Company
We are implementing the NIST Cybersecurity Framework on ourselves first
A note on how HQT is building its own security program before asking agencies to trust us with theirs.
It would be odd to advise agencies on security while running a loose shop ourselves. So one of the first things we did as a company was start a security program aligned to the NIST Cybersecurity Framework, and we are treating it the way we would treat a client engagement.
What we have done so far
- Written policies for acceptable use, access control, data handling, and incident response
- Enforced multi-factor authentication on every service, with phishing-resistant methods for administrators
- Put every device under management with encryption, patching, and endpoint protection
- Centralized logs from identity, devices, and cloud services
- Set up immutable backups and tested a restore
- Adopted a data classification scheme so we know where client data may and may not live
What is in progress
- Aligning to the CJIS Security Policy so our staff can be assigned to public safety work
- Building a NIST SP 800-171 enclave for any federal work involving controlled unclassified information
- Vendor risk reviews for the services we depend on
What we have learned
Even for a company like ours, the framework's value is in forcing you to write things down and decide who owns them. Most of the controls are cheap. The expensive part is discipline, and discipline is easier when it starts on day one rather than being retrofitted.
We will publish updates as the program matures. If your agency is starting the same journey, the framework's own quick start guides are a good place to begin, and we are glad to compare notes.