Cybersecurity Maturity Model Certification advisory services

CUI identification and boundary definition

Our team assists organizations with identifying the collection, use, processing and storage of CUI. This includes determining the flow of CUI and guiding OSCs in customizing their authorization boundary or rationalization to reduce overlapping applications.

NIST 800.171 GAP assessment

In this point-in-time assessment, we identify operational and technological gaps and improvement opportunities across the governance model (e.g., policies and procedures) and assist in creating a plan of action and milestones. The result is a strategic road map to achieve CMMC compliance. Estimated risk ratings of the processes, capabilities and technology in each functional area aid management in developing and submitting scores to the DOD Supplier Performance Risk System.

Cybersecurity program management

RSM will assist OSCs with designing, implementing and managing improvements that optimize and support a client’s CMMC compliance program and cybersecurity posture, including creating customized authorization boundary, designing data flow diagrams, aiding in CUI data identification / labeling, developing a system security plan, and documenting underlying cybersecurity policies and standard operating procedures.

CUI segmentation penetration testing and ‘red team’ assessment

We utilize best-in-class industry methodologies, tools and techniques to assess the maturity of your cybersecurity program and posture, identifying possible attack vectors, vulnerabilities and threats that may pose a significant risk to your organization. Based on our detailed findings, we develop a road map to improve your security program and reduce risk exposure.

Technical review

RSM performs technical reviews of your in-scope CUI assets to facilitate technical alignment with the requirements of NIST 800-171 (a special publication of the National Institute of Standards and Technology). Through this process, organizations gain a thorough understanding of their technical compliance status and create a plan to address any gaps.

Microsoft relationship

As a Microsoft Cloud Solution Provider (CSP) and a Microsoft Agreement for Online Services for Government (AOS-G) partner, RSM is one of only a few Microsoft providers that can deploy, implement and manage Azure, Microsoft 365 and Dynamics 365 for Commercial, Government Community Cloud (GCC) and Government Community Cloud High (GCC-H) tenants, allowing our clients access to Microsoft’s shared responsibility model and flow-down controls.

CMMC enclave build-out and data migration

RSM assists with the design and implementation of secure enclaves by leveraging various cloud-first technologies, including but not limited to Microsoft GCC and GCC-H. Our Microsoft-certified technical implementation professionals and C3PAO leaders work to design and implement the secure enclave in alignment with the DOD’s fundamental cybersecurity expectations. Once the enclave is stood up and secured, RSM supports the secure migration of CUI from on-premises applications and supporting systems, other cloud tenants, or third-party file storage SaaS applications.

Technical remediation

Following the identification of our plan of action and milestones (POA&M), RSM will assist with the identification, selection and implementation of technical solutions, including but not limited to, infrastructure enhancements, network segmentation guidance, authorization boundary definitions, cloud security configurations, identity & access management solution deployment aimed at improving the cybersecurity program and POA&M initiative remediation.

Managed IT services for government contractors

Managed IT services support and maintain government contractors’ IT environments in compliance with  NIST 800-171. As a managed service provider (MSP), we provide service desk support and issue remediation, 24/7 monitoring, infrastructure management, endpoint management, Azure and Microsoft 365 GCC-H management, and dedicated technology advisory.

Managed security services (RSM Defense™)

Our proprietary RSM Defense managed security operations center offers 24/7/365 monitoring and near-real-time reaction to threats, providing extended detection and response (XDR), managed detection and response (MDR), and vulnerability services.

Managed application services

Our managed application services team supports Dynamics 365 business applications and Microsoft 365 and Azure in GCC and GCC-H. We support compliance with the requirements and data-handling protocols of the CMMC, FedRAMP, Defense Federal Acquisition Regulations Supplement (DFARS) 252.204-7012, CUI and ITAR.

Managed compliance services

We offer a holistic risk, compliance and governance solution to assist OSCs with conducting continuous monitoring activities and periodic risk assessments against NIST 800-171 and related security frameworks (e.g., FedRAMP, the Federal Information Security Modernization Act, ISO 27001, etc.). This includes defining and managing efficient risk management and control management practices to help ensure compliance objectives and regulatory needs are achieved and maintained.

Joint surveillance voluntary assessment (JSVA)

Our JSVA services provide OSCs with a comprehensive review and validation of their overall alignment with the DOD’s cybersecurity regulatory expectations. By analyzing governance documentation, network design schematics, technical control implementation status and overall cybersecurity alignment to the requirements of the CMMC (NIST 800-171), a JSVA aims to identify operational and technological improvement opportunities related to the client’s overall information security posture and ability to adhere to the minimum baseline security requirements.

CMMC examination

As a leading C3PAO, RSM is authorized to conduct the CMMC examination, intended to evaluate the effectiveness of an OSC’s cybersecurity posture based on alignment to the underlying requirements of the CMMC (NIST 800-171). Only C3PAOs are allowed to provide this service, which is governed by The Cyber AB in coordination with the DOD.