5 Most Important Questions to Ask your SIEM Provider & When You Should Probably Re-Evaluate Your Current Solution

First Things First: What is a SIEM?

A SIEM (Security Information and Event Management) is a software solution that collects and analyzes security data from multiple sources in real-time to detect and respond to security threats. It aggregates and correlates logs and alerts generated from different sources, such as network devices, servers, and applications, and uses machine learning algorithms to identify patterns of suspicious behavior or anomalies.

SIEMs also provide a centralized view of an organization’s security posture, allowing security teams to quickly identify and respond to security incidents, such as malware infections, data breaches, and insider threats. They can also automate the incident response process by triggering alerts or taking predefined actions, such as blocking access to a compromised system or quarantining a malicious file.

SIEMs are not only an essential tool for managing security for an organization’s environment, they also help organizations comply with security and regulatory standards, such as PCI DSS, HIPAA- and most notably NIST 800-171- by providing real-time visibility into security events and supporting forensic investigations.

Why Is a SIEM Critical for NIST 800-171 Compliance & CMMC?

A SIEM system is important for compliance with the NIST 800-171 and CMMC because it provides critical capabilities for monitoring, detecting, and responding to security incidents as required by the DFARS clauses.

A SIEM system is crucial for compliance with NIST 800-171 because it provides a centralized platform for collecting and analyzing security-related data from various sources, such as firewalls, intrusion detection systems, and servers. This enables organizations to monitor their networks for potential security incidents and respond quickly to mitigate any threats. Additionally, a SIEM system can help organizations meet specific requirements outlined in NIST 800-171, such as continuous monitoring, incident response, and audit log retention. For example, a SIEM system can automate the collection and analysis of audit logs, which is necessary for demonstrating compliance with NIST 800-171 requirements.

Overall, a SIEM system is an essential component of a comprehensive cybersecurity strategy and is critical for achieving and maintaining ongoing compliance with NIST 800-171.

Why is a SIEM AND SOC Critical for NIST 800-171 Compliance & CMMC?

We come across many instances where an organization seeking compliance mistakenly believes that implementing a SIEM solution is all that is required to address the NIST 800-171 control requirements. Unfortunately, a SIEM solution is rather useless without a Security Operations Center (SOC), which is an essential component of an organization’s security infrastructure, responsible for detecting, investigating, and responding to security incidents. It is the central hub where security analysts monitor network and system activity, identify threats, and coordinate response efforts.

It’s of the utmost importance that regardless of the SIEM solution you select, you have a 24x7x365 SOC working with your MSP/MSSP to help manage alerts, review and parse through thousands of logs, remediate vulnerabilities and then document the resolution process on your behalf.

Without a SOC 24x7x365, it is impossible for one person or a small team of 2-3 IT employees to properly manage a SIEM as well as review the thousands of daily alerts generated by a SIEM solution. It’s also important to note that as part of the DFARS 7012 requirements, cybersecurity breaches need to be reported within 72 hours of the incident. Without a true SOC in place, identifying then remediating the breach and completing all the required reporting and documentation tasks, will be especially challenging for the organization.

What NIST 800-171 Controls Does a SIEM Help Address or Fulfill?

A SIEM system can address a considerable number of the 110 requirements outlined in NIST 800-171,

and on average, help increase our clients’ SPRS scores by 50 points. A managed SIEM + SOC approach ensures that an organization can adequately address the required security controls and make the most of their SIEM+ SOC investment.  To help clarify the value of a SIEM solution, here’s a snapshot of the controls/security families that they address alongside the specific, critical features that the solution provides.

Access Control (AC)

AC-2: Account Management

AC-3: Access Enforcement

AC-6: Least Privilege

Audit and Accountability (AU)

AU-2: Auditable Events

AU-3: Content of Audit Records

AU-6: Audit Review, Analysis, and Reporting

Incident Response (IR)

IR-4: Incident Handling

IR-5: Incident Monitoring

IR-8: Incident Response Plan

System and Communications Protection (SC)

SC-7: Boundary Protection

SC-8: Transmission Integrity

SC-13: Cryptographic Protection

• Continuous monitoring: A SIEM is a key component of continuous monitoring, which is required by NIST 800-171. A SOC with a SIEM can collect and analyze security data from multiple sources in real time, enabling security analysts to quickly detect and respond to security incidents.
• Incident response: A SOC is responsible for incident response, which is another NIST 800-171 requirement. A well-equipped SOC can quickly investigate security incidents, contain the damage, and recover affected systems and data.
• Access control: A SOC can also help with access control, another important NIST 800-171 requirement. By monitoring user activity and identifying anomalous behavior, a SOC can help ensure that any unauthorized access to CUI is reported and then addressed to minimize the potential impact of the breach.

However, it is important to note that a managed SIEM system alone cannot address all 110 requirements outlined in NIST 800-171 and that organizations must implement a comprehensive security program that includes multiple security solutions and practices to achieve full compliance with the standard.

The 5 Questions You Need to Ask Your SIEM Provider Today!

Understanding that we’ve covered quite a bit here, the best recommendation we can make is to start a discussion with your MSP/MSSP and SIEM provider to ensure that they’re able to address these questions in detail. Overlooking such a critically important component of your compliance strategy can significantly impact your ability to adequately address the NIST 800-171 requirements and in the worst case scenarios, result in the loss of contracts or even prosecution under the False Claims Act (FCA).

1. Does their SIEM solution also have SOC Capabilities? What level of support do they provide?

Ask about the level of support your SIEM provider offers, including their response times for support requests, their availability for critical incidents, and their expertise in specific areas, such as compliance or threat intelligence. This is critically important as DFARS 7012 requires contractors to report cybersecurity incidents within 72 hours. Without a 24x7x365 SOC, you run the risk of meeting these reporting requirements which could result in fines, the loss of contracts and in some serious cases, prosecution under the FCA.

2. What data sources does your SIEM support?

The success of a SIEM implementation largely depends on the variety and quality of the data sources it can integrate with. Ask your provider what types of log files, event streams, and other sources their SIEM can ingest, and make sure they can handle the specific technologies and applications you use in your environment.

3. How does your SIEM detect and respond to security incidents?

A SIEM is only as good as its ability to detect and respond to security incidents. Ask your provider about their SIEM’s detection and response capabilities, including any advanced analytics or machine learning techniques it uses. You should also ask about their incident response process, including how they prioritize and escalate alerts and how they work with your team to investigate and remediate incidents.

4. How do you ensure the integrity and confidentiality of my data?

Your SIEM provider will have access to sensitive data about your organization’s security posture, so it’s essential to ask about their security and compliance practices. Ask about their data protection policies, access controls, and security certifications, such as SOC 2. Please keep in mind that SIEM providers typically cannot see the data, only the logs which typically do not have any data in them. You should also ask about their data retention policies and how they manage data in compliance with relevant regulations, such as ITAR, GDPR or HIPAA.

5. Can your SIEM scale to meet my organization’s needs?

Make sure your SIEM provider can handle the scale and complexity of your environment. Ask about their performance and scalability capabilities, including how they handle large volumes of data, whether their SIEM can scale horizontally or vertically, and how they handle peak loads.

Conclusion & Informational Resources

In conclusion, a SIEM solution is critical for organizations seeking compliance with NIST 800-171 and CMMC. It provides critical capabilities for monitoring, detecting, and responding to security incidents as required by the DFARS clauses. However, it is important to note that a managed SIEM system alone cannot address all 110 requirements outlined in NIST 800-171, and organizations must implement a comprehensive security program that includes multiple security solutions and practices to achieve full compliance with the standard. Overlooking the importance of a well-equipped SOC with a SIEM can significantly impact your ability to adequately address the NIST 800-171 requirements and can result in the loss of contracts or even prosecution under the False Claims Act. By working with a trusted MSP/MSSP and SIEM provider and asking the right questions, organizations can improve their security posture and meet regulatory requirements with confidence.

To ensure that your SIEM solution meets your organization’s needs and is capable of addressing the NIST 800-171 requirements, contact us today- we’re here to help!