Latest release of our CMMC Reference Architecture is here!

Semi-annual update to Steel Root's managed compliance offering includes security and usability improvements, enhanced administrative controls, and updates to compliance implementations to help customers prepare for CMMC.

Semi-annual update strengthens cybersecurity for Defense Industrial Base and supports CMMC compliance readiness

With less than a year to go before CMMC requirements begin appearing in Department of Defense contracts, cybersecurity and CMMC compliance is top of mind for many defense contractors. That’s why Steel Root introduced last year our reference architecture for DoD compliance, a packaged offering focused on helping our clients get ready for CMMC. Purpose-built to meet all of the technical requirements in NIST SP 800-171, our CMMC-grade system is continuously developed to ensure that its technical configuration keeps pace with changes to compliance requirements, security best practices, and our clients’ business needs.

As part of our comprehensive CMMC offering, Steel Root customers receive regular updates to their IT systems, configuration baselines, and compliance documentation. Today’s release includes more than 30 updates to Steel Root’s proprietary system architecture, focused on enabling clients to advance CMMC readiness, protecting against accidental leakage of controlled unclassified information (CUI), more finely tuning access controls, and saving costs through automation.

Specifically, this new release includes security and usability improvements, enhanced administrative controls, and updates to compliance implementations across the following areas:

• CUI / ITAR data protection: Introduction of custom data loss prevention (DLP) rules to detect and control CUI and ITAR documents
  Including: New pattern match rules that can detect documents with header and portion markings for CUI Basic and Specified, DoD Distribution Statements B-F, and ITAR export control markings to prevent data spillage and alert administrators when sensitive data is shared externally.
• Access control: Adjustments to policies and configurations to enable more finely tuned security controls and streamlined administration
  Including: New administrative workflows for approving and managing privileged roles and controlling group creation. More granular conditional access policies to target Linux and non-standard operating systems.
• Endpoint management: New and updated security configurations for managed devices, including support for Windows 11 and improved compliance monitoring for mobile devices
  Including: New Intune device configuration profiles to disable password reveal functionality (NIST SP 800-171 3.5.11) and capture command line information in audit logs for enhanced forensics. Updates to streamline iOS and Android device management and monitor device compliance.
• Email security: Additional anti-phishing measures and improvements to email encryption and archiving
  Including: Improvements to help users identify fraudulent emails and impersonation attempts. Additional controls to restrict the use of legacy email protocols. Updates to email encryption mechanisms and email archiving.
• Automation: Cloud cost reduction through automation
  Including: Cost savings of up to 60% by automatically lowering Azure usage during off-peak hours
• Log management: Changes that affect security information and event management (SIEM) configuration to ensure constant vigilance across a client’s managed environment
  Including: New alert logic to detect suspicious and anomalous activity and abuse of administrative privileges. Data connector health monitoring mechanisms to alert in the event of an audit logging process failure (NIST SP 800-171 3.3.4).

We know that determining how to best implement and maintain cybersecurity best practices can be difficult even for organizations with dedicated security personnel—and it’s nearly impossible for contractors without cybersecurity resources. We’ve designed our CMMC offering to help our clients focus on growing their business by making it easy for them to meet contractual cybersecurity requirements.

Interested in having us create and execute an actionable plan to reach compliance?
Schedule a consultation with one of our experts to learn how it all works!