Announcing Our New Partner Product: CUI Scoping and Data Flow by DEFCERT

Find Your CUI, Find CMMC Confidence 

Are you preparing for CMMC (Cybersecurity Maturity Model Certification), but are not confident about where all your organization’s CUI is?

If you’re not sure about your assessment boundary and having a hard time finding CUI, you’re not alone.

A foundational step toward establishing a “CMMC ready” cybersecurity program is properly establishing your assessment scope. This scope dictates the locations where security measures need to be implemented to properly achieve certification. This scope is dictated by the flow of CUI (Controlled Unclassified Information) throughout your organization.

Identifying CUI can be a daunting task for many organizations, leaving them with very little confidence in the outcome of their efforts. Unfortunately, this often leads to improper scoping and inadequate protections being applied to CUI data. Additionally, many of the same struggles reappear when organizations are determining if data they create and produce is CUI, ultimately leading to inflated technology costs, resource burdens, failed assessments, or potential fines from the government.

So, how can your organization inject confidence in their ability to perform this foundational step in their CMMC journey?

Summit 7 is excited to introduce our new “CUI Scoping and Data Flow” product, from one of our preferred partners, DEFCERT.

DEFCERT has established themselves as an innovative leader in helping organizations find and secure their CUI data. DEFCERT customizes their service for each organization’s particular DFARS contractual needs and uses a combination of scanning tools and manual reviews to ensure CUI is properly identified, tracked, and protected. They not only help clients discover CUI that’s already present in their environment, but also help identify the flow of CUI throughout business operations and establish safeguarding measures to identify it appropriately in the future.  

How DEFCERT Works

Using a CT scan as a guiding metaphor, we can better understand how DEFCERT discovers CUI in an organization's system, identifies any potential issues, and creates a strategy for compliance:

Initial Consultation (Expectation):

Like an initial meeting with a doctor to define why a CT scan is needed and what the CT scan aims to find, DEFCERT and the customer begin the process by searching the customer’s contracts for CUI and safeguarding requirements that will define the scope of the project clearly.

Contrast Material (Preparation):

In a CT scan, contrast material is used to highlight specific areas of the body for a clearer image. Similarly, DEFCERT maps out the customer’s cybersecurity landscape by combing through their business processes to illuminate and highlight the presence of CUI within their organization.

Scan Initiation (Examination):

Just as a patient undergoes a CT scan to identify internal issues, DEFCERT initiates a comprehensive scan of the organization’s digital environment using Microsoft Purview Content Search. DEFCERT starts its examination by searching through various data repositories, networks, and systems to identify any potential instances of CUI.

Scan Reading & Diagnosis (Identification):

Similar to how the CT scan highlights abnormalities in the body, DEFCERT provides a subject matter expert to assist the client in identifying CUI and properly scoping their environment;  identifying areas of potential “spillage” and offering suggestions for client action to remediate the finding.

Prescription (Solution):

As a doctor would follow up CT Scan results with a treatment plan, DEFCERT assists the client in documenting, establishing, and maintaining proper data flow. DEFCERT helps organizations develop strategies to limit CUI flow to core business processes, IT systems, supplier interactions, 3rd party applications, and external services/providers.

Monitoring and Next Steps (Education, Maintenance, and Improvement):

Just as many medical conditions discovered in a CT scan require monitoring and next steps, DEFCERT educates the organization on the identified requirements, and then teaches the customer how to execute this process in the future. The customer is assisted by DEFCERT to develop a CUI identification “checklist” for data created post-engagement. They will also be provided a cloud compliance report and external service provider evaluation that suggest further action for compliance success.

How DEFCERT can help your organization achieve compliance

If you are an organization looking to ensure your CMMC compliance, you will be pleased with DEFCERT’s  advanced capabilities in helping organizations develop data flow and safeguarding strategies.

With DEFCERT, you will learn to properly develop an assessment scope and maintain data flow. You will learn how to establish and measure your data safeguarding efforts, identify gaps in security, and develop an effective plan to properly protect CUI now and in the future.

Most importantly, you will feel confident in your data protection strategy.

If you want to make sure that your company’s CUI is properly secured so you can confidently share with your higher ups that you are moving toward CMMC certification, DEFCERT is an ideal partner.

To learn more, fill out the form below and someone on our team will reach out to you shortly.