Estimating the Cost of NIST SP 800-171

The government recently released a new federal acquisition regulation that requires NIST SP 800-53 controls for federal information systems operated by contractors. Buried inside that rule are several cost estimates for implementing and maintaining SP 800-53. Meanwhile, the government has never published cost estimates for NIST SP 800-171 even though it is derived directly from SP 800-53. In this episode we use are knowledge of SP 800-53 to do the impossible and estimate SP 800-171 using the government’s own numbers.

Episode Links:
.
.
.
.
.
.
.
.
.
.
.

Chapters:
(0:00 – 1:35): Housekeeping
(1:36 – 6:53): Federal vs Nonfederal Information Systems
(6:54 – 8:45): FIPS 199 Categorization vs NIST SP 800-53
(8:46 – 14:42): Cost Estimate Caveats
(14:42 – 16:45): Cost estimates for SP 800-53 & FedRAMP
(16:46 – 18:15): Overlooking Small Contractors
(18:16 – 21:35): DoD has avoided estimates for SP 800-171 for years
(21:35 – 25:50): CMMC costs vs SP 800-171 costs
(25:51 – 32:50): Deriving SP 800-171 estimates from SP 800-53 estimates
(32:51 – 34:06): SP 800-171r2 considerations
(34:07 – 36:16): Cost vs SMB conundrum
(36:17 – 41:26): SP 800-171B estimates

#cmmc #nist #dfars #dod #dib #cybersecurity

[mikekrawczyk]

Not "rants" - you're mirroring what many of us are thinking - and that is encouraging as we move forward - lol

[Ramr]

Attackers first gained access to the SolarWinds systems in September 2019. The attack was not publicly disclosed until December 2020. This is not a criticism, just a timeline correction for your backstory.

[ClayinSWVA]

The other side of the coin is all the money that was estimated was in labor hours. The other big factor is the software licensing costs for all of the automated monitoring and Fed-Ramp\DFARS\ITAR US person rules.

[jodygreene]

Where, specifically, are the costs estimates documented? The real numbers are more staggering when you consider the costs associated with day-to-day operations on top of the costs associated with each product/service and SSP.