Teleworking with non-gov laptops containing CUI

VPN
1

How does teleworking function with a laptop with CUI?

I telework, and I have 2 laptops, both with CUI. One is DoD issued, and one belongs to my company. With my gov laptop I just connect to my home WiFi, and then VPN in to Wright Patt, nothing special.

How would that work with my non-gov laptop. To be clear, I just need to connect to the internet, directly. I wouldn’t be connecting to a VPN with this one.

Does my home WiFi network have to meet certain standards? Or should my company have a VPN setup?

2

- Or should my company have a VPN setup?

Oh yes, absolutely. Are you familiar with NIST 800-171? If your company is doing work with the DoD and receiving CUI then you need to be DFARS 7012 compliant with is NIST 800-171 and what you describe for that company laptop points to a problem…

3

My concern would be 800-171 3.10.6 regarding safeguarding measures at alternative work sites. It’s a bit up for the air in terms of interpretation, but my reading is that the org can define what safeguarding measures to use at alternative work sites as long as the protection is equivalent and depending on the activity at the site.

For the non-gov laptop if CUI is going over the internet without some other form of encryption or a protected distribution system you would need a VPN, potentially FIPS validated too in this case but that’s a whole other bag of cats. If for example the data just lives on the laptop for reference and the laptop and it’s contents are secured you might not need the VPN.

There might also be some guidance in the company’s Acceptable Use Policy, but talking to whoever your “security guy” is might be the best approach.

4

The company laptop is a covered device as defined in dfars 252.204-7012. The company should be implementing NIST 800-171 and including the device in their plan and implementing the required controls. I will be agnostic on whether or not it needs a VPN. if your company has a cloud native infrastructure their are other things than a VPN that could be used to meet the various security requirements including encryption in transit. As also pointed out there is a requirement for your companies security plan to include or address alternate worksites.

5

I’m debating a similar but different question. If a company SSP notes that there is no CUI stored, transmitted, processed in the contractor ecosystem; and that GFE should be utilized for all CUI unless it’s not available to the contractor, and then CUI can be accessed by DoD e-mail/Secure File Access.

Should the assessment still note implementation of all of the requirements to ensure that CUI is not in the system and that proper administrative, operational, and technical controls are in place? Obviously, with some controls marked NA if they are related to CUI directly in the system?

6

Much appreciated. Sorry for the slow response. I’m just not familiarizing myself with NIST or 800-171. We’re a small operation, and we’re just now setting up new company laptops. So much of it seems up to interpretation. I imagine there’s common practices though—that info’s been challenging to find.

7

Thanks for the response, sorry I was slow to reply.

I’m assuming the VPN would need to be the termination point for the data, right? Like if I need to transmit CUI data to Boeing, and it’s unencrypted, then I’d need to VPN directly to Boeing’s server to transmit? If I needed to transmit to a location that didn’t have VPN I assume I’d have to find some other means to encrypt.

Is there any scenario where public VPN offer anything useful, like nord, Surfshark, etc.

8

If the laptop is properly secured and configured there is no requirement for modifications to your home network.

9

That sounds like CUI is not processed, handled or stored in the system. In that case then an ssp is not required just implementation of the 15 controls in FAR.

Be really really sure before you go that route. Based on the question I would suspect their is CUI involved. I would talk with someone qualified on your specific case.

10

No worries, glad it’s somewhat helpful. On the same journey trying to figure it all out as well. For it can definitely be a bit confusing what is being looked for to meet the controls and there are many different ways to meet the controls, and depending on who you ask or who is assessing you you’ll get different answers. In terms of resources I would recommend 800-171a and the CMMC center of awesomeness and their discord, there’s lots of good discussion that can be sifted through, including by control. The excel file on the main page is very helpful as well, with possible solutions by control.

https://www.cmmc-coa.com/

I would also check with your contract with Boeing to see what they’ve flowed down before getting too far in the weeds- is DFARS 7012 there? does the prime believe they’re flowing CUI to you? Also depending on what it is you’re doing, scoping narrowly can reduce complexity by quite a bit if possible.

For VPNs, one of the relevant controls is 3.13.11, which is to “Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.”

Quoting from the DFARS FAQs Question 72 response:

“When NIST SP 800-171 requires cryptography, it is to protect the confidentiality of CUI (or in this case covered defense information). Accordingly, FIPS-validated cryptography is required to protect CUI, typically when transmitted or stored outside the protected environment of the covered contractor information system (including wireless/remote
access) if not separately protected (e.g., by a protected distribution system). FIPS validated cryptography is required whenever the encryption is required to protect covered defense information in accordance with NIST SP 800-171 or by another contract provision.
Encryption used for other purposes, such as within applications or devices within the protected environment of the covered contractor information system, would not need to be FIPS-validated.”

My interpretation is that if there isn’t any other layer protecting the confidentiality of CUI, that the encryption must be FIPS validated and configured to be such. In that case the VPN connection to Boeing should be FIPS validated. If that sort of VPN wasn’t available, encrypting the file As an aside, the FIPS part might change in v3 of 800-171 but that’s still a ways off.

As a warning, you may find documenting to take at least as long as implementing any technical changes. Companies like Compliance Forge offer template packages though they’re a substantial investment, and if you’re small writing them yourself may be easier than tailoring down.

11

Awesome, that’s good to know. (Sorry for slow response)

I was mostly picturing the VPN as a means to be connected to a trusted network. I’m understanding that it’s really just an option for encrypting any CUI transmission, and that other means of encryption, like HTTPS or file encryption are viable solutions.

12

Great point, I’ve pretty much moved in this direction; basically splitting the contractor system to implicitly state there is no CUI stored, transmitted, processed, but federal contract data is (and applicable to FAR 52.204-21), and that the remainder of 800-171 is N/A to that environment.

13

We do indeed have 7012 mentioned in the contract.

I agree with your interpretation. We are indeed pretty small, and the budget is tight so I‘m expecting it to be me doing this all. That’s the way it goes though.

14

It’s definitely tough as a SMB/Solo IT and Security guy, I think there’s some understanding on the government side of the difficulty but so far there’s not much in the way of assistance outside of community resources. Hopefully as the rubber meets the road that might change slightly but we’ll see.