i2CyberBuild Process

The i2CyberBuild process is designed specifically for DoD contracting companies who have either a FAR/FCI CMMC Level 1 requirement, or a CMMC | NIST 800-171 Level 2 or 3 requirement that requires the handling of CUI.   i2CyberBuild is a comprehensive Compliance Remediation process based on the NIST 800-171/172 and CMMC standards. Remediation is implemented at the conclusion an initial assessment and architecture design performed by Imprimis Subject Matter Experts, supported by experienced cybersecurity analysts.

A similar process is also applicable to commercial entities looking to develop a sound cybersecurity program.

For a "Birds-Eye" View of Imprimis' 3-Phase|Multistage CMMC Assessment, Remediation, and Sustainment Model click the thumbnail at right.

Introduction

Throughout the i2CyberBuild process we align your organization’s unique security challenges with your short- and long-term business objectives to facilitate the development of a robust technology and cybersecurity program. These solutions cover all aspects of technology strategic planning, as well as tactical implementation programs creating strong, compliant and sustainable security policies and procedures.

The i2CyberBuild Program has been developed based upon years of experience and is designed to bring clients into compliance with the Cybersecurity Maturity Model Certification mandate rapidly and at the lowest cost possible.

The Building Blocks of i2CyberBuild

i2CyberBuild facilitates the remediation phase of compliance process, and the following tasks will be addressed and accomplished for the specific client. Most clients will have already begun, or completed, some of these steps.

Physical Security – Physically Protect Facilities, Systems, and Materials

Government Community Cloud High (GCCH) Tenant Creation & Setup at the appropriate level
Domain Control Security & Configuration
Local Network & Infrastructure Security & Configuration (firewalls, switches, WiFi appliances, Devices, Servers, Removable Media, Remote Access, Endpoint Protection, Multifactor Authentication)
Encryption
Vulnerability Scanning & Management
Continuous Monitoring
Backup & Recovery
Documentation – Policies & Procedures, System Security Plan, Incident Response Plan, CUI Management Plan, Configuration Management Plan
Supporting Documentation – ODP Catalog, Configuration Baseline, Document Traceability Matrix, Access and Authorization Matrix, Risk Registries, Assessment Database
Much of the supporting Security Stack that will remain in place during continual sustainment will be set up and implemented during the remediation phase
Establishing IT Steering Group Management Procedures
Develop Training Program

Assessment Phase or Gap Analysis

The normal progression of compliance as shown below involves performing an initial assessment to identify all actions required to bring the organization into compliance resulting in a Plan of Actions and Milestones (POA&M) and preparing a draft System Security Plan (SSP) which allows for the submission of an SPRS score. The remediation phase has been described above which, when completed, will result in the development of an organization’s sustaining activities, associated ‘Security Stack’, and training program.

Remediation Phase

The Remediation phase typically is the most time consuming and most costly simply due to the amount of labor involved in the design, implementation, and eventual practice of all policies and procedures governing infrastructure maintenance and security. Developing security core competencies and controls can disrupt the normal operation of the organization and therefore work must be done at times where this impact can be minimized. One advantage to the extended timeframe is the ability to spread costs over a period of time – a benefit particularly important to the smaller organizations. Further since most of the sustaining platforms have been implemented during the remediation phase, it helps ensure the client will continue to monitor and maintain the required compliance level throughout time.

i2CyberBuild Supports Commercial as well as DoD/Non-DoD Organizations

The i2CyberBuild program was designed so that it could be applied to both DoD/Non-DoD and Commercial organizations. This approach works for organizations that need to comply with various standards, and it applies to organizations who do not need to comply to a standard but want to establish a good cybersecurity program.

The i2CyberBuild program supports our commercial i2CyberStart program by providing a process that transforms the organization’s cyber profile to one employing best practices. The acquisition of proper cybersecurity insurance is recommended to round out clients’ risk management programs.

It is particularly effective for smaller organizations that do not have dedicated IT staff that can support both compliance and sustainment. Using the Imprimis experienced IT staff on an ‘as needed’ basis allows the organization to achieve compliance and sustain it over time quickly and for the least cost.

Get your Cyber Readiness Report Today

To start securing your company’s future with the free IC²E^TM Readiness Report:

The readiness report will provide you with an "operational snapshot" of your current cybersecurity posture, detect gaps in your network policy or procedure shortfalls, and provide an initial set of recommendations.