Anyone have experience with NIST 800-171 in a SaaS environment?

As a former customer, yes! Something we went through. The big call out that we needed to map from a framework compliance standpoint was the following:

• CUI (Controlled Unclassified Information) - File Audit (scan data at rest), File Grid, User Grid, Shared With, Groups, App Permissions, Real Time Reports)
• Access Controls (Role Based Privileges)
• Security Controls (Least Privilege & Time Based Access Controls)
• Centralized Detection (Files Grid, Dashboard, Alerts Triggered)
• DLP (Content Scanning)
• Retention (Audit Logs in BCX)
• DLP Policies (Alerts + Workflows)
• Trusted Applications (Flash panel on 3rd party apps, but now we have Discover!)

Since BetterCloud is leveraging GCP, all Google Cloud services are in scope for NIST 800-171

@mnorton ah I see. I have heard of SCAP and tools that can be used to benchmark compliance on local OS or even Google Chrome. As it pertains to SaaS, this might lean more towards how Google's GCP performs a vulnerability scan.

Tagging @mike-bc to see if he has heard of this or knows someone's shoulder we can tap on.

Also this: https://cloud.google.com/security/compliance/nist800-171

Got it, makes sense. Going to see if we can dig something up on our end!

What's the specific control you're trying to meet with SCAP for SaaS?

@cmathis We are being required to perform monthly vulnerability scans on all of our systems, but most of our systems are SaaS. My understanding based on shared responsibility models is that there needs to be a way to check/report on what controls we have enabled in the SaaS tool that are actually in our realm to control. The entire 800-171 framework does not seem to work super well with SaaS (a lot of controls don’t apply/don’t make sense) so I’m trying to figure how other folks have implemented this.

My understanding is that we can rely on FedRAMP certifications for actual SaaS, and do monitoring on cloud hosted services that we run using something like Nessus.

That’s where I see CMMC making improvements on outdated framework controls.

I was afraid of having to migrate to FedRAMP tools, that would definitely be the more compliant option and check off boxes more clearly (but $$$). CMMC is definitely the more updated framework and probably where we will look towards next

It's also why these companies just stick with Microsoft across the board.