Identifying a Certified Third Party Assessing Organization (C3PAO) - Revision history

Marieramsay at 01:31, 2 March 2025

2025-03-02T01:31:30Z

← Older revision		Revision as of 01:31, 2 March 2025
Line 15:		Line 15:
	==== '''CUI at Alternate Worksites - Work From Home (WFH)''' ====		==== '''CUI at Alternate Worksites - Work From Home (WFH)''' ====

	# When CUI is physically at alternate work sites, the CUI ~~still~~ must be physically protected. The physical protections may include locked filing cabinets, safes, or locked briefcases, for example. Some organizations even allow WFH users to print to corporate-issued printers in their home. At some level, the physical security of your home is providing safeguarding for that CUI. Some assessors will assess the WFH environment remotely, relying on policy and training, user interview, or maybe even demonstration on camera by a WFH user. Other assessors will require an in-person site visit to a representative WFH environment. Other assessors won't assess you if you have CUI at home. If you allow physical CUI at your user's homes, ask your assessor how they plan to assess your WFH environment, or if they will assess it at all.		# When CUI physically exists at alternate work sites, the CUI must be physically protected. The physical protections of the CUI may include locked filing cabinets, safes, or locked briefcases, for example. Some organizations even allow WFH users to print to corporate-issued printers in their home. At some level, the physical security of your home is providing safeguarding for that CUI. Some assessors will assess the WFH environment remotely, relying on policy and training, user interview, or maybe even demonstration on camera by a WFH user. Other assessors will require an in-person site visit to a representative WFH environment. Other assessors won't assess you if you have CUI at home. If you allow physical CUI at your user's homes, ask your assessor how they plan to assess your WFH environment, or if they will assess it at all.

	==== '''Other more specific questions to consider, depending on your environment:''' ====		==== '''Other more specific questions to consider, depending on your environment:''' ====

Marieramsay at 01:30, 2 March 2025

2025-03-02T01:30:21Z

← Older revision		Revision as of 01:30, 2 March 2025
Line 11:		Line 11:
	==== '''Browser used to Access CUI''' ====		==== '''Browser used to Access CUI''' ====

	# Many organizations are accessing and modifying CUI documents through a web browser but have restricted the ability to download and print. Some DOD components also use the browser for accessing Government information. One example is the Navy using Flank Speed. ~~However, when~~ opening a document in a browser it does process information on the endpoint. If that endpoint is not part of the organization information system and controlled then it could be a finding. Some assessors will fail an organization if they are using a browser on an asset that is not controlled others will not. As an alternative there are solutions such as VDI or technologies that provide a pixel representation of a browser that would pass assessment. If you are using a VDI browser application to access CUI, ask your assessor if they would fail the organization.		# Many organizations are accessing and modifying CUI documents through a web browser but have restricted the ability to download and print. Some DOD components also use the browser for accessing Government information. One example is the Navy using "Flank Speed." When opening a document in a browser, it does process information on the endpoint. If that endpoint is not part of the organization information system and controlled then it could be a finding. Some assessors will fail an organization if they are using a browser on an asset that is not controlled, others will not. As an alternative there are solutions such as VDI or technologies that provide a pixel representation of a browser that would pass assessment. If you are using a VDI browser application to access CUI, ask your assessor if they would fail the organization.

	==== '''CUI at Alternate Worksites - Work From Home (WFH)''' ====		==== '''CUI at Alternate Worksites - Work From Home (WFH)''' ====

Marieramsay at 01:29, 2 March 2025

2025-03-02T01:29:05Z

← Older revision		Revision as of 01:29, 2 March 2025
Line 5:		Line 5:
	==== '''SPA Categorization''' ====		==== '''SPA Categorization''' ====

	# Some assessors believe that a Security Protection Asset (SPA) includes any systems components that are used in an organizations Systems Security Plan (SSP) for supporting evidence. Other assessors only identify an SPA a systems that provide protection to components as stated in the NIST 800-171 publication. Talk to your assessor about what they will expect to see from you in an environment like yours.		# Some assessors believe that a Security Protection Asset (SPA) includes any systems components that are used in an organizations Systems Security Plan (SSP) for supporting evidence. Other assessors only identify an SPA as systems that provide protection to components as stated in the NIST 800-171 publication. Talk to your assessor about what they will expect to see from you in an environment like yours.
	# Ask your C3PAO if they expect systems mentioned in the SSP for the purpose of providing evidence to meeting an assessment objective an example of an SPA? Do they believe an SPA has to provide a security function such as a SIEM or EDR? This will impact the level of effort to provide evidence for an assessment. NIST 800-171 states that “The requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI, or that provide protection for such components”.		# Ask your C3PAO if they expect systems mentioned in the SSP for the purpose of providing evidence to meeting an assessment objective an example of an SPA? Do they believe an SPA has to provide a security function such as a SIEM or EDR? This will impact the level of effort to provide evidence for an assessment. NIST 800-171 states that “The requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI, or that provide protection for such components”.
	# You may simply ask: "Which controls will you assess for SPAs?"		# You may simply ask: "Which controls will you assess for SPAs?"

Marieramsay: Added reference and link to C3PAO Stakeholders Forum, plus link to position papers

2025-03-02T00:49:56Z

Added reference and link to C3PAO Stakeholders Forum, plus link to position papers

← Older revision		Revision as of 00:49, 2 March 2025
Line 27:		Line 27:
	# Would you accept N/A for a control without a waiver from DoD?		# Would you accept N/A for a control without a waiver from DoD?
	# What are the risk management practices considered minimum for Specialized Assets (like CNC machines, lab equipment, test equipment)? Do they need to be segmented?		# What are the risk management practices considered minimum for Specialized Assets (like CNC machines, lab equipment, test equipment)? Do they need to be segmented?

			=== C3PAO Stakeholders Forum ===
			Many assessors are involved in a voluntary, informal group that is not associated with the AB. They post [https://www.c3paoforum.org/position-papers/ position papers] that may also provide insight into how assessments may be run in your environment. Not all assessors are a part of the group, but the community is well-respected and very active in the industry.

Marieramsay at 00:09, 2 March 2025

2025-03-02T00:09:52Z

← Older revision		Revision as of 00:09, 2 March 2025
Line 17:		Line 17:
	# When CUI is physically at alternate work sites, the CUI still must be physically protected. The physical protections may include locked filing cabinets, safes, or locked briefcases, for example. Some organizations even allow WFH users to print to corporate-issued printers in their home. At some level, the physical security of your home is providing safeguarding for that CUI. Some assessors will assess the WFH environment remotely, relying on policy and training, user interview, or maybe even demonstration on camera by a WFH user. Other assessors will require an in-person site visit to a representative WFH environment. Other assessors won't assess you if you have CUI at home. If you allow physical CUI at your user's homes, ask your assessor how they plan to assess your WFH environment, or if they will assess it at all.		# When CUI is physically at alternate work sites, the CUI still must be physically protected. The physical protections may include locked filing cabinets, safes, or locked briefcases, for example. Some organizations even allow WFH users to print to corporate-issued printers in their home. At some level, the physical security of your home is providing safeguarding for that CUI. Some assessors will assess the WFH environment remotely, relying on policy and training, user interview, or maybe even demonstration on camera by a WFH user. Other assessors will require an in-person site visit to a representative WFH environment. Other assessors won't assess you if you have CUI at home. If you allow physical CUI at your user's homes, ask your assessor how they plan to assess your WFH environment, or if they will assess it at all.

	==== Other more specific questions to consider, depending on your environment: ====		==== '''Other more specific questions to consider, depending on your environment:''' ====

	# Do you believe that Security Protection Data (SPD) is CUI?		# Do you believe that Security Protection Data (SPD) is CUI?

Marieramsay at 00:09, 2 March 2025

2025-03-02T00:09:25Z

← Older revision		Revision as of 00:09, 2 March 2025
Line 26:		Line 26:
	# Which controls do you believe need to be applied to Contractor Risk Managed Assets (CRMA)?		# Which controls do you believe need to be applied to Contractor Risk Managed Assets (CRMA)?
	# Would you accept N/A for a control without a waiver from DoD?		# Would you accept N/A for a control without a waiver from DoD?
	# What are the risk management practices considered minimum for ~~Security Assessment~~? Do they need to be segmented?		# What are the risk management practices considered minimum for Specialized Assets (like CNC machines, lab equipment, test equipment)? Do they need to be segmented?

Marieramsay: Added Question per Glenda

2025-03-02T00:02:08Z

Added Question per Glenda

← Older revision		Revision as of 00:02, 2 March 2025
Line 26:		Line 26:
	# Which controls do you believe need to be applied to Contractor Risk Managed Assets (CRMA)?		# Which controls do you believe need to be applied to Contractor Risk Managed Assets (CRMA)?
	# Would you accept N/A for a control without a waiver from DoD?		# Would you accept N/A for a control without a waiver from DoD?
			# What are the risk management practices considered minimum for Security Assessment? Do they need to be segmented?

Marieramsay: Added an intro, edited to created subheader2s, formatted Terry H.'s additions, and added Glenda's questions.

2025-03-01T21:42:11Z

Added an intro, edited to created subheader2s, formatted Terry H.'s additions, and added Glenda's questions.

← Older revision		Revision as of 21:42, 1 March 2025
Line 1:		Line 1:
	~~'''SPA Categorization'''~~		It is worth taking some time to find the right C3PAO for an organization.

	~~Some assessors believe that a Security Protection Asset (SPA) includes any systems components that are used in an organizations SSP~~ for ~~supporting evidence. Other assessors only identify an SPA~~ a ~~systems that provide protection~~ to ~~components as stated in~~ the ~~NIST 800-171 publication.~~		The community is invited to use this guide and matrix released by the ND-ISAC: [https://ndisac.org/defense-news/nd-isac-releases-c3pao-shopping-guide-for-small-medium-sized-businesses/ C3PAO Shopping Guide], and encouraged to ask questions of a potential assessor to find the right fit for their environment:

	~~Ask your C3PAO if they expect systems mentioned in the SSP for the purpose of providing evidence to meeting an assessment objective an example of an~~ SPA~~? Do they believe an SPA has to provide a security function such as a SIEM or EDR? This will impact the level of effort to provide evidence for an assessment.~~		==== '''SPA Categorization''' ====

	NIST 800-171 states that “The requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI, or that provide protection for such components”.		# Some assessors believe that a Security Protection Asset (SPA) includes any systems components that are used in an organizations Systems Security Plan (SSP) for supporting evidence. Other assessors only identify an SPA a systems that provide protection to components as stated in the NIST 800-171 publication. Talk to your assessor about what they will expect to see from you in an environment like yours.
			# Ask your C3PAO if they expect systems mentioned in the SSP for the purpose of providing evidence to meeting an assessment objective an example of an SPA? Do they believe an SPA has to provide a security function such as a SIEM or EDR? This will impact the level of effort to provide evidence for an assessment. NIST 800-171 states that “The requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI, or that provide protection for such components”.
			# You may simply ask: "Which controls will you assess for SPAs?"

			==== '''Browser used to Access CUI''' ====

	~~'''Browser used~~ to ~~Access~~ CUI~~'''~~		# Many organizations are accessing and modifying CUI documents through a web browser but have restricted the ability to download and print. Some DOD components also use the browser for accessing Government information. One example is the Navy using Flank Speed. However, when opening a document in a browser it does process information on the endpoint. If that endpoint is not part of the organization information system and controlled then it could be a finding. Some assessors will fail an organization if they are using a browser on an asset that is not controlled others will not. As an alternative there are solutions such as VDI or technologies that provide a pixel representation of a browser that would pass assessment. If you are using a VDI browser application to access CUI, ask your assessor if they would fail the organization.

	~~Many organizations are accessing and modifying~~ CUI documents through a web browser but have restricted the ability to download and print. Some DOD components also use the browser for accessing Government information. One example is the Navy using Flank Speed.		==== '''CUI at Alternate Worksites - Work From Home (WFH)''' ====

	~~However~~, ~~when opening~~ a ~~document~~ in a ~~browser it does process information on the endpoint~~. If ~~that endpoint is not part of the organization information system and controlled then~~ it ~~could be a finding~~.		# When CUI is physically at alternate work sites, the CUI still must be physically protected. The physical protections may include locked filing cabinets, safes, or locked briefcases, for example. Some organizations even allow WFH users to print to corporate-issued printers in their home. At some level, the physical security of your home is providing safeguarding for that CUI. Some assessors will assess the WFH environment remotely, relying on policy and training, user interview, or maybe even demonstration on camera by a WFH user. Other assessors will require an in-person site visit to a representative WFH environment. Other assessors won't assess you if you have CUI at home. If you allow physical CUI at your user's homes, ask your assessor how they plan to assess your WFH environment, or if they will assess it at all.

	~~Some assessors will fail an organization if they are using a browser~~ on ~~an asset that is not controlled others will not. As an alternative there are solutions such as VDI or technologies that provide a pixel representation of a browser that would pass assessment.~~		==== Other more specific questions to consider, depending on your environment: ====

	If you ~~are using a browser to access CUI ask your assessor if they would fail the organization.~~		# Do you believe that Security Protection Data (SPD) is CUI?
			# Is it acceptable to store FIPS 140-2 encrypted CUI in a non-FRME cloud?
			# What do you believe is a Cloud Service Provider and requires FedRAMP?
	~~'''CUI at Alternate Worksites~~ (~~Work From Home~~)~~'''~~		# How do you define logical separation?
			# Is OneDrive in scope if local CUI folders are excluded?
	~~When CUI~~ is ~~physically at alternate work sites (Here we'll focus on work from home/WFH), the~~ CUI ~~needs to be physically protected. The physical protections may include locked filing cabinets, safes, locked briefcases. Some organizations even allow WFH users to print~~ to ~~corporate~~-~~issued printers~~ in ~~their home. At some level, the physical security of your home~~ is ~~providing safeguarding for that CUI.~~		# Which controls do you believe need to be applied to Contractor Risk Managed Assets (CRMA)?
			# Would you accept N/A for a control without a waiver from DoD?
	Some assessors will assess the WFH environment remotely, relying on policy/training, user interview, or maybe even demonstration on camera by a WFH user. Other assessors will require a visit on site to a representative WFH environment. Still other assessors won't even assess you if ~~you have~~ CUI ~~at home.~~

	If you ~~allow physical CUI at your user's homes, ask your assessor how they plan to assess your WFH environment, or if they will assess it at all.~~

Liatris: Added section on work from home [Please Review]

2025-03-01T02:41:13Z

Added section on work from home [Please Review]

@@ Line 6: / Line 6: @@
 NIST 800-171 states that “The requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI, or that provide protection for such components”.
 '''Browser used to Access CUI'''
@@ Line 16: / Line 17: @@
 If you are using a browser to access CUI ask your assessor if they would fail the organization.

Thebert: Created page with "'''SPA Categorization''' Some assessors believe that a Security Protection Asset (SPA) includes any systems components that are used in an organizations SSP for supporting evidence. Other assessors only identify an SPA a systems that provide protection to components as stated in the NIST 800-171 publication. Ask your C3PAO if they expect systems mentioned in the SSP for the purpose of providing evidence to meeting an assessment objective an example of an SPA? D..."

2025-02-28T16:55:29Z

Created page with "'''SPA Categorization''' Some assessors believe that a Security Protection Asset (SPA) includes any systems components that are used in an organizations SSP for supporting evidence. Other assessors only identify an SPA a systems that provide protection to components as stated in the NIST 800-171 publication. Ask your C3PAO if they expect systems mentioned in the SSP for the purpose of providing evidence to meeting an assessment objective an example of an SPA? D..."

New page

'''SPA Categorization'''

Some assessors believe that a Security Protection Asset (SPA) includes any systems components that are used in an organizations SSP for supporting evidence. Other assessors only identify an SPA a systems that provide protection to components as stated in the NIST 800-171 publication.

Ask your C3PAO if they expect systems mentioned in the SSP for the purpose of providing evidence to meeting an assessment objective an example of an SPA? Do they believe an SPA has to provide a security function such as a SIEM or EDR? This will impact the level of effort to provide evidence for an assessment.

NIST 800-171 states that “The requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI, or that provide protection for such components”.

'''Browser used to Access CUI'''

Many organizations are accessing and modifying CUI documents through a web browser but have restricted the ability to download and print. Some DOD components also use the browser for accessing Government information. One example is the Navy using Flank Speed.

However, when opening a document in a browser it does process information on the endpoint. If that endpoint is not part of the organization information system and controlled then it could be a finding.

Some assessors will fail an organization if they are using a browser on an asset that is not controlled others will not. As an alternative there are solutions such as VDI or technologies that provide a pixel representation of a browser that would pass assessment.

If you are using a browser to access CUI ask your assessor if they would fail the organization.