ComplianceForge is very pleased to highlight another successful implementation of the NIST 800-171 Compliance Program (NCP) for Cybersecurity Maturity Model Certification(CMMC). This use case showed the flexible nature of the documentation being able to cover managed services.
Logos Systems is a Texas-based Managed Security Service Provider (MSSP) and vCISO firm serving defense contractors and other regulated organizations that handle Controlled Unclassified Information (CUI). Logos used the NCP for its documentation and it just obtained its CMMC Level 2 certification, following an assessment by an independent Certified Third-Party Assessment Organization (C3PAO). The assessment covered the Logos Systems CUI enclave, the environment Logos uses to deliver security services and its responsibilities under its Shared Responsibility Matrix (SRM). The assessor's findings were a score of 110, with no open items on a Plan of Action and Milestones (POA&M).
William Birchett, CEO, Logos Systems: "The NCP got us most of the way, about 80% of the documentation. To take it to 100%, we scoped our environments with the Unified Scoping Guide (USG), applied the risk and maturity models from the Secure Controls Framework (SCF),and mapped our evidence to the NCP’s Evidence Request List (ERL). As an MSSP, we also had to say what each control means when we do it for someone else. So we wrote that down as our Service Standard. It drives our shared responsibility matrix, and we turned each control's cadence into checklists our team works from every day. The documentation, the matrix and the day-to-day work all say the same thing."
Logos is a MSSP, where it operates the controls inside many clients' environments. Each control had to say what Logos does for a client, in words the delivery team uses every day. The NCP supplied roughly 80% of the documentation (e.g., policies, standards and procedures an assessor expects).The last 20% is what makes a document set true for one specific organization. For an MSSP that meant scope (e.g., who does what, how often, how risk / maturity are judged and where the evidence lives).
One control vocabulary runsthrough policy, delivery, tickets and evidence.
Logos built a Service Standard from the NCP. For each control, the Service Standard states what the control means as a managed service. This process translates the NCP's wording into Logos's service vocabulary and operations.
Turned control cadence into checklists. Each control's cadence (e.g., weekly, monthly and longer) became a recurring checklist task. Requests and incidents get a checklist from their ticket type.
Mapped checklists align with NIST 800-171, where checklists are tied to Assessment Objectives (AOs), so completed work becomes assessment evidence as a side effect of doing the job. Used the Service Standard to drive the SRM. Due to how each control already states what Logos does as a service, the SRM follows from it: it shows which objectives Logos covers for a client and which stay with the client. The standard and the matrix stay consistent because one comes from the other.
