At this point, I’ll assume you’ve heard about NIST 800-171. You’re aware that it impacts your organization, and you know you have to figure it out before December 31st.

But where should you start?

3 Steps to NIST 800-171 Compliance

It may seem daunting, but NIST 800-171 compliance can be broken down into three primary activities:

1. Assessing your environment
2. Addressing deficiencies
3. Documenting your results

That’s basically it.

Step 1: Assessing Your Environment

First off, you need to determine which environment (or environments) are subject to NIST 800-171 compliance. Ask this question:

Does this environment process, store or transmit any Controlled Unclassified Information?

If the answer is yes, it needs to be assessed.

What exactly should you assess?

Go through the Controls (Section 3) of NIST 800-171. For each control, determine if this environment contains safeguards that satisfy the requirements.

Step 2: Addressing Deficiencies

Following your assessment, you should have a solid understanding of which controls are satisfied and which are not.

It’s time to figure out how to address the issues for each control that is not satisfied. It may be as simple as creating a policy or as complex as redesigning your network. Either way, you need to have a plan.

Step 3: Documenting Your Results

You’ve probably been documenting your activity throughout the assessment and remediation steps. At this point, it’s time to put it all together in a format that is acceptable to the Government. They’re quite particular about the way things need to be presented.

The 2 documents you need to produce

Your results should be cataloged in two specific documents:

1. System Security Plan
2. Plans of Action

These documents correspond to the first two steps discussed previously.

System Security Plan

The best approach for creating the System Security Plan is to create sections based on the information required in NIST 800-171.

System Security Plan Outline:

1. Executive Summary
2. System Boundary
3. Operational Environment
4. Security Requirements Implementation
   1. Controls 1 – 110
      1. Implementation Description
      2. Evidence Description (evidence, e.g. screenshots/documents, should be collected and saved but not necessarily included in the SSP)
5. Environment Interconnection with Other Systems

Plans of Action

The government is expecting you to have some issues. You’re going to raise some eyebrows if you claim to be 100% compliant.

Plans of Action Outline:

1. Executive Summary
2. Unimplemented Security Requirements
   1. Specific Controls with Issues
      1. Non-compliance Details
      2. Remediation Plan

Documentation is Key

You know how the government operates… if you deviate even slightly from their requirements you’re going to end up going back to fix things. Make sure you provide solid detail for each control and capture some sort of evidence to back it up. ComplyUp offers a comprehensive NIST 800-171 Self-Assessment Platform, complete with easy to understand explanations of each control.

What if we don’t have CUI?

As the government prepares to enforce the NIST 800-171 compliance requirement, you may find yourself thinking one of these thoughts:

• Can we avoid the NIST 800-171 compliance process altogether if we don’t have CUI?
• We don’t process federal data on our systems, so we don’t need to worry about NIST 800-171.
• We don’t have a contract with the CUI clause currently, so NIST 800-171 doesn’t apply to us.
• The government gave us laptops for use on this contract, so we’re likely exempt from NIST 800-171.

Let’s start with a CUI Overview

NIST 800-171 describes the safeguards that contractors must implement to protect CUI. CUI is “Controlled Unclassified Information”.  Executive Order 13556 established an “open and uniform program for managing” CUI, and named the National Archives and Records Administration as the “Executive Agent to implement this order”. NARA did its part by cataloging the various types of CUI. NARA organizes CUI into several categories:

1. Agriculture
2. Controlled Technical Information
3. Critical Infrastructure
4. Emergency Management
5. Export Control
6. Financial
7. Geodetic Product Information
8. Immigration
9. Information Systems Vulnerability Information
10. Intelligence
11. International Agreements
12. Law Enforcement
13. Legal
14. North Atlantic Treaty Organization (NATO)
15. Nuclear
16. Patent
17. Privacy
18. Procurement and Acquisition
19. Proprietary Business Information
20. SAFETY Act Information
21. Statistical
22. Tax
23. Transportation

Many of these categories have sub-categories. NARA specifically describes what types of information falls within CUI scope based on each category.

Now, back to the question at hand. What if we don’t have CUI based on the NARA definition?

Are you sure you don’t have CUI?

Ok, you may not have access to nuclear data, but what about technical information provided by the government for use on your contract? How about privacy info? This is the type of data that may end up on your systems inadvertently. Have you ever used technical data to demonstrate your understanding of the customer’s needs in a proposal? Have you stored deliverables on your laptop for retention after a contract ends?

Additional CUI Types

NARA reminds us that individual agencies still have some say in how CUI is defined. The top of their site includes the following statement:

***** IMPLEMENTATION REMINDER FROM THE EXECUTIVE AGENT *****

Existing agency policy for all sensitive unclassified information remains in effect until your agency implements the CUI program. Direct any questions to your agency’s CUI program office.

This means you need to be aware of any deviations to the standard CUI definitions by your target agency. For example, consider the new rules proposed by DHS on January 20th:

DHS’s proposed rule broadly defines “CUI” as “any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls[,]” including any “such information which, if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy of individuals.”

This is a big one. They’re basically saying “everything is CUI”. Let your subcontractors know too, since this applies to them as well.

How do you know you won’t be asked to handle CUI?

Think about it from the government’s perspective: Let’s say you’re an agency that puts an RFP out with the “Safeguarding Covered Information” clause. You get 7 proposals that are all similar in technical approach and pricing. Six of the proposals have the following verbiage: “We are compliant with NIST 800-171 and have procedures in place to protect CUI”. The seventh proposal contains the following statement: “We do not process any CUI and have not undergone a NIST 800-171 assessment”.

Which bid do you think will get thrown out?

Prepare to handle CUI

Regardless of whether you currently process CUI or not, it makes sense to have a CUI safeguarding capability. Your competitors surely do.

ComplyUp offers a comprehensive NIST 800-171 Self-Assessment Platform, complete with easy to understand explanations of each control.

What are my NIST 800-171 Outsourcing Options?

NIST 800-171 compliance is still a relatively new topic. Contractors are hustling to learn all they can about these cyber security requirements before the December deadline. Inevitably, folks start to ask if there are any NIST 800-171 outsourcing options.

What aspect of NIST 800-171 are you trying to outsource?

You’re probably looking to outsource one of two things: either a NIST 800-171 assessment or one of the NIST 800-171 requirements. We’ll talk about NIST 800-171 outsourcing for assessments in a future post. This article will focus on offloading some of the requirements to third-parties.

What does the NIST 800-171 SP say about outsourcing?

This is really the only thing that matters. DFARS 252.204-7012 says we have to comply with NIST 800-171, and NIST 800-171 has specific verbiage that deals with outsourcing requirements.

          NIST 800-171 – Section 2.1 Basic Assumptions

Additional assumptions also impacting the development of the CUI security requirements and the expectation of federal agencies in working with nonfederal entities include: […] Nonfederal organizations can implement a variety of potential security solutions either directly or through the use of managed services, to satisfy CUI security requirements;

This single statement suggests that it’s totally acceptable to leverage third-party vendors to meet the compliance requirements. This is great news if you’re not quite compliant with one or more of the controls.

Outsourcing Examples

What are some examples of controls you can outsource? Many of the requirements “feel” like something you can pay someone to do.

• 3.1.14 Route remote access via managed access control points. google: managed vpn services
• 3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat. google: security awareness training services
• 3.6.1 Establish an operational incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities. google: incident handling services

The list goes on… If you find a deficiency within your organization, consider the costs of implementing an in-house solution vs. an outsourced service. You may find it’s quicker to pay someone to solve the problem for you. ComplyUp offers a comprehensive NIST 800-171 Self-Assessment Platform, complete with easy to understand explanations of each control.