{"id":2747,"date":"2020-08-12T12:44:59","date_gmt":"2020-08-12T12:44:59","guid":{"rendered":"https:\/\/www.mstech.com\/?p=2747"},"modified":"2023-12-04T12:24:30","modified_gmt":"2023-12-04T16:24:30","slug":"security-goes-beyond-it","status":"publish","type":"post","link":"https:\/\/www.mstech.com\/security-goes-beyond-it\/","title":{"rendered":"Evidence-Based Security Goes Beyond IT"},"content":{"rendered":"\n

Business leaders that view security as an IT objective will leave their company vulnerable. And for some, that can translate to lost revenue in the years to come.<\/p>\n\n\n\n

For defense contractors in the DoD supply chain, the Cybersecurity Maturity Model Certification (CMMC) implementation<\/a> timeline is on the move. CMMC compliance for these organizations is essential and that means implementing security practices across all aspects of the organization. Businesses that gain the right level of certification early will benefit from near-term competitive advantage as compliance must precede contract bidding. Basically, if you don\u2019t have the right level of CMMC compliance at the onset, you can\u2019t even bid.<\/p>\n\n\n\n

Leaders motivated to prioritize, meet, and maintain compliance must take a broad view and evidence-based approach to security to ensure they\u2019re moving on the right path.<\/p>\n\n\n\n

Hopefully, for organizations in the DoD supply chain, the urgency is established. Business leaders not under specific compliance can also benefit from these practices to improve their overall security posture. There are a few insights we\u2019ve learned along the way to align security within your strategic business objectives:<\/p>\n\n\n\n

Security compliance requires collaboration beyond IT and across business units.<\/strong><\/h4>\n\n\n\n

To meet compliance, a broad view of the organization is necessary to identify and implement technical, administrative, and physical controls. But it\u2019s easy to assume that security\u2014and cybersecurity specifically\u2014falls solely into the technical world and thus would live with the IT department. After all, the IT department has the tools and resources to control system roles and access permissions. And systems are where our data lives. This mindset overlooks the administrative and physical security that is critical to safeguarding data, which is why business leaders are a critical component in driving a successful Information Security strategy.<\/p>\n\n\n\n

Viewing security from a technical perspective might form the walls of a house, but we\u2019re still missing the doors and roof. Which, to follow the metaphor further, leaves the house open and vulnerable to hackers walking right in. Positioning security as a shared objective and strategic priority of leadership fosters shared responsibility to evaluate, document, and audit what information is accessible across the organization. Security reaches beyond IT and compliance requires broad-spectrum, business-driven change.<\/p>\n\n\n\n

\u201cProving it\u201d takes place in every department.<\/strong><\/h4>\n\n\n\n

With CMMC preparation<\/a>, we find the greatest challenge for organizations is the new concept of \u201cproving it\u201d. There is no longer an option to \u201cself-attest\u201d to compliance as there was with NIST 800-171. If you say, \u201cWe only provide access to employees with a business reason to need it\u201d\u2014you\u2019ll need to support that statement with documented evidence for CMMC compliance. This is sometimes referred to as “evidence-based security”.<\/p>\n\n\n\n

 Each department must establish who has access to data, how they access that data, and why. If the right protocol isn\u2019t in place, like multi-factor authentication, taking steps to improve security may need to be adopted. Follow through on security practices will require follow up. Similarly, access to and within facilities must also be examined and proven to meet certain practices within CMMC compliance. Again, your information security objectives overall should reach far beyond your IT department alone. Outside of the technical controls, we must also consider the physical and administrative controls.<\/p>\n\n\n\n

This can seem daunting, there\u2019s no doubt about it. Identifying where data and information can be accessed and if that is appropriate or not takes a significant investment of time and resources. Your business has likely grown over time and your current practices are in place as a result of that growth. There\u2019s no better time to begin the task of reevaluation than today and, luckily, there\u2019s a place you can start.<\/p>\n\n\n\n

Begin with a Gap Analysis or Risk Assessment, but don\u2019t stop there.<\/strong> <\/h4>\n\n\n\n

A Gap Analysis will evaluate security practices against what you have in place today. At Mainstay Technologies, that analysis results in three documents used as tools for discussion and tracking: a comprehensive compliance report detailing findings, an initial draft of your Plan of Action and Milestones (POA&M) for risk management, and an executive summary synthesizing our recommended strategy and path moving forward. The goal is to walk away with a level of education and understanding of where you need to focus your attention to align with your day-to-day operation and compliance requirement. For Mainstay, our process includes mapping your existing practices by consulting leadership, human resources, sales, operations, and other business units.<\/p>\n\n\n\n

If opting for a Risk Assessment, it\u2019s an opportunity to assess and identify areas of compliance, non-compliance, or partial compliance with a set of required controls. The assessment helps to uncover areas of risk for a breach, data, leaks, and other issues. As part of the process, Mainstay will test, identify, and rate that risk. This allows for in-depth technical and organizational recommendations, closing gaps, improving compliance, and mitigating critical vulnerabilities. But you likely won\u2019t stop there. Resulting from these activities, you\u2019ll have a clear understanding of what needs to happen next. More than just IT, a comprehensive IT and Cybersecurity services partner like Mainstay<\/a> can assist in closing gaps and improving how you manage risk.<\/p>\n\n\n\n

Designated by the CMMC-AB, there are benefits to partnering with Registered Practitioners.<\/strong><\/h4>\n\n\n\n

Registered Practitioner Organizations (RPO) have been designated by the accreditation board to provide CMMC consulting services. Like many organizations, Mainstay Technologies is in the process of becoming one of the first companies to hold this designation along with our team of Registered Practitioners (RP). Our soon-to-be RP team members have extensive experience with information security program and compliance management. A CMMC consulting partner like Mainstay is intimately familiar with the basic constructs of the CMMC Standard and holds vast experience with preparing clients for an audit. Following a\u00a0Gap Analysis or Risk Assessment, we often partner for long-term, comprehensive IT and Cybersecurity services to support ongoing compliance.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Business leaders that view security as an IT objective will leave their company vulnerable. And for some, that can translate to lost revenue in the years to come.<\/p>\n","protected":false},"author":6,"featured_media":2748,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","content-type":"","footnotes":""},"categories":[14,10,18],"tags":[],"acf":[],"yoast_head":"\nSecurity Requires Strategic Collaboration Beyond the IT Department<\/title>\n<meta name=\"description\" content=\"Business leaders that view security as an IT objective will leave their company vulnerable. For some, that can translate to lost revenue in future years.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.mstech.com\/security-goes-beyond-it\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security Requires Strategic Collaboration Beyond the IT Department\" \/>\n<meta property=\"og:description\" content=\"Business leaders that view security as an IT objective will leave their company vulnerable. For some, that can translate to lost revenue in future years.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mstech.com\/security-goes-beyond-it\/\" \/>\n<meta property=\"og:site_name\" content=\"Mainstay Technologies\" \/>\n<meta property=\"article:published_time\" content=\"2020-08-12T12:44:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-12-04T16:24:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mstech.com\/wp-content\/uploads\/CMMC-Security-Mainstay-Blog.png\" \/>\n\t<meta property=\"og:image:width\" content=\"887\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"mainstay\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"mainstay\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mstech.com\/security-goes-beyond-it\/\",\"url\":\"https:\/\/www.mstech.com\/security-goes-beyond-it\/\",\"name\":\"Security Requires Strategic Collaboration Beyond the IT Department\",\"isPartOf\":{\"@id\":\"https:\/\/www.mstech.com\/#website\"},\"datePublished\":\"2020-08-12T12:44:59+00:00\",\"dateModified\":\"2023-12-04T16:24:30+00:00\",\"author\":{\"@id\":\"https:\/\/www.mstech.com\/#\/schema\/person\/668a5c95d20a2e1a34ee7efbd2922141\"},\"description\":\"Business leaders that view security as an IT objective will leave their company vulnerable. For some, that can translate to lost revenue in future years.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mstech.com\/security-goes-beyond-it\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mstech.com\/security-goes-beyond-it\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mstech.com\/security-goes-beyond-it\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.mstech.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Evidence-Based Security Goes Beyond IT\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mstech.com\/#website\",\"url\":\"https:\/\/www.mstech.com\/\",\"name\":\"Mainstay Technologies\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mstech.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mstech.com\/#\/schema\/person\/668a5c95d20a2e1a34ee7efbd2922141\",\"name\":\"mainstay\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mstech.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9b0b979190a1f16ceaa44ff389db93e4?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9b0b979190a1f16ceaa44ff389db93e4?s=96&d=mm&r=g\",\"caption\":\"mainstay\"},\"url\":\"https:\/\/www.mstech.com\/author\/mainstay\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security Requires Strategic Collaboration Beyond the IT Department","description":"Business leaders that view security as an IT objective will leave their company vulnerable. For some, that can translate to lost revenue in future years.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.mstech.com\/security-goes-beyond-it\/","og_locale":"en_US","og_type":"article","og_title":"Security Requires Strategic Collaboration Beyond the IT Department","og_description":"Business leaders that view security as an IT objective will leave their company vulnerable. For some, that can translate to lost revenue in future years.","og_url":"https:\/\/www.mstech.com\/security-goes-beyond-it\/","og_site_name":"Mainstay Technologies","article_published_time":"2020-08-12T12:44:59+00:00","article_modified_time":"2023-12-04T16:24:30+00:00","og_image":[{"width":887,"height":500,"url":"https:\/\/www.mstech.com\/wp-content\/uploads\/CMMC-Security-Mainstay-Blog.png","type":"image\/png"}],"author":"mainstay","twitter_card":"summary_large_image","twitter_misc":{"Written by":"mainstay","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.mstech.com\/security-goes-beyond-it\/","url":"https:\/\/www.mstech.com\/security-goes-beyond-it\/","name":"Security Requires Strategic Collaboration Beyond the IT Department","isPartOf":{"@id":"https:\/\/www.mstech.com\/#website"},"datePublished":"2020-08-12T12:44:59+00:00","dateModified":"2023-12-04T16:24:30+00:00","author":{"@id":"https:\/\/www.mstech.com\/#\/schema\/person\/668a5c95d20a2e1a34ee7efbd2922141"},"description":"Business leaders that view security as an IT objective will leave their company vulnerable. For some, that can translate to lost revenue in future years.","breadcrumb":{"@id":"https:\/\/www.mstech.com\/security-goes-beyond-it\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mstech.com\/security-goes-beyond-it\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mstech.com\/security-goes-beyond-it\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.mstech.com\/"},{"@type":"ListItem","position":2,"name":"Evidence-Based Security Goes Beyond IT"}]},{"@type":"WebSite","@id":"https:\/\/www.mstech.com\/#website","url":"https:\/\/www.mstech.com\/","name":"Mainstay Technologies","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mstech.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.mstech.com\/#\/schema\/person\/668a5c95d20a2e1a34ee7efbd2922141","name":"mainstay","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mstech.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/9b0b979190a1f16ceaa44ff389db93e4?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9b0b979190a1f16ceaa44ff389db93e4?s=96&d=mm&r=g","caption":"mainstay"},"url":"https:\/\/www.mstech.com\/author\/mainstay\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/posts\/2747"}],"collection":[{"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/comments?post=2747"}],"version-history":[{"count":1,"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/posts\/2747\/revisions"}],"predecessor-version":[{"id":232025,"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/posts\/2747\/revisions\/232025"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/media\/2748"}],"wp:attachment":[{"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/media?parent=2747"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/categories?post=2747"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mstech.com\/wp-json\/wp\/v2\/tags?post=2747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}