Located in Hudson, New Hampshire, Incon Inc. has manufactured electronic connectors for the Military and Aerospace industries since 1988. Incon is housed in a 30,000 square foot manufacturing facility with a total of 43 employees.
Their connectors are built to the Military Specification MIL-DTL-55302. Their customers include Boeing, Lockheed, BAE, RTX/Collins Aerospace.
Situation:
“In 2017 we became aware of the Department of Defense requirement, NIST 800-171,” said Ted Schultz, President of Incon Inc. NIST 800-171 required that for items designated as CUI (Controlled Unclassified Information), manufacturers needed to implement 110 controls surrounding physical and IT security to prevent the unintended release of CUI.
“NIST 800-171 inferred that we should be able to establish, execute, and self-certify compliance to these controls. Being a small company, we initiated the project ourselves thinking that with enough research and hard work, we would succeed,” said Schultz. “However, we came to realize we did not have IT personnel on staff, and our third-party IT support was not versed in the requirements of NIST 800-171.”
Move ahead to 2022 and little progress had been made against the specification. Many of the requirements and interpretations of the requirements were too complex and beyond their understanding as to the technology and processes needed to meet them. “Our customers were beginning to ask about our NIST progress. We realized that we needed resources to complete this task,” said Schultz.
Solution:
That same year Ted received an email from NH MEP about the latest version of NIST 800-171, now called CMMC or Cybersecurity Maturity Model Certification. He contacted Eric Basta, Business Development Manager for NH MEP, and he described a program where NIST would provide a grant to defray the cost of the CMMC Phase 1 and Phase 2 Assessments by 50%. Incon wasted no time and took advantage of the grant being offered by NH MEP. NH MEP brought in its 3rd party Managed Service Provider, Mainstay Technologies, to perform the CMMC Phase 1 – Baseline Agreement and Phase 2 – Program Creation Assessments for Incon.
For the Phase 1 – Baseline Agreement, the Mainstay Information Security Team worked with Incon to perform an assessment and identify compliance, noncompliance, or partial compliance with each of the 110 components required of CMMC. Mainstay provided Incon a compliance report, along with in-person and over the phone consultations about the findings. This included consultation on a Plan of Action and Milestones Creation (POAM).
For Phase 2 – Program Creation, the Mainstay Information Security Team created the appropriate Corporate Information Security Policies, Procedures, Strategies and Plans for Incon that aligned with CMMC. Mainstay also made cost-effective, CMMC compliant technical mitigation recommendations for Incon.
Results:
“While Incon has not yet self-certified to the 110 CMMC controls, working with Mainstay has drastically reduced our uncertainty. We now know our plan is solid, realistic, and achievable. Nearly all the capital investments have been accomplished, and we are engaged in defining and refining the administrative programs needed for CMMC,” said Schultz.
The following results for Incon Inc. can be credited to having gone through the CMMC Phase 1 and Phase 2 Assessments:
- $800,000 in new sales over the last 12 months
- Created 4 jobs over the past 12 months
- Increased investment of $104,000 in information systems and software over the last 12 months