Category: Security

CMMC 2.0 Updates

cmmc 2.0 updates

WHAT IS CMMC 2.0?

The Cybersecurity Maturity Model Certification (CMMC) was introduced by the U.S. Department of Defense (DoD) on January 31, 2020 to ensure the protection of sensitive unclassified information or controlled unclassified information (CUI).

Originally, the CMMC framework had five levels of cybersecurity maturity (basic to advanced/progressive) and affected more than 300,000 defense contractors. However, on November 4, 2021, the DoD formally announced the CMMC 2.0 framework. This updated version seeks to simplify the model and reduce compliance costs by streamlining the program and scaling back the requirement that all defense contractors obtain third-party certification of their cybersecurity capabilities. Under CMMC 2.0, about 80,000 contractors will have to undergo third-party assessments while contractors at non-critical CUI levels are able to self-certify. Additionally, contractors who are not yet in full compliance with applicable cybersecurity requirements will be permitted to perform less sensitive contracts if they make a Plan of Action & Milestones (POA&M) and commit to completing the remaining requirements within specified dates. These changes are reflected in the diagram below (published by the DoD):

WHAT ARE THE NEW LEVELS?

1️⃣ Level 1 (Foundational) only applies to companies that focus on the protection of federal contact information (FCI). It is comparable to the old CMMC Level 1. Level 1 will be based on the 17 controls found in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information, and focus on the protection of FCI. These controls look to protect covered contractor information systems and limit access to authorized users.

2️⃣ Level 2 (Advanced) is for companies working with controlled unclassified information (CUI). It is comparable to the old CMMC Level 3. CMMC 2.0 Level 2 (Advanced) requirements will mirror NIST SP 800-171 and eliminate all practices and maturity processes that were unique to CMMC. Instead, Level 2 aligns with the 14 families of security requirements and 110 security controls developed by the National Institute of Technology and Standards (NIST) to protect CUI. Accordingly, the 20 requirements in the old CMMC Level 3 that the DoD had imposed were dropped, meaning that the new Level 2 (Advanced) is in complete alignment with NIST SP 800-171.  Identified within DoD contracts under DFARS 252.204-7012 clause.  DoD is still working to define the “critical” CUI information.

3️⃣ Level 3 (Expert) is focused on reducing the risk from Advanced Persistent Threats (APTs). It is designed for companies working with CUI on the DoD’s highest priority programs, estimated to be about 600 companies. It is comparable to the old CMMC Level 5. The DoD is still determining the specific security requirements for the Level 3 (Expert), but has indicated that its requirements will be based on NIST SP 800-171’s 110 controls plus a subset of NIST SP 800-172 controls.

WHEN WILL CERTIFICATION BE REQUIRED?

The DoD is in the rulemaking process and negotiations with the CMMC Accreditation Body, which is expected to take an additional 9-24 months. While these rulemaking efforts are ongoing, the DoD is suspending mandatory CMMC certification, however, it is strongly recommending defense contractors act now and get CMMC assessed/certified to minimize the risk of DIB companies exposing sensitive unclassified information.

HOW TO GET STARTED

Defense contractors looking to start their CMMC compliance journey should look into meeting the 110 controls in NIST 800-171 as soon as possible, as preparation and implementation can take up to 18 months or more.

Not only can we help you achieve NIST-SP 800-171 compliance, but we can also perform a comprehensive gap analysis and determine your current SPRS score.  Then work with you on a plan to resolve areas of non-compliance. As a full-service I.T. firm, we can also implement solutions to address gaps so you are ready for CMMC certification and future audits.

CONCLUSION

CMMC 2.0’s cybersecurity standards will better arm the DoD in its efforts to defend against cyberattacks that threaten U.S. critical sectors. But it’s clear that the DoD cannot wait for CMMC 2.0 formalized assessments to improve cybersecurity in the Defense Industrial Base. While the CMMC 2.0 requirements work their way through the federal rulemaking process, enforcement of federal cybersecurity regulations governing defense contractors has stepped up. If you’re seeking future business with the Department of Defense, it’s important you get started on the compliance path right away.

5 Benefits of Co-Managed I.T.

Co-Managed I.T.

Managing the complexity of networks and servers, compliance standards, cybersecurity, application updates, software licenses and patches, hardware replacements, and more – all while trying to keep up-to-date with new technology and provide 24/7 support – is a lot to expect from one employee.

Let’s face it, your I.T. department is an essential and necessary part of your business, but even your most competent staff can’t do it all or know it all. That’s where co-managed I.T. comes into play.

Co-managed I.T. is a strategic model that blends the convenience of an internal I.T. team with the outside support of a managed service provider (MSP). It allows businesses to customize which I.T. services they provide in-house and determine where they can use an “extra pair of hands”.  For example, your existing I.T. team might manage software updates, installations, and cabling, but your external partner provides help-desk support and cybersecurity training.

For companies with limited internal resources, co-managed I.T. offers business agility and has significant cost and operational benefits. Here are the top five.

TOP 5 BENEFITS OF CO-MANAGED I.T.

  1. I.T. Expertise On-Demand – If you run into issues your employees have less experience resolving, your co-managed support team can provide their expertise. Opting to offboard some of the problems they don’t know how to fix internally is a great way to leverage MSPs’ expert resources. Not only is their focus on I.T. best practices, but they’ve seen a wide variety of issues, so they know how to handle and resolve pretty much anything.
  2. Increased Productivity – A co-managed service model typically covers routine maintenance, upgrades, and patches. Your systems will run more efficiently, resulting in fewer interruptions to operations. You’ll also benefit from additional support during peak “demand periods,” so your internal I.T. team doesn’t have to stop working on major projects for minor emergencies.
  3. Around-the-Clock Support – One of the most significant advantages of using a co-management I.T. model is offering round-the-clock support to customers outside of regular business operating hours. MSPs can also help cover things like sick or vacation time, eliminating the need to pay overtime or stagger your staff’s schedules.
  4. Better Security – Splitting the responsibilities of your I.T. infrastructure between you and a third-party company creates layers of security, making entry into your organization more difficult for bad actors. Many companies choose to keep their most crucial I.T. functions in-house while offloading the rest to a managed service provider. Additionally, because MSPs focus on industry standards for cybersecurity management, you can rest assured knowing that they take every precaution to keep your business data safe.
  5. Less Burnout and Boosted Employee Morale – Business insights, improved strategies, quicker response times, professional consultations, and decision support are empowering tools that can help to foster a more positive employee culture among your I.T. team. By giving them the resources they need to be successful, you create a work environment that promotes longevity and reduces burnout.

The right co-management partner can transform your existing I.T. team by resolving tickets faster, supporting your staff during off-hours or peak times, meeting unique project needs, and keeping up with changing market demands and technological advancements.

As the leading MSP in Dayton, we offer technology and compliance assessments, personalized insights and recommendations, access to the latest technology, and a robust suite of managed services. If you’re interested in co-managed I.T., we can help you navigate options and put together a package that’s right for you.

Call us at 937.490.5600 or contact our team of I.T. experts today to learn more.

Ransomware 3.0 | Cyber Risks in IoT Devices

news from microsoft

Ransomware 3.0

Ransomware attacks continue to get worse. They have now expanded to extort not just the companies, but also contractors and customers, in a “Triple Threat”. In addition to encrypting a victim company’s data, they will also exfiltrate, or download, copies of company data and emails. They will ask for one ransom to decrypt the computers, a second ransom to not make the stolen data public, and then the newest ransom attack. They reach out and present the data to customers, contractors, and business partners and demand a ransom from them in order to not have the data published. With phishing emails still being the number one attack vector for ransomware, be sure you have sufficient protection for your company. A combination of quality user education, phishing exercises and awareness campaigns, and system endpoint protections provides an in depth defense to this constantly evolving threat.

What does this mean for your business?

Back To Business I.T. has you covered. Our cybersecurity training programs are customized to meet the needs of your workforce and are designed to create a “human firewall” inside of your business. Building upon that, we offer state-of-the-art intrusion detection systems to stay one step ahead of cybercriminals. Don’t become a cyber statistic. Contact our team today and get Back To Business.

LinkedIn breach could mean your information was exposed

Just when you thought you had seen it all, think again! LinkedIn is the latest victim of phishing attacks. According to USA Today, firms are stating that cyber attackers are now posing as “boring, authentic, cubicle-office dwellers.” On top of these reported phishing attempts, CyberNews reports that the cyber attackers have also scraped data from 500 million LinkedIn accounts. The information leaked includes LinkedIn IDs, full names, email addresses, phone numbers, and various other sensitive information. Due to the leak of information, customers may be susceptible to increased email and text spamming or phishing.

What does this mean for your business?

Tighten up your security measures, and encourage your employees to do the same. Be conscious of strangers requesting to follow your LinkedIn profile. Consider changing your password periodically. Enable two-factor authentication for your account if possible. This additional layer of security serves as another barrier between your information and bad actors on the internet.

Manufacturing systems and IoT devices present high risk

IOT and other embedded manufacturing systems can present a high risk to your data and operations if not properly secured. Basic security steps can greatly improve your overall risk posture. From doorbells and cameras to CNCs and additive manufacturing systems, there are simple steps you can take to reduce the risk and exposure of the business side of your operations.

What does this mean for your business?

Your network is unique, and your security measures should be too. Your manufacturing systems and devices should be protected using industry best practices. Preventative steps such as changing default passwords, keeping your systems properly patched, and separating crucial systems from the rest of your network can make the difference between a few minutes of down time, and your entire operations coming to a halt. Our team is experienced in manufacturing environments, and passionate about our clients’ security. Contact us today to learn what we can do for your operations.

Microsoft announces 24 new issues posing cybersecurity threats

Microsoft announced the discovery of 24 issues in a wide range of IoT and OT devices. These issues allow malicious individuals to execute code on or crash your devices. This affects a wide range if industrial, medical, and enterprise devices. It is vital to your security to have an active inventory of the assets on your network, monitor them for vulnerabilities, and patch them regularly.

What does this mean for your business?

Our team of experts stands ready to help your organization take care of risks inside your network that you might not know are there. Cyberattacks are at an all-time high…and getting worse every day. We are here to help!

Cybersecurity risks continue to evolve, and so do our tools to fight them. We are passionate about protecting small businesses, and stay up to date on technology and cybersecurity best practices. Contact us today and let us show you how our cybersecurity services can help your business stay safe in an uncertain world.

Call us at 937-490-5600 or Contact Us to learn more or get started.

Common Sense and Cybersecurity

Common sense and cybersecurity

Earlier this month, Colonial Pipeline’s operations came to a halt after a ransomware attack orchestrated by DarkSide, an Eastern European cybercriminal organization. It took several days after the May 7 attack for the company to begin restarting parts of their systems as well as the mainlines. The effects were widespread and felt by most of us – gas prices at the pump fluctuated almost immediately.

As a society, we are becoming increasingly desensitized to news like this. Cyberattacks happen so often, it seems, that it’s hardly news. So why is it that so many businesses still don’t take cybersecurity seriously? There’s a shroud of mystery surrounding cyber – the media portrays hackers as hooded criminals lurking in a dark room. And while cybercrime methods change constantly, there are measures companies and individuals can take to protect their data. Those steps aren’t mysterious; they’re not hidden. Maybe they’re so simple – so rooted in common sense – that it’s easy to overlook them, and dismiss their importance.

 “The problem with common sense is that it is not so common.”

Maybe it’s easy to dismiss simple ways to implement cybersecurity because “well, everyone knows to do that.” The truth is maybe not everyone knows. Maybe “common sense” isn’t as common as we would like to think. For example – do you lock your doors when you’re not home? Chances are you do. It’s one of the most basic things to prevent entry and protect what’s inside. One of the easiest ways to protect your business data is to password protect your computer systems. This most rudimentary of security measures, which costs nothing to implement is still not being used by many businesses.

Along the lines of common sense, let’s revisit the events following the Colonial breach. Gas prices increased, media coverage heightened awareness of a potential (temporary) shortage. Some people took to the pumps to fill up before it got worse. Others took more drastic measures, filling up plastic bags with gasoline. Common sense would tell (most of) us it’s a bad idea to fill a plastic bag with gasoline, but the truth is not everyone has the same thought process and the same information. So much so that the US Consumer Product Safety Commission announced on social media that it was, in fact, a bad idea to fill plastic bags with gasoline.

This is an extreme case, most of us probably understand why it’s not a good idea to fill a bag with gasoline. But many businesses are doing the cybersecurity-equivalent of this, likely without realizing it. For example, if your company has data on computers that aren’t password-protected, or even protected by passwords such as “password1234” – that’s a potentially disastrous situation.

Cybersecurity: Start with common sense

Cybersecurity for your business doesn’t have to be complicated, unattainable, and cost-prohibitive. It would be irresponsible for us to reduce cybersecurity to just password-protecting your computers – but the truth is that you can start with simple steps like that. The password illustration is easy to understand but is by no means the gold standard as far as security measures go. Using common sense – perhaps the best of the senses – can help jumpstart your cyber approach. Your business technology is unique; your cybersecurity strategy should be unique, too. We can start where you are – whether that is as simple as password-protecting your systems or as complicated as monitoring network traffic for anomalies. Every business that uses technology in some way is vulnerable to cyberattacks, from pipelines to pop-up boutiques. Don’t wait until something disruptive brings your operations to a halt. Let’s start today.

Contact our team to talk about cybersecurity solutions for your business, from the tried-and-true to the cutting edge.

Cloudy with a Chance of Data Loss

cloud backup

What would happen if your company lost all of its email data? If you’ve yet to implement a backup solution for your Microsoft 365 data, you could be faced with that question if a cyber-incident occurs.

Over a million businesses use Microsoft 365 – chances are, you do too! By far the most popular productivity suite, this Microsoft product includes apps such as Outlook, Word, Excel, PowerPoint and others, depending on your configuration. But did you know that Microsoft is not responsible for backing up the data on in your Microsoft 365 suite?

Why Microsoft 365 Customers Need a Backup Solution

Many business owners using Microsoft 365 believe that their data is totally secure. The reality, however, is a different story. Although Microsoft offers many benefits in productivity, efficiency, and collaboration with Microsoft 365, the company doesn’t provide users with a comprehensive backup system for their underlying data.

Mechanical malfunctions and physical damage, hacking and theft, user error, and power outages all put user data at risk in the cloud. Protecting data has never been more important – hackers are now attacking computers and networks at a rate of one attack every 39 seconds. While companies do their best to prepare for these problems, no plan is foolproof, and stories of data loss are far from rare, with the average data breach costing small businesses $149,000. Furthermore, 60% of small businesses close their doors within 6 months of a data breach.

Cloud Backup Saves Data, Time, and Money

The fact is that having only one copy of important data is asking for trouble, whether it’s stored in the cloud or elsewhere. If your data isn’t backed up, you could be facing not only a loss of productivity as you scramble to rebuild, but also a loss in revenue and reputation.

Microsoft 365 is an excellent service that gives you access to your data from virtually any place at any time — and across many devices. As a software-as-a-service (SaaS) built on the industry-leading Azure public cloud, Microsoft 365 offers users high reliability, geographic redundancy, and secure connectivity.

This should not, however, be confused with a comprehensive data protection solution. Microsoft does not back up Microsoft 365 user data, so it recommends that customers use third-party solutions. Furthermore, Microsoft doesn’t protect data from common issues like file corruption or everyday human error. Nor does it offer a way to easily revert to older versions if something goes wrong beyond their normal data retention policy.

Back To Business I.T. can help you evaluate your options in addressing these shortcomings and specifically discuss how implementing a backup solution can be cost-effective and seamless and offer peace of mind.

Our Cloud Backup Service Is Easy to Use, and Recovery Is Fast

Not all backups are created equal, however. When looking into a solution that can protect your data stored in the cloud, there are a few fundamental questions you should be asking your vendor:

  • What data is actually being backed up?
  • How is the backup data being stored and protected?
  • How often is data backed up, and for how long?
  • How easy is the data restoration process?

Our Cloud Backup Service is a flexible, agile, and reliable solution that offers comprehensive data protection across the full Microsoft 365 tenant, unlimited storage and retention of user data, and a hassle-free setup and run experience. Better yet, data-recovery means you can have peace of mind that your company can be up and running with minimum downtime.

There are several things to consider when selecting a cloud backup solution – and our team of experts can help with that! Our team can customize an approach that works for the company data that should be protected as well as other business and budgetary needs.

Contact our team today to learn about our Cloud Backup solution for your Microsoft 365 data!

Back To Business I.T. to Participate in First-Ever Identity Management Day

Identity Management Day

Identity Management Day, founded by the Identity Defined Security Alliance, aims to educate and engage business leaders and I.T. decision makers on the intersection of identity management and security.

 

Beavercreek, OH — Back To Business I.T. today announced that it will participate in the first ever ‘Identity Management Day,’ an annual awareness event that will take place on the second Tuesday in April each year. The inaugural Identity Management Day will be held on April 13, 2021.

Founded by the Identity Defined Security Alliance (IDSA), the mission of Identity Management Day is to educate business leaders and IT decision makers on the importance of identity management and key components including governance, identity-centric security best practices, processes, and technology, with a special focus on the dangers of not properly securing identities and access credentials.

In addition, the National Cyber Security Alliance (NCSA) will provide guidance for consumers, to ensure that their online identities are protected through security awareness, best practices, and readily-available technologies.

To support this exciting initiative as a champion, Back To Business I.T. will be sharing information about ways to safeguard your identity online as well as resources available to individuals and organizations.

“Raising awareness around identity management is especially critical after a barrage of identity-based breaches made headlines in the past year, including Twitter, Marriott, and Nintendo. In fact, research by the IDSA reveals that 79% of organizations have experienced an identity-related security breach in the last two years, and 99% believe their identity-related breaches were preventable,” said Julie Smith, Executive Director of the IDSA.

Smith continued, “Compounding this, the ongoing pandemic has accelerated digital transformation initiatives that support changes in how we work and how we live day-to-day, putting organizations at greater risk. Our hope is that Identity Management Day will result in higher prioritization of identity security and, as a result, fewer data breaches in 2021 and beyond. We are grateful for all of the support from IDSA and NCSA member companies and the broader industry to further this mission.”

“Identity-related cybercrimes are nothing new, but the methods that hostile actors are using have changed tremendously,” said Tyler Greenwood, Vice President of Back To Business I.T. “Phishing and identity spoofing are tactics that cybercriminals are using to get people to give up information that’s then used to compromise systems. It’s happening everywhere and unfortunately many people and businesses aren’t taking proper precautions and are paying the price.”

“Identity management isn’t just about passwords anymore”, Tyler added, “It’s about people. Making sure users are trained to recognize maleficence is potentially the most critical factor keeping their identity and credentials safe.”

Back To Business I.T. offers customizable managed services designed to improve your business operations. Whether you have straightforward technology requirements or complex technical needs, Back To Business I.T. offers a full suite of managed services and solutions that can bring value to your operations and solve your technology challenges. One of our most popular services – Security Awareness Training – offers custom-built company-specific campaigns to train employees on cybersecurity risks. We craft and deploy simulated phishing campaigns to test employee awareness and provide resources to strengthen their understanding and increase cyber resiliency.

About the Identity Defined Security Alliance

The IDSA is a group of identity and security vendors, solution providers, and practitioners that acts as an independent source of thought leadership, expertise, and practical guidance on identity centric approaches to security for technology professionals. The IDSA is a nonprofit that facilitates community collaboration to help organizations reduce risk by providing education, best practices, and resources.

To learn more about and get involved in Identity Management Day 2021, please visit www.identitymanagementday.org and check out #IDMgmtDay on Twitter and LinkedIn.

Follow the IDSA

Join the Community: https://forum.idsalliance.org/

Twitter: www.twitter.com/idsalliance

LinkedIn: www.linkedin.com/company/identity-defined-security-alliance/

Blog: https://www.idsalliance.org/blog/

Follow Back To Business I.T.

Facebook: https://www.facebook.com/BacktoBusinessIT/

Twitter: https://twitter.com/Back2BusinessIT

Instagram: https://www.instagram.com/backtobusinessit/

LinkedIn: https://www.linkedin.com/company/back-to-business-it

YouTube: https://www.youtube.com/user/BacktoBusinessIT

Create a Disaster Recovery Plan to Protect Your Data

disaster recovery plan

Your company’s most precious business resource is its data. What is your game plan for protecting it?

Data loss cripples businesses – studies show that over 50% of businesses hit by cyber-crime close their doors within 6 months. What measures are you taking while cyber-criminals step up their game? If your game plan doesn’t include backups, you’re effectively planning to lose when (not if) a cybersecurity breach occurs. Don’t like losing? Let’s go over some game plan essentials to get that win.

Consider the elements

Even with strict information controls and excellent maintenance of technology, avoiding data loss incidents is all but impossible. You can account for what you can control – and that’s about it. Aside from the usual suspects – ransomware, human error, and technology failure – there are other forces that could destroy your business if you don’t have proper backups. Don’t let other variables, such as natural disasters, structural fires, and theft, derail your business success. Create a Disaster Recovery Plan to use as your playbook for succeeding in less-than-ideal conditions, and position yourself to recover that data quickly.

A strong lineup

Not all backups are the same. Businesses have different needs and budgets and every backup strategy needs to consider both. Think of this as your line up. How long can your business afford to be “down” in the event of a disaster? What players need to stay in as long as possible? What data is affordable to lose? Priority should be given to the data essential to carry out your essential business functions. In the event of a breach, recovering that data quickly could spare you big losses.

Use a long term strategy

A winning game plan takes you all the way, right? Backups protect your data by ensuring you have a ‘copy’ of everything you need in case of compromise. How long should you keep those copies? The compliance and regulatory requirements for your industry should guide how long you keep data backups. A good long-term strategy accounts for not just unexpected events, but also compliance requirements to ensure your data is there whenever you need it.

Plan for the wildcard

People are a constant variable in the biggest upsets. In times of emotional distress, employees often make poor decisions. Almost 75% of departing employees admit to taking company data in some form. 70% of intellectual property theft occurs within 90 days of an employee’s resignation. Worse yet, even more malicious activity can occur and hostile actors inside the workplace, unfortunately, purposefully delete data. Plan for the wildcards by having timely backups and enjoying peace of mind knowing you can get back to normal after a compromise.

The competitive advantage

If a disaster were to hit your area, how quickly would your business recover? How quickly would your competitors recover? Implementing a disaster recovery plan through effective backups ensures quick restoration and minimizes down time. Make backups your competitive advantage by ensuring you can get back on your feet faster and more effectively than your competitors.

A strong game plan accounts for all known and unexpected factors. It includes an aggressive offense for the things we can predict, and a solid defense for the sudden and unexpected. Plan for the win – backup your data and get back to business.

Want to secure a win for your business?

Our team will work with you to create a custom disaster recovery plan that fits your business needs, the data you need to protect, and your budget. Contact us today!

What is a CMMC RPO?

CMMC rpo

Throughout 2020, the U.S. Department of Defense released details surrounding the Cybersecurity Maturity Model Certification (CMMC) requirements for companies in the defense industrial base (DIB). These new consolidated cybersecurity requirements are driving suppliers and contractors to dedicate time, money, and other resources to strengthen their cybersecurity strategy to meet compliance. Depending on the company’s existing cybersecurity posture, some will have much more work to do than others, and they will all need professional guidance.

It’s no surprise that the market has been recently flooded with consulting firms claiming to be experts in CMMC compliance requirements. Keep in mind that not all third-party consultancies are created equal. As a small business, we understand how important it is to properly vet vendors, and make sure you’re getting the most out of every dollar you assign to projects like these.

The CMMC Accreditation Body (CMMC-AB) has introduced five certifications and authorizations to differentiate entities offering CMMC compliance services. These are:

  • Certified Third-Party Assessor Organizations (C3PAO)
  • Registered Provider Organizations (RPO)
  • Registered Practitioners (RP)
  • Certified Professionals (CP)
  • Certified Assessors (CA)

We’re happy to provide some details regarding the RPO authorization, and what is involved.

RPOs like The Greentree Group are authorized by the CMMC AB to provide consulting services to government contractors and other companies in preparation for their CMMC assessments. We can also assist during these assessments if there is a finding that will prevent you from attaining your desired CMMC maturity level. However, we do not conduct certification assessments, and we do not grant certified status. Only C3PAOs are equipped to conduct these certification assessments. As an RPO, we are here to provide CMMC guidance and support to companies impacted by these new regulations. It’s important to remember that C3PAOs cannot provide guidance unless they’re also certified as an RPO – and even then, they cannot offer the same services (assessment + guidance) to the same company.

WHAT GOES INTO BECOMING AN RPO

A company must do the following to become certified as a CMMC RPO:

  1. Be an entity owned by a “US person”.
  2. Be registered with the CMMC-AB in order to receive authorization to use the official logo distributed by the CMMC-AB.
  3. Sign an RPO agreement, reflecting a commitment to comply with the CMMC-AB Code of Professional Conduct.
  4. Clear an organizational background check.
  5. Have at least one Registered Practitioner (RP) on their team. An RP is specially trained and authorized by the CMMC-AB to deliver “non-certified advisory services informed by basic training on the CMMC standard” at all times.
  6. Pay an annual registration fee.

These requirements put in place by the CMMC-AB are helpful for companies seeking certification because they provide a measure of legitimacy. As with any new regulations or rules, there will be many companies claiming to be experts in the field, and competing for your business. By selecting a company that has attained its RPO authorization, businesses can be confident that their choice is well suited for the job and committed to CMMC standards.

CHOOSING THE RIGHT CMMC RPO FOR YOUR COMPANY

RPO authorization is an important consideration when choosing a provider- but there are other things you should keep in mind. Other important questions you may want to ask –

  • How much experience does the RPO have in cybersecurity and maintaining compliance in highly regulated spaces?
    • The Greentree Group has supported both DoD programs and DIB clients with obtaining and maintaining required cybersecurity compliance for over a decade
  • Do they have experience with other frameworks such as CIS CSC, NIST SP 800-53, NIST SP 800-171, and ISO 27001?
    • Greentree has cybersecurity experts for the cybersecurity framework you require
  • How knowledgeable are they about the defense contracting environment?
    • Greentree’s cybersecurity team has a combined 50+ years of defense contracting experience
  • How many years have they been in business? Are they well-established?
    • The Greentree Group has been in business for 26 years with an established reputation for excellence in customer support
  • How easy is it for the provider to scale efforts appropriate to your business?
    • We support clients of all different sizes and architectures, as your business grows our support for your cybersecurity needs can grow with you

Note: Back To Business I.T. is a service brand of The Greentree Group.

WHY IS THE RPO AUTHORIZATION IMPORTANT FOR YOUR BUSINESS?

The new CMMC-AB authorization process for RPOs is an effective way for companies to sift through the increasing chatter in the CMMC consultancy space. The RPO certification signals that a consulting firm is invested in the CMMC space, and has committed to cybersecurity best practices. By visiting the CMMC marketplace, companies can look for certified RPOs in their area and reach out on their own terms.

We are authorized by the CMMC-AB as an RPO, and ready to guide your business along in the CMMC journey. Are you ready to learn more? Fill out this form and one of our cybersecurity experts will be happy to provide more information about CMMC compliance.

Skip to content