Tag: cybersecurity

The Rise of Ransomware: Why Every Business Needs a Cybersecurity Plan

man holding his head, with a computer with a ransomware alert on the screen behind him

Imagine waking up to the chilling message: “Your files are encrypted. Pay now or lose them forever.” This isn’t a dystopian movie plot; it’s the harsh reality of ransomware, a cyberattack that’s rapidly becoming a top threat for businesses of all sizes.

The Stats Paint a Grim Picture

In 2023, ransomware payments reached an all-time high of over $1 billion, according to Chainalysis. This exponential growth shows no signs of slowing down.  By 2031, experts project businesses will experience a ransomware attack every two seconds. The data is clear: no industry is safe, with attacks targeting hospitals, government agencies, and even small businesses.

Why Should You Be Worried?

Even if your business doesn’t handle sensitive data, the consequences of a ransomware attack can be devastating. Consider these statistics from the SOPHOS State of Ransomware 2023 report.

  • The average ransom payment in 2023 was $260,000. That’s a hefty sum for any business, especially small and medium-sized organizations.
  • Beyond the ransom, businesses incur additional costs for downtime, data recovery, and reputational damage. For instance, healthcare organizations collectively have experienced a loss of $77.5 billion since 2016 in downtime costs alone.
  • A single attack can cripple operations for days or even weeks, leading to lost revenue and productivity.

Don’t Be a Victim: Build a Cybersecurity Fortress

The good news is, you don’t have to be a sitting duck. By implementing a robust cybersecurity plan, you can significantly reduce your risk of falling prey to ransomware:

  • Educate your employees: Phishing emails are a common entry point for ransomware. Regular training empowers employees to identify and avoid suspicious emails.
  • Patch your systems regularly: Unpatched software vulnerabilities are often exploited by attackers. Make timely updates a priority.
  • Backup your data regularly: Having a reliable backup system allows you to restore your data in case of an attack, minimizing downtime and data loss.
  • Invest in security solutions: Antivirus software, firewalls, and endpoint detection and response (EDR) tools can help detect and prevent ransomware attacks.
  • Develop an incident response plan: Knowing what to do in case of an attack can minimize damage and expedite recovery.

Staying Ahead of the Curve

The FBI offers valuable insights into emerging ransomware threats and mitigation strategies. Additionally, CISA’s proactive approach like “pre-ransomware notifications” helps organizations identify and stop attacks before they happen.

Remember, cybersecurity is an ongoing process, not a one-time fix. By staying informed, taking proactive measures, and implementing a comprehensive plan, you can significantly reduce your risk of falling victim to ransomware and safeguard the continued success of your business.

Don’t become another ransomware statistic! Schedule a FREE cybersecurity consultation with Back To Business I.T. today to assess your vulnerabilities and build a customized plan to shield your business. Let our experts help you sleep soundly knowing your data and operations are safer.

FTC Safeguards Rule 2024: Secure Your Data, Secure Your Business

Features a banner with the text "Is Your Organization Prepared for the FTC Safeguards Rule Changes?" prominently displayed. Below this headline, there's a detailed bullet-pointed checklist labeled "Safeguards Rule Compliance Checklist," highlighting various compliance tasks. To the right, a person in a dark suit is holding a glowing digital lock symbol, representing cybersecurity

Understanding the updated FTC Safeguards Rule for non-bank financial institutions

If you’re a non-bank financial institution, you are probably already familiar with the FTC Safeguards rule put in place in October, 2021. However, you may not be familiar with one of the most recent updates to this rule.

First, what is the Safeguards Rule?

If you’re not already familiar, the FTC Safeguards rule states that non-banking financial entities, including mortgage brokers, car dealerships, and payday loan companies, need to establish, execute, and sustain an extensive security strategy to protect their clients’ data. In October, 2021, the FTC confirmed updates to the Safeguards Rule, enhancing the data security measures these financial institutions must implement to secure their customers’ financial information.  

The latest amendment

In addition to the previous requirements, on October 27, 2023, the FTC announced non-bank financial institutions must report to the FTC any security breach impacting at least 500 consumers’ data as quickly as possible and no more than 30 days after its discovery. This notification is especially necessary when unencrypted customer data is accessed without the consent of the person it belongs to. The report to the FTC must include specific details about the incident, such as the estimated number of consumers affected.

This requirement to notify about breaches will be enforced after May 13, 2024 which is 180 days following the rule’s publication in the Federal Register.

Why does this amendment matter?

The recent amendment to the FTC Safeguards Rule amplifies enhanced trust and uniformity in data security practices at non-bank financial institutions. Adherence to this updated rule demonstrates a robust commitment to protecting data and propels a more consistent approach to data security across various financial sectors. However, this amendment presents certain challenges. Implementing these changes may necessitate operational adjustments within institutions. Additionally, they must carefully balance the need for transparency with the risk of exposing vulnerabilities or potentially compromising ongoing investigations.

The FTC’s update to the Safeguards Rule is a significant step towards better protecting customer information in the financial sector, especially for non-bank institutions. Ensuring effective handling and reporting of data breaches provides assurance that financial information is in safe hands.

Staying ahead of regulatory changes is not just about avoiding penalties—it’s about protecting your reputation and securing your customers’ trust. The updated FTC Safeguards Rule outlines critical steps that non-bank financial institutions must take to safeguard customer information. But understanding these requirements and integrating them into your business practices can be complex.

Back To Business IT has developed a comprehensive Compliance Checklist for the updated October 2023 FTC Safeguards Rule to help you navigate these changes with confidence. Our checklist is designed to ensure that you don’t miss a single step in your journey to full compliance.

Don’t leave your compliance to chance. Download the Back To Business IT Compliance Checklist today and start implementing the necessary safeguards to secure your customer data and maintain your competitive edge.

Visit our resources page now to get your copy of the checklist and learn more about our tailored IT solutions that keep your business ahead of the curve.

  1. Federal Trade Commission – Safeguards Rule Update.
  2. FTC Safeguards Rules

Top 10 Cybersecurity Trends for 2024

Futuristic cybersecurity shield emblem superimposed on a circuit board highlighting modern cybersecurity trends and digital protection technologies.

The cybersecurity landscape is undergoing a seismic shift, driven by technological advancements, evolving threats, and a heightened focus on regulation. From the talent crunch in cybersecurity to the rise of Generative AI and the increasing importance of soft skills, the industry is bracing for a transformative year. This guide delves into the Top 10 Cybersecurity Trends for 2024.

1. The cybersecurity skills crunch will mean less people/higher costs for organizations.

One of the most critical challenges facing the cybersecurity industry is the talent gap. According to the Bureau of Labor Statistics1, the employment of information security analysts is projected to grow by 33% from 2020 to 2030. This rate of growth is much faster than the average for all occupations, highlighting the increasing demand for cybersecurity expertise. However, the supply of qualified professionals is not keeping pace with this demand, leading to a talent gap that poses a serious risk to organizations. For businesses, this can mean higher labor costs. In the next few years, scarcity will cause salaries to increase, and upskilling existing employees will require added costs for development and training.

2. Cybersecurity professionals will have increased need for soft skills.

While technical expertise remains a the primary focus for anyone working in cybersecurity, there will be a growing emphasis on the importance of soft skills for cybersecurity professionals. These include interpersonal communication, problem-solving, and emotional intelligence, among others. Effective communication will be crucial when explaining complex security issues to non-technical stakeholders so that decision-makers can understand how and why to take appropriate action. Indeed2 suggests that a blend of technical and soft skills will be the hallmark of the most sought-after cybersecurity professionals.

3. There will be more cybersecurity in board rooms.

According to a Gartner Report3, around 70% of corporate boards are expected to have at least one member with specialized cybersecurity knowledge by 2026. Another report from Moody’s4 reveals that company cyber budgets have jumped by 70% in four years. This significant increase in financial allocation is a testament to the escalating importance of cybersecurity at the highest levels of corporate governance. Boards are not just approving larger budgets; they are actively participating in discussions about how these resources are allocated and used.

As a result, the role of the CIO (Chief Information Officer) will become even more important

According to Info-Tech’s Annual CIO Survey Report For 20245, one of the top priorities for CIOs in 2024 will be to engage with the board on cybersecurity matters. This involves not just presenting technical metrics but translating these metrics into understandable, actionable business strategies. The recent SEC charges against SolarWinds serve as a stark reminder of the consequences of neglecting cybersecurity at the governance level. The SEC alleges that SolarWinds misled investors about its cybersecurity measures, leaving the company vulnerable to a significant cyberattack disclosed in December 2020. This event led to a sharp decline in the company’s value, underscoring the critical importance of taking cybersecurity seriously at the highest levels of an organization. And the SEC’s action in this case should act as a wake- up call for publicly traded companies that wish to avoid the same fate.

4. IoT (internet of things) cyberattacks will increase.

The proliferation of IoT devices, ranging from smart home appliances to industrial sensors, has expanded the attack surface for cybercriminals. According to InformationWeek6, security measures are not keeping pace with the grow of IoT technology, widening the security gap.  For businesses, one of the greatest vectors for threat is IoT devices used by remote and hybrid employees without proper security measures in place on devices used to connect to sensitive data. McKinsey7 notes that the lack of standardized security protocols is a significant concern, especially considering the IoT is expected to potentially be worth up to $12 trillion dollars globally by 2030.

5. More cybersecurity regulations are coming down the pike.

The newest regulations aim to safeguard national security and ensure economic stability by setting standards and guidelines for cybersecurity practices. In the United States, the 2024 defense bill has allocated $13.5 billion specifically for cyberspace activities. Notably, in the US financial sector, the SEC  has introduced new rules requiring companies to include cybersecurity risk factors and incidents in their financial disclosures set to take effect on December 15, 2023. In the UK, the Product Security and Telecommunications Infrastructure (PTSI)8 act was passed into law in 2022 and aims to regulate products capable of connecting to a network, such as IoT devices like networked CCTV cameras, with a compliance deadline of April 29, 2024.

Similarly, the EU is focusing on the cybersecurity of a product’s life cycle for IoTs that connect to a network by implementing the European Cyber Resilience Act (CRA). The CRA is designed to replace the existing European Union agency for cybersecurity ENISA.  It will oversee certification schemes for ICT products, services, and processes and is set to be officially released in 2024.

6.  Generative AI will continue to have long lasting impacts on cybersecurity.

The integration of Artificial Intelligence (AI) into cybersecurity is not a new phenomenon, but the advent of generative AI marks a significant milestone. One of the most concerning developments is the use of deepfake technologies for social engineering attacks. According to a report by Cyber Magazine9, the proliferation of deepfakes is causing increasing concern in the cybersecurity community. AI-generated synthetic media can impersonate individuals, manipulate content, and deceive systems, making them a potent tool for cybercriminals aiming to compromise business networks and data. Beside deepfakes, AI is contributing to more sophisticated phishing attempts. AI can be used to create more believable phishing emails with programs like ChatGPT, Bard, and Claude and to automate the process of sending these emails, making attacks more efficient and harder to detect.

On the flip side, advancements in AI are also empowering organizations to bolster their defenses. A Gartner report10 highlights the growing importance of Machine Learning in data science, including real-time anomaly detection. Additionally, AI-driven incident response mechanisms are becoming increasingly sophisticated. These systems can automatically isolate affected network segments, initiate predefined security protocols, and even communicate with human operators to provide real-time updates on security incidents.

7. You will see evolving, more sophisticated phishing attacks and the cost will be much higher.

Phishing attacks have long been a staple in the cybercriminal’s toolkit, and Humans are the weakest link in the chain. 95% of cybersecurity issues traced to human error11. The advancement of automated technologies and generative AI tools that can create more realistic and emotionally evocative phishing attempts is a large contributing factor on this front. Cybersecurity Ventures12 predicts that by 2025, cybercrime will cost companies and individuals over 10 trillion dollars worldwide.

8. Cyber warfare and state-sponsored cyberattacks will continue to increase.

Ongoing conflicts and significant electoral events around the world are expected to be flashpoints for cyber warfare activities. According to the U.S. Department of Homeland Security’s homeland threat assessment for 202413, state-sponsored cyberattacks are among the top threats facing the nation. Critical infrastructure sectors such as energy, transportation, and healthcare are likely to be primary targets. In 2022, one of the biggest attack types on infrastructure was remote management devices with a marked increase happening over the course of the year.  In the current geopolitical environment, the trend for cyber warfare shows no signs of slowing.

9. There will be a move towards cyber resilience as cyberattacks become more common.

Organizations will no longer be solely focused on preventing cyberattacks; they will also be investing in strategies to ensure operational continuity in the aftermath of an attack.  According to the National Institute of Standards and Technology (NIST)14, cyber resilience is “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.” However, it is not a one-size-fits-all concept; it can be implemented at multiple levels, including individual system elements, entire systems, and even across organizations or sectors. As cyberattacks become more frequent, organizations will likely invest more in training programs, technological solutions, and governance models that support cyber resilience. The aim is to build systems that not only defend against cyber threats but also adapt and recover quickly when attacks occur.

10. The zero trust model will continue to evolve.

The concept of zero trust has been a cornerstone in cybersecurity, operating on the principle of “never trust, always verify.”15 However, the zero trust model, which relies heavily on static rules and policies, is becoming increasingly inadequate. According to Gartner16, the future of it will demand more dynamic and adaptive security measures to cope with the complexities introduced by emerging technologies and sophisticated cyber threats. One of the major shifts in zero trust will be the incorporation of AI for real-time authentication. AI algorithms can analyze behavioral patterns and other contextual factors to make instantaneous trust decisions. Beyond that, the zero trust model will increasingly incorporate continuous monitoring of user activity. This approach extends the security perimeter past the initial point of entry, continuously verifying the legitimacy of a user’s actions throughout their session.

The adoption of zero trust is on the rise. According to a 2023 report by Fortinet17, 67% of survey respondents have adopted zero trust network access but have struggled to implement the full suite of strategies.  In fact, in 2023, only 28% had achieved complete implementation – down from 40% in 2021. While there is an increase in the intention to adopt zero trust, the difficulties in achieving full planned deployment in the business environment require a higher degree of commitment.

Conclusion

As we confront the unfolding cybersecurity trends of 2024, it becomes clear that this year will be a watershed moment for digital defense. In an era where technological progress and cyber threats accelerate in tandem, robust and forward-thinking cybersecurity strategies are not just advisable—they are imperative. Organizations are called to bolster their digital ramparts with a blend of seasoned experts, cutting-edge AI technologies, and resilient operational blueprints that promise not just to endure but to dynamically counteract cyber incursions. The path to a fortified cyber future is complex and demands a unified front across all sectors and communities. It’s a path that companies like Back To Business IT are equipped to help navigate. Staying ahead of the curve and ready to act decisively will transform these emerging challenges into stepping stones for a more secure and resilient digital landscape.


1. https://www.bls.gov/OOH/computer-and-information-technology/information-security-analysts.htm

2. https://in.indeed.com/career-advice/career-development/cyber-security-skills

3. https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024

4. https://www.businessinsurance.com/article/20230929/NEWS06/912360168/Company-cyber-budgets-jump-70-in-four-years-Moody%E2%80%99s-

5. https://www.infotech.com/research/ss/annual-cio-survey-report-2024

6. https://www.informationweek.com/data-management/iot-technology-growth-and-security-trends-this-year-and-beyond

7. https://www.mckinsey.com/industries/technology-media-and-telecommunications/our-insights/cybersecurity-for-the-iot-how-trust-can-unlock-value

8.https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1037629/PSTI_FactSheet_1__Overview__1_.pdf

9.https://cybermagazine.com/technology-and-ai/the-rising-tide-of-deepfakes-as-ai-growth-cause-concern

10. https://www.gartner.com/en/newsroom/press-releases/2023-08-01-gartner-identifies-top-trends-shaping-future-of-data-science-and-machine-learning

11. https://www3.weforum.org/docs/WEF_The_Global_Risks_Report_2022.pdf

12. https://cybersecurityventures.com/cybercrime-damage-costs-10-trillion-by-2025/

13. https://www.dhs.gov/sites/default/files/2023-09/23_0913_ia_23-333-ia_u_homeland-threat-assessment-2024_508C_V6_13Sep23.pdf

14. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2.pdf

15. https://www.nist.gov/blogs/taking-measure/zero-trust-cybersecurity-never-trust-always-verify

16 https://www.gartner.com/en/newsroom/press-releases/2023-10-17-gartner-unveils-top-predictions-for-it-organizations-and-users-in-2024-and-byond

17. https://www.fortinet.com/blog/industry-trends/zero-trust-report-key-takeaways#:~:text=In%202021%2C%2040%25%20of%20respondents,54%25%20in%20the%20previous%20survey

Choosing the right IT support model for your business: in-house, outsourced, or co-managed

Image of a keyboard with a key labeled "Support"

In today’s technology-driven business landscape, having reliable and efficient IT support is crucial for smooth operations and growth. Choosing the optimal IT support model is critical for businesses facing increasingly diverse technology challenges. This blog explores the benefits of three primary IT support models – in-house, outsourced, and co-managed – to help businesses understand which option suits their unique needs.

In-House IT Support

In-house IT support involves hiring and managing a dedicated team of IT professionals within your organization. This model works best for large enterprises or businesses with complex IT needs and substantial resources. With in-house IT support, businesses have direct control over their IT operations and can align strategies with specific business objectives. It offers real-time support, immediate response to issues, and deeper knowledge of the company’s IT environment.

Benefits:

  • Direct Control and Alignment: With an in-house IT team, businesses have direct control over IT operations. The team can align IT strategies with specific business objectives, ensuring technology solutions are tailored to meet the organization’s unique needs.
  • Immediate Response: In-house IT support allows for real-time support and immediate response to IT issues. IT staff are on-site and readily available to address technical problems, minimizing downtime and disruption to business operations.
  • Deeper Knowledge of Company Environment: The in-house team gains extensive knowledge of the organization’s IT infrastructure, applications, and processes. This deep understanding enables more personalized support and tailored solutions.
  • Security and Confidentiality: In-house IT support with cybersecurity expertise allows businesses to maintain strict control over sensitive data and proprietary information, mitigating the risk of data breaches or leaks associated with external providers.
  • Customized IT Strategies: In-house teams can develop long-term IT strategies based on the company’s vision and goals, leading to better technology planning and implementation.

Cybersecurity:

  • Direct control over IT operations allows for better implementation of cybersecurity measures tailored to the organization’s specific needs. The in-house team can create and enforce strict security policies, ensuring the protection of sensitive data and proprietary information. However, limited expertise may hinder the ability to stay updated on the latest cybersecurity threats and best practices.

Ultimately, the decision to opt for in-house IT support depends on the specific needs, budget, and objectives of the organization. While it provides direct control, immediate response, and deep knowledge of the company environment, businesses must carefully consider the associated costs, scalability concerns, and potential limitations in expertise. For many small to medium-sized businesses, a combination of in-house IT support and outsourced or co-managed IT services may offer the most balanced and cost-effective solution to meet IT requirements.

Outsourced IT Support:

Outsourced IT support entails partnering with a third-party Managed Service Provider (MSP) like Back To Business I.T. This model is a popular choice for small to medium-sized businesses seeking cost-effective and expert IT solutions without the overhead of maintaining an internal IT team. Outsourced IT support provides access to a pool of specialized IT experts, 24/7 monitoring, proactive maintenance, and the latest technologies. It allows businesses to focus on core competencies while leaving IT responsibilities in the hands of experienced professionals.

Benefits:

  • Expertise and Specialization: Outsourced IT support provides access to a team of specialized IT professionals with diverse skill sets and expertise. MSPs stay up-to-date with the latest technologies and industry best practices, ensuring businesses receive top-notch support.
  • Cost-Effectiveness: Outsourcing IT support can be more cost-effective for small to medium-sized businesses compared to maintaining an in-house IT team. Businesses save on expenses related to recruitment, salaries, benefits, and ongoing training.
  • 24/7 Monitoring and Support: MSPs typically offer round-the-clock monitoring and support, providing continuous surveillance of IT systems and rapid response to any issues, even during non-business hours.
  • Proactive Maintenance: MSPs take a proactive approach to IT management, identifying potential problems before they become major issues. This helps prevent downtime and keeps the business running smoothly.
  • Scalability and Flexibility: Outsourced IT support can easily scale up or down to match business needs. It offers the flexibility to add or remove services as required, making it an adaptable solution for evolving businesses.
  • Focus on Core Competencies: By outsourcing, businesses can focus on their core competencies and strategic initiatives, freeing up time and resources to drive innovation and growth.
  • Access to Advanced Technologies: MSPs have access to cutting-edge technologies and tools, enabling businesses to leverage the latest solutions without investing in expensive infrastructure.

Cybersecurity:

  • External MSPs, like Back To Business I.T., specialize in cybersecurity and stay informed about emerging threats. They implement robust security protocols, conduct regular monitoring, and offer proactive maintenance to protect businesses from cyber threats. However, businesses must carefully vet MSPs to ensure they have robust security practices in place.

Businesses looking to outsource IT support should carefully select a reliable MSP, consider data security, and establish effective communication to ensure a seamless and productive partnership.

Co-Managed IT Support:

Co-Managed IT support, like the services provided by Back To Business I.T., is an ideal option for businesses that already have an in-house IT team but require additional expertise and support. With this model, the internal IT team collaborates with an external MSP, benefiting from their industry knowledge, advanced tools, and resources. Co-Managed IT support offers enhanced IT capabilities, faster issue resolution, and the flexibility to scale IT resources based on business demands.

Benefits:

  • Augmented Expertise: Co-Managed IT support offers businesses the advantage of combining the knowledge and skills of their internal IT team with the specialized expertise and resources of an external MSP. This partnership ensures a more robust and comprehensive strategy.
  • Flexibility and Scalability: The co-managed model allows businesses to scale based on their fluctuating needs. During peak periods or specific projects, the MSP can provide additional resources and support, enabling the internal IT team to focus on core tasks.
  • Enhanced Efficiency: By sharing responsibilities with an external MSP, the internal IT team can offload routine tasks and focus on strategic initiatives and innovation. This leads to improved efficiency and productivity within the IT department.
  • Proactive Problem-Solving: Co-managed IT support brings together the collective insights of both internal and external teams, leading to a more proactive approach to IT problem-solving and risk management.
  • Cost-Effectiveness: Businesses can gain access to specialized IT resources without bearing the full cost of maintaining a larger in-house team. Co-managed support allows businesses to optimize their IT budget effectively.
  • Increased Coverage: With the MSP’s 24/7 monitoring and support capabilities, businesses can ensure continuous coverage and quick response times to IT issues, even outside regular working hours.
  • Industry Best Practices: The collaboration with an external MSP introduces the organization to industry best practices, emerging technologies, and innovative solutions that can drive business growth.

Cybersecurity:

Co-managed IT support combines the expertise of the internal IT team and the external MSP, leading to a comprehensive cybersecurity approach. The MSP’s industry best practices and insights enhance the organization’s security posture, while the internal team maintains an in-depth understanding of the company’s specific security requirements.

Co-Managed IT support offers businesses the best of both worlds, leveraging the expertise of their internal IT team alongside the specialized knowledge and resources of an external MSP. While communication and coordination are crucial to the success of this model, the benefits of flexibility, scalability, and cost-effectiveness make co-managed IT support an attractive option for businesses.

Which IT Support Model is Right for Your Business?

In-House:

  • Best suited for large enterprises with extensive IT needs and resources.
  • Provides direct control over IT operations.
  • Offers on site response and deeper knowledge of the company’s IT environment.

Outsourced:

  • Ideal for small to medium-sized businesses seeking cost-effective expert IT solutions.
  • Provides access to specialized IT experts, 24/7 monitoring, and the latest technologies.
  • Allows businesses to focus on core competencies while leveraging external IT expertise.

Co-Managed:

  • Perfect for any size business with an in-house IT team in need of additional expertise and support.
  • Enables collaboration with an external MSP for enhanced capabilities and issue resolution.
  • Offers flexibility to scale IT resources based on business demands.

Choosing the right IT support model is a crucial decision that directly impacts your business’s efficiency, security, and overall success. Back To Business I.T. provides tailored solutions to keep your business thriving in the digital age. Our goal is simple: to help you get back to business. Contact Back To Business I.T. at 937.490.5600 or schedule an IT Assessment today to explore how we can empower your business with the right IT support model.

The Impact of NIST SP 800-171 Revisions on CMMC Compliance

Impact of NIST SP 800-171 Revisions on CMMC Compliance

Maintaining compliance with the evolving Cybersecurity Maturity Model Certification (CMMC) requirements is crucial for defense contractors and organizations. In this article, we’ll explore the recent revisions of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 and their direct impact on CMMC compliance. As a leading provider of cybersecurity solutions, Back To Business I.T. aims to empower defense contractors with the necessary insights to navigate these changes effectively.

Understanding NIST SP 800-171 serves as the baseline for protecting Controlled Unclassified Information (CUI) on nonfederal systems and organizations. These guidelines establish essential security requirements that federal agencies and government contractors must follow when handling sensitive information. CUI encompasses data such as intellectual property, health information, and critical energy infrastructure information. Compliance with NIST SP 800-171 is a prerequisite for defense contractors seeking to secure Department of Defense (DoD) contracts.

The Impact of NIST SP 800-171 Revisions on CMMC Compliance

The revisions in NIST SP 800-171, particularly the upcoming Revision 3, significantly influence the compliance landscape for defense contractors pursuing CMMC certification. Let’s explore how these revisions affect CMMC compliance:

  1. Enhancing Alignment: NIST has aligned the language of SP 800-171 Revision 3 with the closely related SP 800-53 Rev. 5, enabling defense contractors to apply the technical tools and controls outlined in SP 800-53 to achieve CMMC compliance. This alignment streamlines the implementation process and ensures a consistent approach to cybersecurity.
  2. Strengthening Security Requirements: The revised NIST SP 800-171 places increased emphasis on cybersecurity, reflecting the evolving threat landscape and state-level espionage targeting CUI. The new requirements address specific threats to CUI and incorporate state-of-the-practice cybersecurity controls. By adhering to these enhanced security requirements, defense contractors can bolster their cybersecurity posture and better protect sensitive information.
  3. Simplifying Implementation: NIST SP 800-171 Revision 3 introduces clearer instructions and specific criteria, reducing ambiguity and facilitating easier implementation. This streamlining of requirements simplifies the compliance process and enables defense contractors to align their cybersecurity practices with the latest industry standards.
  4. Aligning with Future CMMC Levels: The revisions in NIST SP 800-171 provide a foundation for future CMMC levels beyond Level 3. By incorporating the enhanced security requirements and alignment with SP 800-53 Rev. 5, defense contractors get a head start in preparing for future CMMC levels, ensuring a smooth transition as the certification evolves.

To achieve CMMC compliance, defense contractors must remain up-to-date with the revisions in NIST SP 800-171.

The upcoming Revision 3 brings enhanced alignment, strengthened security requirements, simplified implementation, and a forward-looking approach to future CMMC levels. By effectively understanding and implementing these revisions, defense contractors can ensure their cybersecurity practices meet the rigorous standards required for DoD contracts.

Back To Business I.T. is committed to supporting defense contractors on their journey towards CMMC compliance, and we’re ready to provide tailored cybersecurity solutions. Take the first step today by scheduling a gap analysis with our expert cybersecurity consultants.

Department of Defense prepares rollout of national cybersecurity standards

DoD cybersecurity standards

By Tyler Greenwood, Vice President of Back To Business I.T. (originally published in the Dayton Business Journal)

Cyber incidents like the SolarWinds attack in 2019 and the Colonial Pipeline ransomware attack in 2021 have the U.S. Department of Defense (DoD) taking urgent action to strengthen national cybersecurity regulations.

A report released last November found most prime contractors (and their subcontractors) hired by the DoD in the last five years failed to meet minimum cybersecurity standards, putting U.S. national security at risk. Security gaps in the federal supply chain have been well known for years, but attempts to fix them have failed.

Enter: CMMC

In response to heightened security risks, the DoD introduced Cybersecurity Maturity Model Certification (CMMC) program. Its goal is to ensure any company involved in the federal supply chain is protecting controlled unclassified information.

Under CMMC guidelines, more than 300,000 contractors must meet 110 NIST SP 800-171 controls, which the government sees as a reasonable cyber risk management approach. In addition, 80,000 of these organizations must complete a third-party assessment and certification to continue bidding on defense contracts.

When will CMMC certification be required?

The DoD is expected to release a final rule on CMMC framework by March 2023, which means contractors could start seeing requirements in RFPs/RFIs as early as May.

If your business is one of the 80,000 contractors that requires an outside assessment and certification, you may have less than a few months to do so. Failure to achieve compliance before the published rule could mean leaving money on the table and losing the ability to do business with the Department of Defense.

Getting started

If your company is still in the beginning stages of CMMC compliance, the time to act is now. Preparation and implementation of the following requirements can take upwards of 18 months. To get started on compliance, contractors should immediately:

  • Work toward meeting the 110 controls in NIST SP 800-171.
  • Identify their Supplier Performance Risk System (SPRS) score.
  • Create a system security plan (SSP).
  • Document plans of action and milestones (POA&M) to demonstrate how you intend to close any gaps for controls not yet met.

Next steps

If your organization has already started on CMMC compliance, consider conducting a preliminary self-assessment to see if you satisfy requirements. This can provide a range of helpful information to ensure you have everything functioning as expected once you’re ready to formally self-attest or go for your official certification.

If your business wants consultative guidance, including assistance walking you through standards you didn’t meet, explaining why, and offering suggestions on closing those gaps, you might find it beneficial to work with a CMMC Registered Provider Organization (RPO), such as Back To Business I.T.

As a full-service I.T. firm and the region’s leading CMMC-AB RPO, Back To Business I.T. can help you achieve NIST SP 800-171 compliance as well as help you prepare your plan of action and milestones (POA&M) and system security plan (SSP) required for CMMC certification. Learn more at www.backtobusinessit.com/cmmc-readiness.

8 Spooky Cybersecurity Statistics To Help You Prepare For The Worst

cybersecurity statistics

A cyberattack is a scary event. It can shut down a business, cripple a government, and even incapacitate an entire country if the right measures aren’t taken to prevent it from happening.

THIS HALLOWEEN, WE BRING YOU EIGHT SPOOKY CYBERSECURITY STATISTICS THAT EMPHASIZE THE DANGERS OF CYBER THREATS AND URGE YOU TO PREPARE FOR THE WORST.
  1. 54% of small and medium-sized businesses (SMBs) say their I.T. departments are not sophisticated enough to handle advanced cyberattacks. (Sophos)
  2. As of February 2022, there were 8.77 million new pieces of malware circulating the Internet of Things (IoT) and mobile app stores. (AV-TEST)
  3. A ransomware attack takes place against a business every 14 seconds. (Cybersecurity Ventures)
  4. 91% of SMBs haven’t purchased cyber liability insurance, despite awareness of risk and the likelihood that they would be unable to recover from an attack. (Cybersecurity Magazine)
  5. Almost 89.7% of US businesses saw at least one successful cyberattack within a 12-month period. (CyberEdge Group)
  6. 53% of business leaders agree that remote work has made it much easier for hackers and cybercriminals to take advantage of them. (Norton)
  7. 50% of data breach incidents involve phishing and social engineering. (Trustwave)
  8. On average, only 5% of companies’ folders are properly safeguarded. (Varonis)

A large number of organizations still remain unprepared for a cyberattack – please be proactive and prepare now by contacting us – we can implement multi-factor authentication, roll out company-wide security training campaigns, and implement policies and procedures to help you keep your business and sensitive data protected. Don’t become a cybersecurity statistic!

What to Expect When Applying for Cyber Insurance

cyber insurance
Several years ago, cyber insurance was just an add-on to larger policy discussions, but with the rise of malicious online attacks, it’s jumped to the forefront and has become one of the most expensive policies under a company’s insurance coverage. Here’s how to ace your application and get the best rates.

Cybercrime is a multibillion-dollar industry. Even with careful security measures in place, it remains a constant struggle for businesses to stay one step ahead of hackers looking to extort them. Phishing emails, malware, security breaches, network security issues, and computer system breakdowns are just a few examples of the kinds of cyber risk that can cause serious liability or revenue loss. That’s why proper cyber liability insurance remains a vital risk-transfer tool for organizations of all sizes.

For businesses attempting to acquire cyber insurance, the application process itself can be daunting. Application forms aren’t standard and can be very complex — what used to be a seven-question application has evolved over the last few years into a multi-page document broken out into various categories. Truth be told, it can read less like an application and more like an audit questionnaire. (Check out a sample cyber insurance application here.)

Insurers want to be as thorough as possible when evaluating an organization’s cybersecurity infrastructure and deciding their level of risk. They depend on the detail contained in the application to determine how well the people, processes, and technology can protect and respond to cyber threats. Any vagueness or incorrect information can create major issues later on if (or when) a claim is filed.

If you’re planning on applying for cyber insurance, it’s important to identify your company’s cyber risks prior to submitting the application. Specifically, insurers will ask for:

  • The basics — What industry you operate in, as well as how much and what type of information your organization stores, processes, and transmits. In addition, underwriters want to see how you manage data security and who oversees cyber-related matters.
  • Information security — Do you have a formal program in place to test and audit security controls? Underwriters also typically look to see if you have basic controls in place, including firewall technology, anti-virus, and intrusion detection software.
  • Breach history — Have you been breached before? Is the data you house vulnerable? How effective are your data security techniques moving forward?
  • Data backup — Underwriters want to know if you back-up all your valuable data on a regular basis, if you utilize a redundant network, and if you have a disaster recovery plan in place.
  • Company policies and procedures — What type of cybersecurity and incident response policies do you have in place? For example, how do you handle password updates, the use of personal devices, and revoking network access to former employees?
  • Compliance with legal and industry standards — Failing to comply with cyber-related legislation can be incredibly costly, and insurers want to know how you handle compliance. Specifically, whether you are compliant with applicable regulatory frameworks, are a member of any outside security or privacy groups, or utilize out-of-date software and hardware.

Although the cyber insurance application is more rigorous than most insurance applications, you can secure the best rate by doing your due diligence and prepping ahead of time. Being honest about the risks and vulnerabilities your company may face from cyber threats will also help you get the right policy coverage.

Need help applying for cyber insurance or meeting specific criteria? Talk to an expert at Back To Business I.T. today!

Skip to content