Automated SSP Preparation for CMMC

How CyberOne can help you build your SSP

If your organization works as a defense contractor, it must assure that it has done its due diligence to comply with all applicable NIST, DFARS, and CMMC compliance requirements.

CyberOne can help by automating documentation collection for CMMC compliance (and multiple other frameworks) through integration or automated notifications and our best-in-class portal.

CyberOne supports global compliance frameworks and security requirements, including FedRAMP, NIST, ISO, COSO, CIS, and more — and provides cross-references to existing documentation you may already have in place to support CMMC mapping.

CyberOne simplifies the self-assessment process by delivering a single, central dashboard to help you visualize your compliance stance, across all applicable frameworks; identifying the gaps in your cybersecurity program, and telling you how to fill them.

CyberOne doesn’t pay for marketing. Our clients do it for us.

Automated compliance and risk management from a single source of truth.

See it here today

CMMCAB Latest News

 

 

The CMMC Advisory Board has appointed Melanie Kyle Gingrich to lead training and development. Previously, the Senior Vice President of Product Development for Monster Worldwide, she has been charged with training and standing up a CMMC ecosystem of organizations that develop course materials and train assessors as the CMMC Board prepares to roll out its first certifying organizations this summer. Read more here from FCW.

CyberOne Security provides CMMC readiness and continuous monitoring to prepare and support you through the lifecycle of your CMMC certification process. From your 800-171 Self Assessment submission to the SPRS through control implementation, evidence verification, certification with our C3PAO partners, and continuous control monitoring for re-certification, CyberOne provides step-by-step guidance and automation that saves time and provides complete assurance for certification success. Oh, and, most important of all, it’s affordable for all-size organizations.

  1. Control Self Assessment for DFARS CyberSecurity Requirement
  2. CMMC Control Mapping to 800-171
  3. Automated Evidence Collection
  4. Certification Readiness Report
  5. C3PAO connection
  6. Continuous Monitoring post-Certification

Read our reviews on Capterra and contact us now for your FREE CMMC Evaluation.

 

DarkSide: The Consumerization of Hacking

 

The Colonial Pipeline Co. attack brought to light well-documented susceptibilities to our aging energy infrastructure in the US. It also demonstrates the real and growing threat that cyber-crime poses to our society, as well as a growing trend in the cybercrime market, that of RaaS, Ransomware as a Service. This is the consumerization of cybercrime, where hacker collectives literally operate as a business serving clients with ready-for-use ransomware tools that can be used to deliver attacks on global companies.

For more information on the hack and its perpetrators, DarkSide, read the Krebs on Security article that takes a close look at “DarkSide” and its operations.

Hacktivists turned Capitalists

Hacker groups or collectives are nothing new. The first documented incident of hacking dates back to 1971 and is attributed to a Vietnam Vet, John Draper, who figured out a way to make free phone calls. Inevitably, hacking has come a long way since John decided he needed to make free long-distance calls, becoming very much a part of the mainstream of social lexicon, even glamorized to a large extent by hackers themselves as well as a largely uninformed Hollywood portrayal of “hacktivist” culture. Far from the Hollywood “freedom fighter” portrayal of the hacker, the blackhat industry has always largely been about making money, but in recent years has become bolder and better, while seemingly losing all ethical values.

Who is at risk?

These hacking collectives will tell you that only the largest companies that can “afford to lose a few million” are targeted. They also claim that state actor projects, or geopolitics, are off the table with the sole aim of these groups to serve as a sort of online Robin Hood – taking from the rich… Oops, seems like they forgot about giving back to the poor. The reality seems far less “ethical” and far more indiscriminate. This week, a single, albeit major, pipeline operation was interrupted. Just three months ago, a small Florida city water company was hacked. School districts and universities have been targets and, of course, most industry sectors have been and continue to be targeted, from carpet manufacturers to the big banks. All in all,  it is estimated that 2,400 U.S.-based government, healthcare facilities, and schools were victims of ransomware in 2020 alone. Pre-IPO companies who are trying to safeguard sensitive data before going public are a popular target. The reality is that these attacks have a cascading fallout that impacts our safety, our health, our economy, our taxes, our livelihoods. Who is at risk? All of us it would seem.

Consumer Beware

Yes, based on the above, corporations are largely the chosen victims of ransomware. However, if you think this makes you immune as an individual, well, think again…

This attack crossed over into the public domain, closing a major US oil and gas pipeline, leading to a widespread fallout ranging from lines at the gas stations and a shortage of fuel, rising gas prices, to fallout – thankfully minimal –  in the stock market.

Corporations that have suffered ransomware attacks are lobbying governments to provide bail-out funds to enable them to beef up security practices to help protect against future attacks. What we may never know (of course we know) is whether appropriate security measures were in place prior to these attacks? From a consumer perspective, that cost is now being passed on to you in the form of higher product prices, lack of wage increases, and of course in your taxes.  If this sounds like the great TARP bailout of 2008, where citizens effectively paid the billion-dollar bonuses of bankers, well… your hearing might be good.

As Krebs reports, experts say ransomware attacks will continue to grow in sophistication, frequency, and cost unless something is done to disrupt the ability of crooks to get paid for such crimes. Last month, a group of tech industry heavyweights lent their imprimatur to a task force that delivered an 81-page report to the Biden administration on ways to stymie the ransomware industry. Among many other recommendations, the report urged the White House to make finding, frustrating, and apprehending ransomware crooks a priority within the U.S. intelligence community, and to designate the current scourge of digital extortion as a national security threat.

Corporate “Oversight”

As corporations either invest or receive bailout money to build out security, corporations will invest in tools to scan networks, environments, systems, and assets in an attempt to pre-empt and detect threats. However, this data needs to be managed effectively, prioritized, and applied to people, process, and technology to have any impact. This is where companies can fall short and is a gap that CyberOne is trying hard to help them fill.

We want all companies to build a culture of risk across their organization. This starts with effective governance and leadership commitment to risk awareness and providing resources for effective risk management. While many companies are able to provide compliance certifications as a demonstration of commitment to security, risk management is really the key to effective security.

For more information on risk management implementation contact CyberOne

 

 

May is Free: Get Your CMMC Free Readiness Assessment

 

For the entire month of May, CyberOne is offering a free readiness assessment for CMMC Certification. The Assessment is compatible with the 800-171 Assessment required by the SPRS. Click on the link below and put CMMC in the message field. We will respond with your assessment:

FREE CMMC Assessment

Fully Guided CMMC Implementation and Certification – no need for costly consultants:

CyberOne’s full suite GRC platform enables you to complete every step of the CMMC Certification process. We provide you all the tools and information you need to achieve and maintain certification on CyberOne’s highly automated, modern SaaS platform. Before you engage an MSP or consultant, check out what we can do for you. Request a demo today.

  • NIST 800-171 Control Self Assessment, SSP (get it for free here)
  • Policy Development Support
  • CMMC Control development and implementation guidance (level 1-3)
  • Automated Evidence Collection and review
  • Mitigation and Issue Management for POA&M’s, Findings and Risk Environment
  • Risk Register for proactive risk management
  • Vulnerability Scans & Analysis
  • Our Auditor-ready platform can be used in collaboration with C3PAO’s for Certification
  • Contact with C3PAO’s ready to certify you with CyberOne special pricing

 

CyberOne with Slack for Alerts & Risk Mitigation

 

 

 

 


CyberOne’s GRC lifecycle Saas platform provides an open API for integration with most modern business systems. If your company is using Slack, you can integrate with CyberOne to manage risk mitigation, send alerts and notifications to slack, create communication channels within your organization and directly with CyberOne Support. See the workflow below for more information or contact us for your demo.

  1. Authenticate to Slack
  2. Create your #1risk channel to communicate directly with CyberOne
  3. Send alerts and notifications from CyberOne to Slack

The CyberOne Security extensible, GRC lifecycle Saas platform is your single source of truth for Policy, Risk, and Compliance management. Built for companies of all sizes, we help automate and integrate your policy, compliance, asset, risk, incident, and business continuity management. Manage all your certifications on CyberOne (SOC 2, ISO 27001, CMMC, PCI, HIPAA) with our cross-referenced framework library with more than 100 global frameworks. CyberOne also provides policy, control, evidence, risk register and assessment templates, and step-by-step training and implementation guides. There’s no more need for costly consultants, or confusing, demoralizing spreadsheets!

INTEGRATE. AUTOMATE. THE POWER OF ONE

 


Slack API app – CyberOne Risk Workflow Sample

Incoming Webhooks:

Webhook #1. When Finding is created and when user clicks on Send Email Registration, create a message to Slack that say:

Icon: https://fontawesome.com/icons/shield-virus?style=solid

color: #FA7C00

Title: Issue Management

You have a new request. Click on Mitigate Risk if you can resolve the issue by the assigned due date or if you need more time, click on Exception Request to obtain risk approval.

Finding Name – <insert>

Source Type – <insert>

Due Date: <insert>

Primary Contact: <insert>

Finding Description – <insert>

If Yes, (populate finding response = Mitigate Risk and create Risk Mitigation record to associate with Finding)

If No (populate Finding response = Exception Request and Create ER record to associate with Finding)

Sample Slack Integration with CyberOne