Defense

Phase I – GAP Analysis (2-4 weeks)

The first step necessary to providing a comprehensive cyber security solution is through a thorough evaluation of your business. The critical components include environment, personnel, and technology infrastructure. This phase gives our staff the necessary information to define what is in-scope and out-of-scope from an information protection standpoint. We evaluate and document the following:

• Asset Inventory: Our staff will define what assets are in-scope and out-of-scope, as well, as classify the cyber assets per the CMMC Scoping Guide.
• Risk: We will identify any gaps that present a technical compliance risk to your business against the NIST Risk Management Framework.
• CUI Data Flow: iFORTRISS CMMC certified consultants will identify what types of sensitive data your organization handles, to what extent it needs to be protected, and document how information flows through your systems. This includes interviewing personnel, reviewing contracts and analyzing workflows. 
• System Security Plan:  Under CMMC and NIST 800-171, all information systems that store, process, and/or transmit CUI must have an SSP in place as part of their NIST Risk Management Framework (RMF). Your SSP describes your operating environment and how you have implemented all of the required security requirements. Once compliance gaps are identified, we build a blueprint to help you address your cybersecurity deficiencies. 
• Review of 320 Practices/Objectives: We will quantify all 320 NIST/CMMC practices and objectives and the associated documentation against the NIST/CMMC benchmark scores.
• Supplier Performance Risk System (SPRS) Score: By the end of Phase I, you will have a preliminary SPRS Score. This is a critical step since all DoD contractors must have a certified Supplier Performance Risk System (SPRS) score uploaded to eMASS by a C3PAO in order to obtain future DoD contracts.
• Plan of Action & Milestones (POAM): Unsurprisingly, there will be requirements that you do not currently meet. Requirements not met (gaps/risks) will be documented during your initial evaluation. Our team of CMMC certified experts will help you develop a Plan of Action & Milestones (POAM) designed to correct deficiencies/risks and reduce or eliminate system vulnerabilities.

At the end of Phase I, you will have a technology roadmap that will shore-up the known vulnerabilities along with providing techniques to ensure future compliance. This evaluation will give you a better understanding of how much it will cost to achieve full compliance and how long it will take.

Phase II – Remediation & Managed Security Services (1-3 months)

In this Phase, we will present any major hardware or software upgrades required, prepare your network for Enclave development, and implement Managed Services. We offer our clients a hybrid or turn-key solution for their managed services. The driving focus is to provide CMMC/NIST/DFARS-compliant managed security services for your business so that you can maintain compliance moving forward. We deliver this through offering the following options:

1. Turn-key solutions for clients that want to completely outsource their IT needs and compliance.

2. Hybrid solutions for clients with existing IT departments that lack the bandwidth and knowledge to become CMMC compliant independently.

We also offer strictly consultative services if an organization is staffed and “cyber mature” enough to maintain CMMC activities on their own moving forward.

Phase III – Enclave Development & Deployment (4 months)

This phase involves obtaining GCCH/Azure Gov Licenses and establishing a tenant, enclave buildout with all configurations, rules, and policies. We also build the SharePoint 800-171 compliance center and train enclave owners (IT Staff or MSP) to maintain the enclave. It is important at this point to start building a history of documenting tasks and continuous monitoring, in order to be ready for the certification assessment and prove your business has a culture of compliance.

Phase IV – GRC Support (6 Months)

This phase involves maintaining the operational integrity of the Enclave and developing training materials for staff to provide proof of cultural change. The Shared Responsibility Matrix (SRM) will also be developed in this phase.

Compliance is a continually on-going process because CMMC will require re-certification every 3 years. iFORTRISS managed security solutions for defense contractors are powered by a comprehensive suite of robust cybersecurity and GRC tools, including a reporting dashboard and document repository for compliance artifact retrieval when you are audited.