Our 2-Phase NIST Compliance Process

You can achieve NIST SP 800-171 compliance in just two phases- with the option to gain ongoing compliance management.

Phase I: Project Definition

First, we will develop your detailed project plan, charter, and reporting processes—with defined roles and responsibilities—so you know who will be doing what and when within your implementation.

During this phase, we will adapt our standard processes to your unique needs. We will discover your data’s accuracy and availability. We will review your existing business processes and workflows. And we will map your system architecture. When possible, we will also validate the data that you share with third parties.

By the end of this phase, we will give you a clear map of what Controlled Unclassified Information (CUI) you currently store, process, and transmit. Together, we will use this map to define a project that will fit into your requirements, budget, and timeline.

Phase II: Gap Assessment

Next, we will see how well each of the data elements that we chose to include in your project scope currently meets the NIST SP 800-171 framework.

To achieve NIST compliance, each of your data elements must meet a series of requirements that are grouped into 14 security domains. These domains are:

To see how well each of your data elements meets each of these security domains and requirements, we will perform a gap assessment. We will conduct a series of interviews, process walkthroughs, artifacts validations, and reviews of your policies, procedures, and system configurations.

By the end of this phase, we will give you a complete picture of your current state and where you currently fail to achieve NIST compliance. Depending on the scope of your project, we may also define a prioritized roadmap and a Systems Security Plan (SSP) that will address the compliance gaps we’ve found and efficiently move you into good standing with NIST.

Phase III: Compliance Management

Depending on your needs, we can provide a range of additional compliance management services.

• We can review your gap analysis, and tell you which remediation actions to prioritize to produce the biggest impact on your compliance as quickly as possible.
• We can track your gaps in compliance, display them on a compliance management dashboards, and provide real-time status updates and next-steps for every
  remediation stage.
• We can align your NIST compliance requirements with your other compliance frameworks to create an efficient, scalable plan to achieve and maintain good standing with them all.
• We can create a bespoke calendar of activities that you must complete to maintain compliance and then train your key stakeholders to play their role in maintenance.

Finally, we offer a range of additional services that can be folded into your NIST SP 800-171 project. These additional services will help you maintain NIST compliance with less work while improving your baseline security posture. These services include, but are not limited to: