One Thing to do to Ensure Compliance Failure

One Thing to do to Ensure Compliance Failure

There are a lot of ways to fail a compliance audit. In meeting compliance for CMMC level 2 or NIST SP 800-171 one of the best ways to fail an audit is to make compliance an IT task. When companies do so it can only mean that corporate management has a fundamental misunderstanding of the task at hand. At CMMC Level 2 the keystone for compliance is the System Security Plan. This is a holistic plan that describes compliance to the 320 requirements established to safeguard the organization’s information management system. It is a system security plan, because it takes a systems approach, it is not an IT Plan, or a Cybersecurity Plan. The second element is that the IT department or individual often has little to no authority. The System Security Plan outlines how the organizational resources are gathered and coordinated to provide a comprehensive security posture. This effort in leveraging organizational assets requires direct management involvement, this is an insurmountable task for the IT department. In working with a number of large companies the mapping of user access to information often highlights outdated access control rules. Updating and realigning access control rules is often business process re-engineering task, where user roles are developed and realigned with ongoing business processes. Success in framing the System Security Plan and in compliance is management lead and directed.
Granted there is much in the CMMC L2 or the NIST construct that descripbe the

and s into In almost all instances the IT department it is an overhead function, it is not one that brings in revenue. It is often a corporate orphan, considered a necessary appendage that is underfunded and staffed.
is
mof will One Thing to do to Ensure Compliance Failure