November 2021 update on CMMC 2.0: requirements have been pared down. For contractors who are still working on NIST 800-171 compliance, we don’t expect much to change in the near-term, though the burden of proof / evidence should be significantly lower.
Need help? Our coaching model helps you avoid high consulting fees.
Are you getting ready to start down the path of getting your CMMC certification?
Based on our recent NIST 800-171 / CMMC projects, here are the 21 most common technology projects that we see companies needing to implement in order to comply.
- Windows 10 on all PCs where possible. In-support versions of all server OS and software (e.g., SQL Server).
- If older computers are still required (e.g., to drive equipment), very strict network segmentation and no/limited Internet access.
- All computers and servers configured (at least partially) to the appropriate STIGs
- There will be a TON of new GPOs that need to be added. If you're not on a domain, plan to add one.
- 2FA everywhere: local access, VPN/remote access, OWA, etc.
- More refined network segmentation. Some companies opt to deploy a NAC.
- Secure file sharing system (if they're sharing data internally or with external parties)
- Tons of physical security controls (cameras, locks, sometimes badges, systems for tracking visitors, etc.)
- Managed encryption everywhere
- Mobile device management -- definitely on phones and tablets, ideally on workstations too
- Generally, no cloud services handling CUI unless you're in Microsoft 365 GCC High
- Wifi access points using FIPS 140-2 encryption
- HDD shredding, usually through a NAID-certified service
- Business-class firewall with security services enabled and reviewed
- At a minimum, firewall logging to a SIEM, with either a SOC service or anomaly detection algorithms
- EDR solution or MDR solution on top of the antivirus that you should already have.
- Blocking file sharing services / apps
- Migrating all users to Standard accounts
- USB lockdown and other DLP measures
- Offsite backup
- Segregation of data in the ERP system and in shared drives
Want help with your NIST 800-171 / CMMC project? Learn more about what we do here.