CMMC CERTIFICATION:
SPYRUS SOLUTIONS

With the CMMC certification requirement fast approaching, it is critical DIB organizations invest in a tried and tested technologies that are already NIST SP 800-171 certified.

SPYRUS has spent 20 years building and deploying military grade cryptographic solutions for the USG and private sector and can help organizations immediately meet level 3 of the CMMC framework.

SPYRUS Solutions address 60 practices within 10 of the 17 Capability Domains required by CMMC and NIST 800-171.

Slide 1

CAPABILITY DOMAINS

Click on box with a Rosetta lock to show how SPYRUS can help you achieve CMMC certification.

Access Control

ACCESS CONTROL

- Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- Control the flow of CUI in accordance with approved authorizations.
- Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- Employ the principle of least privilege, including for specific security functions and privileged accounts.
- Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- Limit unsuccessful logon attempts.
- Monitor and control remote access sessions.
- Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Asset Management

ASSET MANAGEMENT

- Visibility into the hardware devices, to include removable media, operating on the network.
- Discover/ prohibit new/ unauthorized devices that connect to the network.
- Identify all devices actually present.
- Address whether the device is authorized on the network.
- Address whether someone is assigned to manage the device.
- Prevent entry of malicious or compromised hardware from being installed on the system.
- Reduce the number of easy-to-compromise devices that are not actively administered.
- Prevent unauthorized hardware from being used for data exfiltration.

Media Protection

MEDIA PROTECTION

- Protect (i.e., physically control and securely store) system media containing CUI.
- Limit access to CUI on system media to authorized users.
- Sanitize or destroy system media containing CUI before disposal or release for reuse.
- Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
- Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
- Control the use of removable media on system components.
- Prohibit the use of portable storage devices when such devices have no identifiable owner.
- Protect the confidentiality of backup CUI at storage locations.

Situational Awareness

SITUATIONAL AWARENESS

- Protect (i.e., physically control and securely store) system media containing CUI.
- Limit access to CUI on system media to authorized users.
- Sanitize or destroy system media containing CUI before disposal or release for reuse.
- Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
- Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
- Control the use of removable media on system components.
- Prohibit the use of portable storage devices when such devices have no identifiable owner.
- Protect the confidentiality of backup CUI at storage locations.

Audit & Accountability

AUDIT & ACCOUNTABILITY

- Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
- Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
- Review and update logged events.
- Alert in the event of an audit logging process failure.
- Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
- Limit management of audit logging functionality to a subset of privileged users.

Personnel Security

PERSONNEL SECURITY

- Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

System & Communication Protection

SYSTEM & COMMUNICATIONS PROTECTION

- Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
- Separate user functionality from system management functionality.
- Prevent unauthorized and unintended information transfer via shared system resources.
- Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
- Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
- Establish and manage cryptographic keys for cryptography employed in organizational systems.
- Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
- Prohibit remote activation 27 of collaborative computing devices and provide indication of devices in use to users present at the device.
- Protect the authenticity of communications sessions.
- Protect the confidentiality of CUI at rest.

System & Information Integrity

SYSTEM & INFORMATION INTEGRITY

- Provide protection from malicious code at designated locations within organizational systems.
- Monitor system security alerts and advisories and take action in response.
- Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
- Identify unauthorized use of organizational systems.

Identification & Authentication

IDENTIFICATION & AUTHENTICATION

- Identify system users, processes acting on behalf of users, and devices.
- Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
- Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
- Employ replay-resistant authentication mechanisms for network access to privileged and non- privileged accounts.
- Prevent reuse of identifiers for a defined period.
- Enforce a minimum password complexity and change of characters when new passwords are created.
- Prohibit password reuse for a specified number of generations.
- Store and transmit only cryptographically-protected passwords.
- Obscure feedback of authentication information.

Recovery

RECOVERY

- Actions taken to render data written on media unrecoverable by both ordinary and, for some forms of sanitization, extraordinary means.
- Process to remove information from media such that data recovery is not possible. It includes removing all classified labels, markings, and activity logs.

Access
Control
(AC)
Incident
Response
(IR)
Risk
Management
(RM)
Security
Assessment
(SAS)
Maintenance
(MA)
Asset
Management
(AM)
Situational
Awareness
(SA)
Media
Protection
(MP)
Awareness &
Training
(AT)
Audit &
Accountability
(AA)
System &
Communication
Protection (SCP)
Personnel
Security
(PS)
System &
Information
Integrity (SII)
Configuration
Management
(CM)
Physical
Protection
(PP)
Identification &
Authentication
(IDA)
Recovery
(RE)

Our DevicePatrol platform consists of FIPS 140-2 level 3 certified endpoints and a robust endpoint management software enabling IT departments to dynamically manage authentication keys, audit data access activity, and “destroy” data and operability of endpoints anywhere in the world. Each endpoint is tamperproof and secured with a Rosetta HSM meeting NIST SP 800-171 standards of data encryption and multifactor authentication (MFA) and does not use to computing components of a host device.

When combined with our NcryptNshare secure collaboration application, files and folders can be secured with public key authentication and assigned access timers with end-to-end encryption to ensure complete data security at rest, in motion, and in use.

Download our CMMC White Paper to learn more about how SPYRUS Solutions help you quickly and immediately comply with up to Level 3 of the CMMC framework.

Visit our CMMC Resource Center to stay current on certification news.

Interested in how SPYRUS can help your organization with today’s security challenges?

CONSULT AN EXPERT