NIST SP 800-171 – Defending Against Organizational Risk

As a government contractor, adherence to NIST SP 800-171 requirements is not just an option, but an essential mandate. Proactive preparation for compliance with these security requirements is crucial in order to avoid potential disruptions to your business operations. This blog is focused on the Risk Assessment security requirement.

Key Takeaways

Performing regular risk assessments are essential for identifying and mitigating potential threats to an organization’s operations, assets, and individuals.

Scanning system components for vulnerabilities must be implemented and findings must be reported and addressed.
Prioritizing and remediating vulnerabilities allow organizations to reduce the likelihood of falling victim to cyberattacks.

Reviewing NIST SP 800-171 Risk Assessment

A risk assessment is a systematic process for evaluating vulnerabilities to cyber threats within an organization. Risk assessments help identify potential security weaknesses, assess the likelihood and impact of cyber attacks, and prioritize areas for improvement to a company’s overall cybersecurity posture. Performing regular risk assessments is vital in identifying vulnerabilities and threats to an organization’s operations and for monitoring Controlled Unclassified Information (CUI). This process is fundamental to maintain a company’s security posture and to protect corporate assets and reputation.

3.11.1. Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. This requirement focuses on the importance of regularly assessing risks to the organization’s operations, assets, and individuals. This means checking how the company’s systems and processes for handling CUI might face threats or vulnerabilities that could affect its mission, reputation, or people. The goal of this requirement is to understand these risks well enough to manage and effectively reduce them, ensuring the safety and security of sensitive information.

3.11.2. Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. Vulnerability scanning should be performed on each system component with the required scans and frequency determined by the organization. Vulnerability scanning includes scanning functions, ports, protocols, improper configurations, and services not currently available. There are three approaches that can be used to scan custom applications:

Static Analysis: Static analysis inspects code without executing the program.
Binary Analysis: Binary analysis inspects the binary numbers of the program.
Dynamic Analysis: Dynamic analysis inspects code during program execution.

The scanning process requires updates on new vulnerabilities detected to ensure that they are addressed in a timely manner. Information on vulnerabilities can be found on the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD).

3.11.3. Remediate vulnerabilities in accordance with risk assessments. A thorough risk assessment identifies vulnerabilities and assigns a risk level based on the likelihood and security impact. It is imperative that weaknesses found as a result of risk assessments are remediated in a timely and controlled manner. The following provides a roadmap for prioritizing remediation efforts.

Remediation Techniques:

Patching: Apply security patches released by software vendors.
Upgrade/Replace: Upgrade to a newer version or replace the entire system if patching is not available or effective.
Configuration Changes: Adjust system configurations, harden security settings, or disable unnecessary features.
Workarounds: Restrict access or isolate vulnerable systems. This should be implemented as a temporary measure while a permanent solution is being developed.

After applying remediation techniques, it is important to test the system to ensure the vulnerabilities are fixed and that no unintended consequences were discovered. Even after remediation, some risks may remain. Organizations should continuously monitor their systems and reassess the risk after implementing controls.

Continuous Monitoring

Consistent and thorough risk assessments, as outlined in NIST SP 800-171 Section 3.11.1, are paramount for effectively identifying and mitigating risks. By understanding and addressing the potential threats to operations, assets, and individuals, organizations can ensure a robust defense against cybersecurity challenges. A proactive approach with periodically assessing risks helps safeguard organizational integrity and builds trust. Risk assessment is an ongoing process. It is essential to regularly review and update assessments as the organization’s security posture evolves and the cyber threat landscape changes. System components should be assessed on a frequent basis using vulnerability scans. Risk assessments provide guidance to identify and prioritize organization’s cybersecurity vulnerabilities and help to identify areas that pose the greatest risk.

These are just a few examples of how to implement Risk Assessment whether you are a DoD Contractor or part of the Defense Industrial Base (DIB). Look for our next blog on Security Assessment.

Stay Ahead of the Game: Ensure Your NIST SP 800-171 Compliance for DoD Contracts

IBSS will use our 20 years of corporate DoD cybersecurity experience to prepare you for NIST SP 800-171 compliance. We specialize in developing cybersecurity strategies that align with organizational business processes to detect or prevent cyber attacks. We identify threats and vulnerabilities, and we assist organizations with managing risks to critical data. We provide expert support to promote compliance with Defense Federal Acquisition Regulation Supplement (DFARS), Federal Information Security Modernization Act (FISMA), Federal Risk and Authorization Management Program (FedRAMP), NIST SP 800-171, and Privacy requirements.

Related News