Cybersecurity
New England Defense Manufacturers! Meet your NIST 800-171 compliance obligations as a prime or subcontract manufacturer for the defense industry by participating in the Cybersecurity Training Workshops, presented by your New England MEP Centers through the New England Regional Defense Industry Collaboration (NERDIC).
Details
1) The workshops are conducted in four half-day online sessions, presented every other week starting on April 27th.
2) Each workshop topic is delivered on a Tuesday and again on a Thursday of the same week covering the same topic to give you a choice and schedule flexibility for you and your staff. Please choose either the Tuesday or Thursday track upon registering below.
3) Following payment of the series, you must register your employee(s) for all of the four, half-day workshop sessions. Each workshop is intended for different individuals and responsibilities within your business depending on the agenda topics being presented.
4) Fee: $500 – covers all four workshop sessions (a $4,500 value, subsidized thanks to a cybersecurity grant)
5) Your company must be in the defense supply chain with your facility located in Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, or Vermont.
Mitigating the cybersecurity risks and NIST 800-171 requirements facing defense industry manufacturers does not have to be a challenge.
Session 1: Cybersecurity Management Team Overview
Dates: Tuesday, April 27 and Thursday, April 29 (same content both days)
Time: 8 am – 12 noon on each date
Suggested attendees: Business Owners, Management Staff, Senior Leadership
Agenda Overview
During this workshop session, you will be provided with a comprehensive understanding of current and future DoD cyber regulatory requirements and a briefing on the cyber threat landscape. You’ll also receive a review of the process and resource commitment necessary to comply with current requirements.
At the conclusion of Session 1, you will be given an assignment that serves as a prerequisite for Session 2. It will focus on identifying team members who will contribute to security compliance, understanding what Controlled Unclassified Information data is, and mapping out the IT infrastructure and operations processes in place that control the creative, storage, and transmission of data internally and to third parties (vendors and customers).
Session 2: Cyber Risk Management Plan Development
Dates: Tuesday, May 11 and Thursday, May 13 (same content both days)
Time: 8 am – 12 noon on each date
Suggested attendees: Business Owners, Operations Managers, Quality Managers
Agenda Overview
This workshop session will focus on developing a Risk Management Plan (RMP), covering the sections and content included in an RMP.
Topics covered will include properly documenting user roles and responsibilities and an in-depth discussion on the process of complying with NIST 800-171. It will address pre-assessment preparation tasks, GAP assessment, and reviews of System Security and Incident Response Plans. It will also cover compliance reporting in the Supplier Performance Risk System (SPRS).
Assignment at the end of session 2 involves completing a questionnaire focused on capturing organizational duties and placing into a roles and responsibilities matrix, as a prerequisite to session 3.
Session 3: Policies and Procedures Documentation
Dates: Tuesday, May 25 and Thursday, May 27 (same content both days)
Time: 8 am – 12 noon on each date
Suggested attendees: HR Managers, Operations Managers, IT Managers
Agenda Overview
This workshop session will focus on developing a Policies and Procedures Document. It is intended to be a working session where each section of a completed policies and procedures document is reviewed in order for attendees to gain an appreciation and higher degree of understanding for the level of detail required for each section.
Session 4: Systems Security Plan Development
Dates: Tuesday, June 8 and Thursday, June 10 (same content both days)
Time: 8 am – 12 noon on each date
Suggested attendees: IT Managers and Staff with IT responsibilities
Agenda Overview
This workshop session will focus on the details included in a system security plan. It will be an interactive session that will result in a greater understanding of the topics outlined in the agenda when implementing the plan.
***UPDATE: Currently, NH MEP has received funding through the CARES Act to provide partial funding for the CMMC Implementation to manufacturers that have been impacted by COVID-19.***
CMMC Implementation Services
NHMEP provides Phases 1 and 2 of CMMC Implementation to New Hampshire manufacturers who are DoD suppliers or sub-contractors. We begin by working with your IT management on a gap analysis of your current cybersecurity strategies to discover strengths, weaknesses and the best solution to bring your company into CMMC compliance.
What is CMMC?
CMMC Version 1.0 was released in January 2020 and serves as a unified cybersecurity standard for future Department of Defense (DoD) acquisitions. For the bidding process on DoD contracts, CMMC will ensure a fairer process by outlining required levels based on your company’s business requirements. CMMC V1.0 defines a maturity model as a set of characteristics, attributes, indicators, or patterns that represent capability and progression in a particular discipline. It works to establish best practices through defining and structuring action that must be taken by a company to prove that it has incorporated these practices.
The CMMC Framework
The CMMC model framework organizes processes and cybersecurity est practices into a set of domains. For each of the 17 domains, there are processes that span five levels of cybersecurity maturity. Additionally, each of the domains contain one or more capabilities spanning the five levels. And, for a given capability, there are one or more practices that must be demonstrated.
The 17 Domains
Each domain is comprised of processes and capabilities across the five levels. The domains include:
- Access Control (AC)
- Asset Management (AM)
- Awareness and Training (AT)
- Audit and Accountability (AU)
- Configuration Management (CM)
- Identification and Authentication (IA)
- Incident Response (IR)
- Maintenance (MA)
- Media Protection (MP)
- Personnel Security (PA)
- Physical Protection (PE)
- Recovery (RE)
- Risk Management (RM)
- Security Assessment (CA)
- Situational Awareness (SA)
- System and Communication Protection (SC)
- System and Information Integrity (SI)
Phase 1 – Basic Cyber Hygiene
Processes are performed and select practices are documented where required. There are 17 practices to demonstrate basic cyber hygiene. Equivalent to all practices in Federal Acquisition Regulation (FAR) 48 CFR 52.204-21 from FAR Clause 52.204-21. The first level ensures basic safeguarding of federal contract information.
Phase 2 – Intermediate Cyber Hygiene
Processes are documented, including Level 1 practices and a policy exists that includes all activities. Practices demonstrate intermediate cyber hygiene. This level complies with FAR, includes a select subset of 48 practices from NIST SP 800-171, and includes an additional 7 practices to support intermediate cyber hygiene. A total of 72 practices must be demonstrated at this level as organizations transition to demonstrate cybersecurity maturity progression to protect controlled unclassified information.
To get started with a gap analysis for CMMC Implementation or to learn more, please contact NHMEP:
“Working with the Partnership was a cost effective way to remain ahead of implementation timelines to achieve compliance with NIST 800-171. Their administrative and technical assistance provided a rich contextual understanding of controlled information and information systems, and guided our company’s policy approach to information exchange governance. We are now better prepared to meet current and emerging information security obligations for all of our clients.”
The National Institute of Standards and Technology (NIST) Labs have developed a Behavioral Anomaly Detection cyber solution for manufacturers.
Use it to preempt cyberattacks, rather than dealing with the consequences.
View and download the pdf Securing Manufacturing Industrial Control Systems: Behavioral Anomaly Detection.
Value Stream Mapping Information Session
Webinar
Root Cause Analysis & Corrective Action Training
Grappone Conference Center, Concord
Using AI Technology to Crosstrain & Upskill Employees
Webinar