Cybersecurity: More than A DoD Issue
Download as PPTX, PDF0 likes300 views
The document outlines a presentation on cybersecurity compliance, particularly for government contractors, led by Robert E. Jones, an expert with over 15 years of experience in defense contracts. It covers cybersecurity requirements, basic standards such as NIST SP 800-171, and essential compliance steps like employee training and device inventory. Additionally, it introduces the Cybersecurity Maturity Model Certification (CMMC), which will be required for defense contractors by mid-2020.
Cybersecurity: More than A DoD Issue
- 1. Cybersecurity: More than a DoD Issue
- 2. Robert E. Jones Government Contracts & Accounting Expert CPA, CPCM, NCMA Fellow Meet your presenter: • Robert has over 15 years of Department of Defense contract and accounting experience. • He has successfully managed over $400 million in federal contracts.
- 3. About us Left Brain Professionals is a boutique accounting firm that serves government contractors. We specialize in accounting system design, implementation, and audit support.
- 4. Our Services
- 6. Why we’re here To learn the basics of cybersecurity compliance for your business.
- 7. Learning Objectives • Identify the cybersecurity requirements in your contracts • Define the basic cybersecurity requirements • List simple steps you can take towards compliance • Get certified!
- 8. Identify Requirements in Your Contracts FAR 52.204-21 • Basic Safeguarding of Covered Contractor Information Systems DFARS 252.204-7012 • Safeguarding Covered Defense Information and Cyber Incident Reporting Focus on Systems vs Data
- 9. Identify Requirements • Other agency • Commercial requirements
- 10. Room Poll What cybersecurity requirements exist in your contracts? • FAR 52.204-21 • DFARS 252.204-7012 • Another agency • Other/commercial • I don’t know
- 11. Define Basic Cybersecurity Reqs • NIST (SP) 800-171 • COBIT 5 • SANS 20 • ISO/IEC 27001
- 12. NIST (SP) 800-171 • Access Control • Awareness and Training • Audit and Accountability • Configuration Management • Identification and Authentication • Incident Response • Maintenance • Media Protection • Personnel Security • Physical Protection • Risk Assessment • Security Assessment • System and Communications Protection • System and Information Integrity
- 13. Other Frameworks • COBIT 5 • SANS 20 • ISO/IEC 27001
- 14. Room Poll How many requirements are listed in NIST (SP) 800-171? • 14 • 110 • 171 • 222
- 15. Simple Steps Towards Compliance • Train all employees • Use multifactor authentication • Inventory all devices and software • Allow only certain devices to connect • Remote wipe devices • Utilize cloud storage
- 16. Train All Employees • Provide annual cybersecurity awareness training to all employees • Provide periodic threat updates • Utilize phishing test services • Provide advanced training to IT and other key individuals
- 17. Use Multifactor Authentication • Enable multifactor authentication on all PCs and servers • Enable multifactor authentication on all email, VPN, and networks • Enable multifactor authentication on as many software and accounts as possible
- 18. Inventory All Devices and Software • Take an inventory of all devices (PCs, servers, phones, tablets, printers, scanners) • Take an inventory of all software (including version and licenses) • Take an inventory of all users and access
- 19. Allow Only Certain Devices to Connect • Block access to all emails, networks, and servers by default • Allow access by exception
- 20. Remote Wipe Devices Setup remote access with wipe capability on all devices (laptops, phones, tablets)
- 21. Utilize Cloud Storage Take advantage of the security built into cloud applications and storage • FedRAMP for CUI on government contracts Not required for commercial contracts
- 22. Room Poll Which of the following is not a step towards compliance? • Training a select few employees • Taking an inventory of devices • Setting up remote wipe of devices • Utilizing cloud storage
- 23. Get Certified • New CMMC from DoD • Cybersecurity Maturity Model Certification • 5 levels • Will be required by mid-2020
- 24. CMMC 18 domains that mimic 14 categories in NIST (SP) 800- 171
- 25. CMMC 5 levels of certification
- 26. Room Poll Cybersecurity certification will soon be required for all defense contractors? • True • False
- 27. Discussion and Q & A
- 28. Connect with us Download the presentation Left Brain Professionals Inc. @LeftBrainPro @LeftBrainPro Email: support@leftbrainpro.com
- 29. Melissa R. Metzger MAFM melissa@leftbrainpro.com Robert E. Jones CPA, CPCM, NCMA Fellow robert@leftbrainpro.com