BlueSteel Cybersecurity

BACKGROUND

Please describe your company and your position there.

CareSight is an advanced reporting and analytics-as-a-service solution that delivers actionable data to reduce risk and improve caregiver and patient experience for hospitals. I am the founder and managing partner.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

CareSight businsess requires a National Institute of Standards and Technology Special Publication 800-171 (NIST-800-171) Security Program, with a compliance posture that s monitored via the following areas:

• Security Control Monitoring & Management
• Policy & Procedure Management
• Information Repository
• Consulting Support

SOLUTION

How did you select this vendor and what were the deciding factors?

Vendor came through referral via trusted contacts affiliate with EO (the Entrepreneur's Organization)

Describe the project in detail and walk through the stages of the project.

BlueSteel Cybersecurity will serve as the Virtual CISO (Chief Information Security Officer) to work with CareSight, LLCto accomplish the following priorities:

• Establish compliance platform and create a list of all assets including the following: hardware, access control information, network diagram, and data flow diagram.
• Create initial draft of System Security Plan (SSP) that outlines the series of controls the organization will adhere to and the points of contact who are responsible for the security program.
• Outline the current DevOps process and begin incorporating OWAPS’s DevSecOps Maturity Model.
• Address open vulnerabilities for both system and application. Progress will be captured via POA&M document.
• Create CMMC level 1 (basic hygiene) checklist of 14 controls to immediately implement as a the minimum starting point.
• Establish measures, metrics, and status monitoring and control assessment frequencies that will identify the organizational security's position
• Detect changes to information system infrastructure and environments of operation
• Provide the level of security control effectiveness in a manner that supports continued operation within compliance requirements
• Implement an ongoing monitoring program to collect the data required for the defined measures and report on findings, and automate collection, analysis, and reporting of data where possible.
• Create any new policy, procedure, and design documentation necessary to fill compliance gaps and fulfill requirements for the following control groups: Access Control, Awareness & Training, Audi & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, and System & Information Integrity.
• Develop basic security training program for the organization.

How many resources from the vendor's team worked with you, and what were their positions?

Managing Partner and Chief Information Security Officer

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We are a boutique company working in a complex compliance environment. BlueSteel is giving as an effective framework that is allowing us to progressively get to 800-171 that ensures that are operating at a level required to do business in healthcare institutions in the US.

How effective was the workflow between your team and theirs?

Their project management is exceptional. Effective communication and collaboration.

What did you find most impressive or unique about this company?

Empathy regarding the difficulties of a smaller company trying to operate at the same level of multi-national corporations.

Are there any areas for improvement or something they could have done differently?

None

BACKGROUND

Please describe your company and your position there.

I'm the Chief Operating Officer of a private pay outpatient mental health practice.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

We were looking for a cybersecurity firm to conduct a Security Assessment to determine any known security vulnerabilities within the current system. Additionally, we were looking for ongoing managed IT support and strategic planning around technology systems and decisions.

SOLUTION

How did you select this vendor and what were the deciding factors?

We searched and vetted multiple firms, however, BlueSteel Cybersecurity demonstrated its expertise in numerous areas such as security, compliance, data, software, and IT.

Describe the project in detail and walk through the stages of the project.

BlueSteel Cybersecurity provided Security Assessment for our company utilizing the following approach:

1. Intelligence Gathering - This included understanding the systems, configurations, deployment processes, and any known vulnerabilities discovered in the past.
2. Vulnerability Analysis - BleSteel Cybersecurity performed the necessary scans to detect existing vulnerabilities and analyzed the data to define the action items for remedial.
3. Exploitation - BlueSteel Cybersecurity performed a series of attacks to define the current security flaws on our platforms.
4. Reporting - BlueSteel provided a final analysis that covered discoveries, suggestions, and report card grades in various areas. They then developed a Plan of Action & Milestones to outline the remediation items, which they executed flawlessly.

How many resources from the vendor's team worked with you, and what were their positions?

Ali, who is the CEO, and Tony, who is the Chief Information Security Officer

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

BlueSteel Cyber Security conducted an extensive, systematic security assessment for us, which was very eye-opening and illustrated where possible vulnerabilities lie within our systems.

Bluesteel was then able to put together a well-thought-out project plan to address all vulnerabilities and positioned our company to implement the top security coverage and best practices that can scale as we grow.

How effective was the workflow between your team and theirs?

They kept us in the loop every step of the way through weekly meetings via Zoom and the utilization of a project management board. For anything that came up in between, BlueSteel Cybersecurity was available to reach via Slack.

What did you find most impressive or unique about this company?

We appreciate how they took the time to explain all possible remedies for the vulnerabilities that were found and suggested what may work best for our company as we scale.

Are there any areas for improvement or something they could have done differently?

There is nothing at this time that could have been done better. They demonstrated phenomenal leadership at every step of the way.

BACKGROUND

Please describe your company and your position there.

I'm the founder of SubHub.com, a SaaS platform for building and managing membershop websites.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

We were looking for an external cybersecurity company to identify any security vulnerabilities that could affect our service or our clients' websites.

SOLUTION

How did you select this vendor and what were the deciding factors?

BlueSteel Cybersecurity was recommended to us by other satisfied clients. They were quickly responsive, very helpful and accommodating, and they explained our options clearly.

Describe the project in detail and walk through the stages of the project.

They explained to us how to configure our platform to provide them with necessary access. They confirmed that the platform configuration replicated a live environment so that test results would be accurate and relevant. They conducted the test and provided detailed results, with full guidance for follow-up and appropriate action where required. We were relieved

How many resources from the vendor's team worked with you, and what were their positions?

One senior resource worked closely with us throughout the course of the project.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We were relieved to learn that our platform was solid and secure, but BlueSteel Cybersecurity did identify several areas for further risk reduction and increased security. Our team is working on implementing the recommendations currently.

How effective was the workflow between your team and theirs?

The entire process has been guided patiently and smoothly. There was no disruption to normal operations and the additional effort required to support the testing was very reasonable and appropriate.

What did you find most impressive or unique about this company?

The extensive knowledge and patience shown during the process made this a very positive experience. We were supported by a senior team member and we felt respected and listened-to.

Are there any areas for improvement or something they could have done differently?

This really went as smoothly as we could have hoped. There were no areas for obvious improvement. They should just keep doing what they're doing -- it works.

BACKGROUND

Please describe your company and your position there.

I'm the CTO at Qrvey, an Embedded Business Analytics software platform for SaaS companies running on the AWS ecosystem.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

We work to ensure that our software is not prone to exploitable vulnerabilities that could lead to data or security breaches. This is particularly critical for several of our customer's deployed environments. Our goal is to run periodic 3rd party penetration tests to ensure compliance and to harden our platform.

SOLUTION

How did you select this vendor and what were the deciding factors?

We connected with Ali from BlueSteel Cybersecurity, and after desribing our requirements, we determined that they would be able to meet our needs within our accelerated timeline.

Describe the project in detail and walk through the stages of the project.

After meeting to discuss requirements and the project plan/timelines. We engaged with the BSC team to setup and perform mutliple outside penetration tests on several of our environments. After the tests were completed, we met with BSC to review the results and understand the details for remediation. After remediation, we run addtional tests to ensure any previously identified vulnerabilities are addressed.

How many resources from the vendor's team worked with you, and what were their positions?

Unsure of the total number of resources utilized, but all communication went through a central POC, which worked well for our team.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We were able to successfully complete multiple penetration tests as part of the SOW, for several of our most common platform use-cases. Based on these results, we can now share results with our customers and prospects who are going through their own security reviews/audits.

How effective was the workflow between your team and theirs?

BSC kept us updated during each step of the process, and we had good communication over multiple channels, including Email and Slack. The deliverables were also shared via an easy to access portal which made it possible to quickly find and access the content.

What did you find most impressive or unique about this company?

We appreciated their quick turnaround time during all stages of the process. From start- in defining the scope and requirements, to completing the tests and deliverables, everything was completed quickly and thoroughly.

Are there any areas for improvement or something they could have done differently?

Everything during this project was to our satisfaction.

BACKGROUND

Please describe your company and your position there.

I am the CEO and President of a company that provides sales, management, customer service training and consulting services to small to mid-market organizations.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

We had a possible sign of breach, which prompted us to look at our security practices more seriously. We decided to follow a specific security compliance process to bench as best practice.

SOLUTION

How did you select this vendor and what were the deciding factors?

We sourced 5 different organizations to submit proposals. BlueSteel Cybersecurity’s proposal was the most transparent and comprehensive offering.

Describe the project in detail and walk through the stages of the project.

We started with a comprehensive security assessment to understand the security gaps our organization was facing. From there we decided on a security compliance certification that our organization was looking to benchmark against and eventually go through the certification process at a later time. BlueSteel Cybersecurity as a readiness program that helped us setup the foundation to our program.

This program included everything from policy creation to roadmapping our security program. From there BSC then provided us with a continuous security coverage program that not only includes managed security services, but also security control management, periodic security assessments, and security policy management.

How many resources from the vendor's team worked with you, and what were their positions?

2. 1 was a project manager and 1 was cybersecurity engineer

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

In their proposal they outlined the exact deliverables that would be due at the end of the project. They have a PM tool that captured every deliverable with an ETA of delivery. They also did a great job respecting our time by giving us an understanding on time commitments and keeping us organized. Lastly they have a security compliance platform that seemed to bring all of the moving parts to this engagement into one central view that was easily understandable.

How effective was the workflow between your team and theirs?

BlueSteel Cybersecurity was exceptional in keeping everyone in sync and helping us move forward.

What did you find most impressive or unique about this company?

For a cybersecurity compliance firm, they were great in finding creative solutions to meet compliance requirements. Normally compliance is a very binary thing and sometimes the solutions can be costly for small organizations. BlueSteel Cybersecurity found alternatives that was easy for us to adopt while meeting the compliance requirement.

Are there any areas for improvement or something they could have done differently?

When you have complex projects like these, it’s easy to lose track on some tasks. I think one area of improvement would be to come up with an alert system that gives the task owner a few days heads up in case they miss a task. Not really a big item but something to think about.

BACKGROUND

Please describe your company and your position there.

Be NIST 800-171 compliant and post our SPRS score. Eventually we would like to obtain our CMMC Level 3 certification.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

Our organization was looking to be NIST 800-171 compliant and we need a firm to help us get there. BlueSteel Cybersecurity is a security compliance focused organization and has a tremendous amount of experience helping organizations like ours go through the process of developing a security program that is easy for us to follow/adopt and meets NIST 800-171 requirements.

SOLUTION

How did you select this vendor and what were the deciding factors?

We sourced and worked with different organizations in the past to help us with poor results. BlueSteel Cybersecurity’s proposal for NIST 800-171 compliance was transparent and customized for our needs.

Describe the project in detail and walk through the stages of the project.

We started with a discovery session to review our current SPRS score and the policy/compliance work performed by a previous vendor. BlueSteel Cybersecurity has a small business program that included everything from policy creation to road mapping our security program. Once we finalize our NIST 800-171 preparation, BSC will then provide us with a continuous security coverage program that not only includes managed security services, but also security control management, periodic security assessments, and security policy management.

How many resources from the vendor's team worked with you, and what were their positions?

We sourced and worked with different organizations in the past to help us with poor results. BlueSteel Cybersecurity’s proposal for NIST 800-171 compliance was transparent and customized for our needs.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Our SPRS score improved greatly within the first month of engaging with the firm.

How effective was the workflow between your team and theirs?

BlueSteel Cybersecurity use a project management platform that was easy to use and followed an agile process that included weekly huddles.

What did you find most impressive or unique about this company?

They've taken  the time to understand our business and what our needs were in terms of compliance. All of their solutions are custom-tailored for our specific operations process which we have not experienced with any other firm prior.

Are there any areas for improvement or something they could have done differently?

None.

BACKGROUND

Please describe your company and your position there.

I am the CTO at Mobomo, LLC headquartered in Vienna, VA. Our company has about 120 employees and we server federal government agencies with their digital transformation needs

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

Our company has been reviewing the new federal CMMC regulation and wanted an assessment of what we would need to do to become compliant

What were your goals for this project?

Develop a set of documents describing what Mobomo would need to implement in order to become CMMC compliant

SOLUTION

How did you select BlueSteel Cybersecurity?

One of our owners had a contact with BlueSteel

Describe the project in detail.

We met with BlueSteel to review the controls for CMMC along with a number of documents that outlined how we would implement those controls to become compliant. BlueSteel also did a security scan of our infrastructure and provided us with POA&M's and worked with us to remediate them.

What was the team composition?

We primarily worked with one consultant to review the controls and corresponding documents. We also worked with a systems engineer who scanned our infrastructure for security vulnerabilities.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

BlueSteel provided us with a clear plan for obtaining CMMC compliance and helped us to create the documentation that we would need when we peruse the certification.

How effective was the workflow between your team and theirs?

BlueSteel was easy to work with and always prompt in their communication. The tools they used to track the project were easy to used and worked well for us.

What did you find most impressive about this company?

The level of knowledge about CMMC compliance and how to implement it was impressive.

Are there any areas for improvement?

None.

BACKGROUND

Introduce your business and what you do there.

I’m a creative assist for a commercial film production company.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with BlueSteel Cybersecurity?

We recently started working with a client who required more stringent cybersecurity, specifically related to intellectual property (IP) compliance.

SOLUTION

What was the scope of their involvement?

Our clients provided a checklist of everything we needed them to do to become IP compliant, and BlueSteel Cybersecurity came up with a plan of action. We worked through that plan together, constantly communicating with the client. Now they’re providing a monitoring service.

What is the team composition?

There were three people working on the project.

How did you come to work with BlueSteel Cybersecurity?

We looked for potential partners on Google and reached out to about a dozen firms, but most of them didn’t fit the bill. BlueSteel Cybersecurity focused on compliance, which was exactly what we needed. After talking to Ali (CEO), we were confident about moving forward with them.

How much have you invested with them?

We’ve spent about $10,000 so far, and we plan to spend about $10,000 per year moving forward.

What is the status of this engagement?

We started working with them in February 2021 and the project is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement? 

The client was impressed by BlueSteel Cybersecurity’s work. They were able to complete every task on the list and delivered quality results. They clearly put some thought and effort into the preproduction process.

How did BlueSteel Cybersecurity perform from a project management standpoint?

They’ve done an excellent job managing the project. They’ve done everything we need to get the project up and running on time. They create presentations and thoroughly document everything. They make sure it’s easy for me understand and comprehend, so we can execute on our end.

We generally communicate over phone, but we also send documents through emails.

What did you find most impressive about them?

I’ve discovered that managed IT is such a vague term, but  BlueSteel Cybersecurity’s team are clearly experts in compliance. They were the perfect partners for what we needed.

Are there any areas they could improve?

I do not have any complaints. It was great working with them.

Do you have any advice for potential customers?

If you need to obtain a certain spec, this is the team to talk to.

BACKGROUND

Please describe your company and your position there.

AIMEREON Inc. is a small disadvantaged (8(a)) business focused on custom software development. My role is as Project Manager for AIMEREON's ongoing engagement with the U.S. Navy to supply COTS web-based software for learning content analysis, design, development, and life-cycle surveillance and update.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

BlueSteel Cybersecurity (BSC) is supporting AIMEREON in our ongoing Cybersecurity Maturity Model Certification (CMMC) Level 3 readiness and certification process, as well as NIST 800-171 CUI self-assessment and reporting under the new (Nov 2020) DFARS requirements.

They are also collaborating with AIMEREON in conducting DISA Application (Security Technical Implementation Guides) STIG for our COTS LEAD learning content toolset being implemented by the U.S. Navy.

What were your goals for this project?

Both on a corporate and a software product level, BlueSteel Cybersecurity will assist AIMEREON in enhancing our cybersecurity capability and in meeting all government requirements to provide (Commercial off-the-shelf) COTS software support to DOD.

SOLUTION

How did you select BlueSteel Cybersecurity?

AIMEREON identified BSC as a candidate for our cybersecurity support requirements via face-to-face meetings and discussion between BSC President Ali Alage and AIMEREON President Benjamin Chou.

Describe the project in detail.

AIMEREON's extensive cybersecurity enhancement efforts include NIST 800-171 CUI self-assessment and reporting IAW new (Nov 2021) DFARS requirements, ongoing CMMC Level 3 assessment and certification support, and detailed DISA Application STIG conduct and remediation of our COTS LEAD learning content toolset to support an ongoing contractual effort.

What was the team composition?

BSC is providing management, technical, and IT staff in support AIMEREON's management, software engineering, and instructional systems design (ISD) team for these efforts.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

BSC has assisted AIMEREON in turning around our NIST 800-171 self-assessment and reporting in less than 3 weeks to support a new subcontract award. They have also positioned the artifacts generated during that process to support our preparations for CMMC Level 3 assessment in late 2021 have stood up the Application STIG testbed for our COTS software toolset assessment in less than 30 days.

How effective was the workflow between your team and theirs?

Our virtual meeting on on-line repository collaboration has been productive and reliable.

What did you find most impressive about this company?

In a market with exaggerated claims about expertise and experience in the rapidly evolving government support cybersecurity marketplace, BlueSteel Cybersecurity has accurately portrayed their capability and over-delivered on all services and products.

Are there any areas for improvement?

AIMEREON has been highly satisfied with BSC's support and is confident our relationship will continue to evolve productively throughout our assessment and certification process.

BACKGROUND

Please describe your company and your position there.

Advanced IT Labs focuses on building customer enterprise level software solutions for fast-growing organizations. As the PMP for the company, I head our customer projects and ensure we as an organization are in compliance with the ever-changing security requirements we are asked to meet.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire BlueSteel Cybersecurity?

We needed to reach CMMC Level 3 compliance in order to participate in DoD contracts. BlueSteel Cybersecurity is a CMMC RPO and had a tremendous amount of experience helping organizations like ours go through the process.

What were your goals for this project?

CMMC Level 3 readiness. We wanted to be ready as an organization by taking the time to develop the assets and procedures that the certification requires with BlueSteel Cybersecurity.

SOLUTION

How did you select BlueSteel Cybersecurity?

We sourced 5 different organizations to submit proposals. BlueSteel Cybersecurity’s proposal was the most transparent and comprehensive offering.

Describe the project in detail.

We needed CMMC/NIST-800-171 Level 3 Readiness service to meet NIST-800-171 requirements currently and prepare for a CMMC Level 3 assessment. Our goal with an outside vendor was to align the scope of NIST-800-171 and CMMC to help the organization understand the applicable control environment. The end result is everything required for a successful assessment and be able to prove we have met all 130 security controls.

What was the team composition?

On Advanced IT Labs, we had me and our tech team. On BlueSteel Cybersecurity’s side had their CISSP/PM, CISO, and Security Engineer

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Yes. In their proposal, they outlined the exact deliverables that would be due at the end of the project. They have a PM tool that captured every deliverable with an ETA of delivery. They did a great job respecting our time by giving us an understanding of time commitments and keeping us organized. With all of that said and done, we completed the project faster than expected.

How effective was the workflow between your team and theirs?

As previously mentioned, BlueSteel Cybersecurity was exceptional in keeping the two teams in sync and helping us move forward.

What did you find most impressive about this company?

For a cybersecurity compliance firm, they were great in finding creative solutions to meet compliance requirements. Normally compliance is a very binary thing and sometimes the solutions can be costly for small organizations. BlueSteel Cybersecurity found alternatives that were easy for us to adopt while meeting the compliance requirement.

Are there any areas for improvement?

When you have complex projects like these, it’s easy to lose track of some tasks. I think one area of improvement would be to come up with an alert system that gives the task owner a few days heads up in case they miss a task. Not really a big item but something to think about.