EO 13556 established a governmentwide Controlled Unclassified Information (CUI) program to standardize the way the executive branch handles unclassified information that requires protection.
Only information that requires safeguarding or dissemination controls pursuat to federal law, regulation, or governmentwide policy may be designated as CUI.
Safeguarding Covered Defense Information and Cyber Incident Reporting.
Basic Safeguarding of Covered Contract Information Systems
NIST SP 800-171 V1
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.
Federal Information Security Modernization Act of 2014 (FISMA).
Protect CUI - Protect your Business
Soon it wll be mandatory to hold in-hand a Cybersecurity Maturity Model Certification (CMMC) Level 1-5 to pursue and conduct DoD business. DoD is the first community to mandate this - all of the rest of Government will follow. State and local Governments are following suit and ramping up their own protection protocols and policies to protect sensitive data. DATA, DATA, DATA...protect it.
ARES ...Secure....Protect...Defend ..
Is my cloud service provider doing the right things?solutions
FEDRAMP is a system aimed at ensuring Cloud Services Providers can meet CUI requirements.
Hardware and Software Partners - APPs
Can ensure systems meet CUI and in turn CMMC demands.
Do I need an application to ensure all data is secure, use is auditable; historical usage reports - available for Government inspection?
Do I meet CMMC requirements for redundant protection - no single point of failure; can I survive a hack or a systemic crash?
Knowing what to do and what to say is not the same as proving what you do
All companies doing business with DoD have attested, by signing contracts, they are in compliance with DFARS 252.204-7012. Anything less than complying is therefore a false claim.
The Federal Government takes false claims seriously; contracts can be terminated and reprocurement costs may be borne by the firm that is noncompliant; firm's debarrment and suspension from Government business may follow. ARES Point: Say what you do then PROVE IT!