How Do I Comply With NIST 800-171 & CMMC?

There is a lot of information on the ComplianceForge website. We publish a considerable amount of guidance documents to help our clients identify what is most appropriate for them.  

From a "start here" perspective, baselining your level of understanding is critical so that you can make "apples to apples" comparisons from an objective perspective:

• NIST CSF vs ISO 27001 / 27002 vs NIST 800-53 vs NIST 800-171 vs SCF. Understand the differences between NIST CSF, ISO 27001/27002, NIST 800-53, NIST 800-171 and the Secure Controls Framework. We put together a useful guide on that topic.
• Policies vs Standards vs Procedures. Gain an insight into the differences between policies, standards, controls, procedures and other documentation components. The Hierarchical Cybersecurity Governance Framework (HCGF) puts those concepts into a "swim lane" diagram to make it easy to understand the relationships and the authoritative definitions from sources like ISO, NIST, ISACA and AICPA.
• Statutory vs Regulatory vs Contractual Obligations. Prioritize your "must have" vs "nice to have" requirements by understanding statutory, regulatory and contractual compliance.
• Strategic vs Operational vs Tactical. From a scoping perspective, understand strategic vs operational vs tactical considerations.
• Threats vs Vulnerabilities vs Risks. Understand the differences between threats, vulnerabilities and risks to appreciate how controls are central to your cybersecurity program.

Defense Contractor-Specific Guidance

We recognize that the US Defense Industrial Base (DIB) has a lot of unique cybersecurity challenges. Therefore, we put together some helpful information that is specific to the DIB:

• NIST 800-171 Compliance - Where Do I Start?
• What Is Controlled Unclassified Information (CUI)?
• ITAR vs EAR vs FAR vs DFARS (CUI & CMMC)

• NIST 800-171 R2 to R3 Transition Guide

  Sooner, rather than later, the US Government's global supply chain will have to transition to NIST 8...

• NIST 800-171 R3 Kill Chain

  The CMMC 2.0 & NIST 800-171 R2 version of the CMMC Kill Chain introduces the theory of constrain...

• NIST 800-171 R3 In A Nutshell

  It is worthwhile to take a look at NIST 800-171 R3 through a People, Process, Technology, Data &...

• NIST 800-171 R3

  NIST 800-171 Rev 3 was released on 14 May of this year, and it contains significant changes from the...

---