Improving record keeping and data handling is critical to keeping the trust of partners, vendors, contractors, and customers. The importance is magnified when the federal is involved, with the goal of making a national culture of cyber security that protects the knowledge of our businesses, citizens, and government. The National Institute of Standards and Technology (NIST) created Special Publication 800-171 to assist protect Controlled Unclassified Information.
But what does that really look like? How will you recognize you’re meeting the standards laid call at NIST 800-171?
What is Controlled Unclassified Information (CUI)?
Before we enter NIST 800-171, we should always discuss exactly what constitutes Controlled Unclassified Information, or CUI. Simply put, CUI is information that’s sensitive and relevant to our interests, but not strictly regulated by the federal. According to the National Archives and Records Administration, the chief Agent charged with creating and implementing standards for unclassified data and overseeing agency compliance, CUI is taken into account any potentially sensitive, unclassified data that needs controls in situ which define its proper safeguarding or dissemination.
How does one Implement NIST SP 800-171?
NIST 800-171 was created following the passage of FISMA (Federal Information Security Management Act) in 2003, which resulted in many security standards and guidelines. It was formed in part to strengthen cyber security, particularly in light of many well-documented breaches in recent years, including the USPS (U.S. Postal Service) and NOAA (National Oceanic and Atmospheric Administration) (National Oceanic and Atmospheric Administration).
It’s understandable for manufacturers to wonder what they ought to do to implement NIST SP 800-171 and ultimately get in compliance with DFARS, and whether there are specialized resources available to assist them to achieve that milestone without preventable pitfalls. The primary thing they ought to confine in mind is that being DFARS compliant likely involves working with a cyber security consultant that knows the NIST SP 800-171 requirements inside and out.
It’s advisable for little manufacturers to seem to their state’s Manufacturing Extension Partnership (MEP) Center. a part of the MEP National Network™, a bigger organization that connects them to NIST, the representatives at your local MEP Center will have a working knowledge of NIST SP 800-171 and may help companies steal themselves against DFARS compliance. It is often a brief or long process, depending upon the complexities of a company’s operating environment and knowledge systems, but implementing NIST SP 800-171 may be a necessary process for a corporation to guard its information.