Some state-level data privacy laws mirror PCI DSS compliance standards or refer to them directly; non-compliance could result in your business running afoul of your state’s laws.
• Federal law enforcement may open an investigation to ensure that credit card data stolen from your organization is not being used to finance terrorist activities.
• Angry customers could decide to file costly civil lawsuits against you.
• If you file a cyber insurance claim, your provider may deny it.

The stakes are too high to leave compliance to chance. Utilize these best practices to help maintain PCI DSS compliance:

Monitor POS Terminals for Card Skimmers

If you have brick-and-mortar locations, train employees to monitor POS terminals for card skimmers. While unattended terminals in self-checkout areas are most at risk, card skimmers have also been found on terminals in human-staffed checkout lanes; they take only a few moments to install.

Always Change Default Manufacturer Passwords

PCI DSS compliance requires changing default, manufacturer-provided passwords on all equipment prior to connecting it to the network. These passwords are widely available online, often right on the manufacturers’ websites, and they’re the first thing any hacker that wants to break into your system will try.

Make Sure Your Employee Training is Relevant to Your Industry

PCI DSS compliance requires organizations to provide employees with security awareness training; make sure this training is relevant to your industry and organization. The cyber security and compliance issues that retail employees encounter will be different than those found at a collection agency or a healthcare facility.

Understand that Compliance is a Continuous Effort

Nearly all the retailers SecurityScorecard found out of compliance with PCI DSS failed requirement no. 6, which is about developing and maintaining secure systems and applications through prompt installation of software security updates and implementing secure software development practices and change control protocols. Your PCI DSS compliance protocols should not be centered around passing your annual audit but maintaining a secure payment card environment year-round.

Use a GRC Automation Solution

Today’s data environments are highly complex, and technology changes rapidly. Keeping up with PCI DSS compliance requirements can be challenging, especially if your company is still using spreadsheet software. Upgrading to a modern GRC automation solution such as Continuum GRC’s IT Audit Machine (ITAM) will help you prepare for your annual audits and maintain continuous compliance year-round far more quickly, easily, and for less money.

Finally, don’t make the mistake of thinking that PCI DSS compliance – or compliance with any framework or standard – equals cyber security. Compliance is the starting point for enterprise cyber security, not the do-all, end all.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

An SOC 2 Type 2 report is crucial when selecting a cloud service vendor

We are living in a cloud-first world; cloud services, including storage services and SaaS providers, are wildly popular. Unfortunately, third-party vendor breaches are at epidemic levels, and new regulations such as the EU GDPR are seeking to hold organizations accountable if third-party business associates that store or handle their sensitive data, including their cloud vendors, are hacked. One way for businesses to protect themselves is to look for an SOC 2 Type 2 report when evaluating cloud vendors.

While cloud vendors are embracing the SOC 2 Type 2 to demonstrate their commitment to data integrity and security, many client organizations are still unfamiliar with this important audit standard.

What is an SOC 2 Report?

The SOC 2 is part of the American Institute of Certified Public Accountants (AICPA) SOC reporting framework and utilizes the AT-101 professional standard. Unlike the SOC 1, which focuses on financial reporting controls, the SOC 2 documents service organizations’ non-financial reporting controls. It was specifically designed for to address the needs of service organizations that store customer data in the cloud, including SaaS providers.

SOC 2 attestations are based on AICPA’s Trust Service Principles of Security, Availability, Processing Integrity, Confidentiality, and Privacy. Reporting organizations are not required to address each one of the Trust Service Principles; SOC 2 reports can be limited to the principles that are relevant to the services being provided. AICPA’s principles of Security attest that the organization protects information and systems against unauthorized access, information disclosure, and damage; and Privacy, which attests that the service organization collects, uses, retains, discloses, and disposes of personal information properly.

Type 1 vs. Type 2

There are two types of SOC 2 reports, Type 1 and Type 2. When evaluating a cloud vendor, always look for a Type 2. While a Type 1 audit provides a snapshot of an organization’s controls at a point in time, a Type 2 audit examines them over a specified period. The Type 1 is, thus, only preliminary to the Type 2. An SOC 2 Type 1 demonstrates that the provider has controls in place but has not yet audited them. A Type 2 demonstrates that they have tested the controls over a period of time and proven that they work.

SOC 2 Type 2 reports benefit both cloud vendors and their clients. Client organizations can rest assured knowing that their cloud vendors’ controls meet the highest standards of data governance and security. Cloud vendors are able to differentiate themselves in a crowded marketplace and enjoy their own peace of mind, knowing that they have proactive data governance and cyber security controls in place to protect their systems and their clients’ data.

While SOC 2 audits are time-consuming and rigorous, GRC automation technologies such as Continuum GRC’s IT Audit Machine (ITAM) can make the process take far less time and go far more smoothly.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.