NIST SP 800-171 IMPLEMENTATION FOR THE SMALL-MEDIUM BUSINESS DoD Cybersecurity for the Windows-Based SMB

This book guides the small to medium business through implementation of NIST SP 800-171. For the smaller organization, implementation can seem like an overwhelming challenge. Yet, many companies find themselves in the position of having to implement or stop selling to the Department of Defense (Due to DFARS 252.204-7012). So, for some businesses, their choice is to implement these controls or cease to exist. In the NIST SP 800-171 standard there are more than 100 individual requirements that span a wide range of areas related to security. While there are some requirements are simple, straightforward and easy to implement, there are others that are not. Some of the requirements need significant research just to figure out what is needed. Others threaten to require changes in how business is conducted. There are also requirements that look like they will need many, many hours to meet them. Some requirements sound like they can only be accomplished through big monetary expenditures. All of these things provide challenges to a small IT department that is already resource challenged. It was precisely because of these challenges that this book was written. This book is designed to provide guidance to the IT administrator that needs to implement NIST SP 800-171, but doesn't have the necessary resources to do so. These are not suggestions to "get around" the requirements, but suggestions for value-added security enhancements that meet the requirements. These suggestions designed to achieve compliance while not breaking the bank or putting you in the insane asylum. The book goes through every one of the requirements in NIST SP 800-171, addressing them individually. In many cases, the suggestions are very specific, describing Group Policy or procedural steps that will satisfy the requirement. The goal of all these suggestions is for them to be specific, realistic and sound from a security standpoint. Updated to align with Revision 1 of the NIST standard.