NIST Cyber Maturity Assessment

​

Self Assessment tool to help companies understand current cyber risks and gaps, identify mission critical challenges, and prioritize investments in Cybersecurity based on on business needs and risk.

 

Cyber Risk and Cyber Technology Assessments

​

Cromtec Cyber Solutions Risk Assessment Services are designed for clients with Governance, Risk Management, and Compliance (GRC) requirements who wish to develop a strategic plan to reduce risk.

This service is supported by our Cyber Security Assessment Services (CSAS). We assist our clients by identifying risks at the organization, business or mission, and information system levels, then developing a strategy to measurably improve overall cyber security and mitigate risk to an acceptable level.

This included identifying relevant frameworks and selecting common controls. We support any requirements you have around FedRAMP, NIST 800-53, NIST 800-171, NIST CSF, 23 NYCRR 500, PCI DSS, GDPR, and the HIPAA Security Rule.

•  Categorizing systems and establishing recovery objectives

•  Identifying critical business processes and supporting system, including data flows

•  Defining risk tolerance

•  Prioritizing investments

•  Evaluating enterprise architecture and general cyber security (using our CSAS) including vulnerability   scanning, penetration testing, code review, configuration and patch management

•  Providing analysis of CSAS findings and developing a Plan of Action

​​

Cyber Risk Assessment

​

Almost all compliance frameworks require a risk assessment to identify threats, vulnerabilities, and determine appropriate mitigation strategies. We tailor your risk assessment and provide action items to ensure you're not just checking boxes.

1. FedRAMP Preparation: We’ll develop all supporting documentation for Cloud Service Providers planning to undergo an assessment by a Third-Party Assessment Organization (3PAO), and support the organization through the audit process.

2. DoD Acquisition Requirements for Cyber Security (DFARS 252.204) Compliance: Our analysts are experts with a background and experience working for the Department of Defense and Federal Government. We’ll help you interpret and apply the controls effectively and document everything in a format that’s acceptable to suppliers, prime contractors, and government officials, while protecting your information.

3. NIST Computer Security Resources: Whether your organization is looking at the Cybersecurity Framework, 800-53, or trying to implement a topic-specific NIST publication, our analysts recommend appropriate strategies for applying guidelines to actually reduce risk.

4. HIPAA Security Rule: Most often found with other requirements like PCI or GDPR, we help you understand how your current security strategy meets the HIPAA Security Rule and identify gaps to make sure your organization is fully covered with information protection and privacy.

5. PCI-DSS: Our experts help you prepare for a QSA audit, or will assist with determining the appropriate SAQs and implementing the controls.

​

Technology Risk Assessment

​

Our technology risk assessment follows our Discovery Framework and serves to identify technological gaps in the business architecture. We employ our discovery analysts and collectors to provide fast and comprehensive discovery without the need for credentials or tap port access.

The technology assessment plays an important role in maintaining the secure hygiene of the organization. We offer a broad range of services to protect infrastructure against internal and external threats. Our experts will analyze your architecture, develop a plan, manage the implementation, and perform ongoing lifecycle management and reporting.

​

These services include:

• Security Infrastructure

• Productivity Applications

• Network Infrastructure

• Servers / Cloud Computing

• Rogue Device Detection

​

Incident Response Plan

​

An incident response plan is a set of instructions to help IT staff detect, respond to, and recover from network security incidents. These types of plans address issues like cybercrime, data loss, and service outages that threaten daily work.

 

How toCreate an Incident Response Plan

​

1. Determine the critical components of your network

To protect your network and data against major damage, you need to replicate and store your data in a remote location. Because business networks are expansive and complex, you should determine your most crucial data and systems, prioritize their backup, and note their locations. These actions will help you recover your network quickly.

2. Identify single points of failure in your network and address them

Just as you should back up your data, you should have a plan B for every critical component of your network, including hardware, software, and staff roles. Single points of failure can expose your network when an incident strikes. Address them with redundancies or software fail-over features. Do the same with your staff. If a designated employee can’t respond to an incident, name a second person who can take over. By having backups and fail-safes in place, you can keep incident response and operations in progress while limiting damage, disruption to your network, and your business.

3. Create a workforce continuity plan

During a security breach or a natural disaster, some locations or processes may be inaccessible. In either case, the top priority is employee safety. Help ensure their safety and limit business downtime by enabling them to work remotely. Build out infrastructure with technologies such as virtual private networks (VPNs) and secure web gateways to support workforce communication.

4. Create an incident response plan

Draw up a formal incident response plan, and make sure that everyone, at all levels in the company, understands their roles. 

An incident response plan often includes:

• A list of roles and responsibilities for the incident response team members.

• A business continuity plan.

• A summary of the tools, technologies, and physical resources that must be in place. 

• A list of critical network and data recovery processes.

• Communications, both internal and external. 

5. Train your staff on incident response

Only IT may need to fully understand the incident response plan. But it is crucial that everyone in your organization understands the importance of the plan. After you’ve created it, educate your staff about incident response. Full employee cooperation with IT can reduce the length of disruptions. In addition, understanding basic security concepts can limit the chances of a significant breach.