It’s time to get ready for CMMC 2.0. Although the exact timing of this cybersecurity mandate is uncertain, it makes sense to begin the process of meeting the requirements today as compliance will be required soon. How does your company get started—and how do you balance growing your business, engaging your customers, and managing your operations with all of the work involved in becoming compliant with this requirement?
The answer is simple. Engage with a managed services provider (MSP) specializing in CMMC. For many companies, it’s the only feasible option—and important stakeholders agree. Stacy Bostjanick, Chief Defense Industrial Base Cybersecurity, Deputy Chief Information Officer for Cybersecurity (DCIO(CS)), Office of the Chief Information Officer, recently referred to the rise of ‘cybersecurity-as-a-service’. Richard Wakeman, Senior Director of Aerospace and Defense for Microsoft Azure Global stated, “We have been leaning on managed service providers because we believe [they are] the fastest path, especially for small and medium sized companies, to get to a CMMC certification as quickly as possible.”
Our managed compliance process works
At CyberSheath, we have a proven process, honed from our years of experience working with hundreds of companies to bolster their security posture and ensure compliance. We start by assessing your current state against the mandatory requirements contained in DFARS clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. This DFARS requirement is written into well over one million contracts today and is a mandatory requirement for practically all DOD contracts. Our managed compliance service focuses on DFARS 7012 and the implementation of NIST 800-171 so that you can both meet today’s legal requirements and be well positioned for CMMC when it is finalized. We deliver a tailored solution for full compliance with single-source ease, efficiency, and accountability. We bring together security, IT, and regulatory components in a documented, scalable, repeatable way to deliver managed compliance.
Getting started
Although our methodology is consistent across our managed service engagements, we also know that each customer is unique. Ultimately, we work closely with you to help you become compliant and secure, constantly communicating with you and your team at the beginning and throughout our working relationship.
Initiation and planning
We begin with getting to know your organization and your needs, including understanding the cadence you are seeking and kicking off onboarding synchronization calls. We start aggregating documentation and digging into discovery. Our goal is to access information that allows us to craft an effective approach in alignment with your objectives. Activities in this phase include engagement kickoff calls, incumbent provider transition, service desk setup, environment access, and more.
Technology implementation
We take a security first approach. Whether we’re going to be implementing security controls within your existing environment or Office 365 tenant, or we’re going to start planning for a migration to GCC or GCC High, we begin deploying baseline technologies within the specified environment. This includes Azure Sentinel, the security information and event management (SIEM) platform used for logging, collection, and aggregation of event data. We then deploy other security agents such as those used for remote monitoring and management, endpoint detection, multi-factor authentication, vulnerability management, and more.
Service configuration
As we implement those security controls, we start looking at what’s actionable. We tune systems, identifying what is real and what might be malicious. We also perform our onboarding quality control checks, making sure we have everything we need deployed as you transition into service activation.
Service activation
We ensure that you know how to connect with our service desk, how our security operations center (SOC) works, and how our incident response team will interface with your team if needed. We want you to be comfortable with the technologies we have put in place. Our goal is for your day-to-day activities to continue as normal.
Our CMMC Managed Services components
Managed security services
On day one, we want to understand what’s happening within your systems as quickly as possible. We then work to implement an intelligent, tailored solution that compliments how your business operates. Monitoring, logging, and alerting is handled 24/7 by true security professionals in our SOC.
- Security log aggregation and monitoring provides a unified approach to threat detection and compliance management.
- Incident response services assess the environment for intrusions into or misuse of assets.
- Vulnerability management continuously assesses your environment for vulnerabilities and patch compliance.
- Endpoint detection and response helps to secure against ransomware, fileless malware, and other sophisticated attacks on Windows, macOS, Linux, Android, and iOS.
Managed IT services
We want to let you do what you do best every day and leave the IT concerns to us. Our consultants have seen so many different environments and addressed a huge amount of issues. We have the skills and experience to address your challenges.
- Managed IT helpdesk support provides a single point of contact for IT related faults and queries via our Service Desk system utilizing ConnectWise.
- Office 365 tenant management delivers comprehensive cloud services support from initial setup of the Microsoft Azure tenant and configuring the cloud-based environment to support your needs and providing ongoing operational support to ensure that the IT environment has the highest levels of availability.
- Server and storage management includes configuration of key windows components such as Azure Active Directory and group policy configuration settings to ensure that appropriate policy is applied across the tenant.
- Client device support including remote deskside management support ensures that your users have the highest levels of availability which includes patch management and incident management services.
- Exchange mail migration services provide migration services to migrate the existing commercial MS O365 tenant to GCC.
- Additional cloud-driven Azure-managed security solutions including implementation of Azure Information Protection (data leakage protection), Microsoft Endpoint Manager, and Multi-factor Authentication are included.
Managed regulatory compliance services
We ensure that as projects move through controls implementation, we’re remeasuring, revalidating, and rescoring so that we can see measurable progress against your SPRS score.
- Annual assessment performed by CyberSheath provides a CMMC gap assessment to score your compliance and and update your SPRS score.
- POA&M / SSP documentation is generated and updated as necessary to align with changes in the environment and close gaps.
- Continuous remediation provides support along the way to ensure ongoing progress is made towards compliance.
- Annual incident response exercises are performed as dictated by CMMC compliance requirements.
- Audit support is provided as necessary.
All of these managed services components are integrated and continuous. We build a collaborative partnership with each company that engages us as their MSP. This is an ongoing service to maintain your compliance and help you plan, as you move forward. It’s managed compliance that meets you where you are and brings order to what is otherwise a very chaotic process.
CyberSheath can help
The best partner to help you follow the rules is the one that helped write them. Our executives have been involved in the development of major DOD cybersecurity initiatives since 2008. We have completed more than 1,000 NIST 800-171 assessments and solutions for our clients. Cybersecurity compliance is all we do. We can do it for you. Contact us to get started.