Totem.Tech

BACKGROUND

Please describe your company and your position there.

We are a provider of metal finishing and coating services for aerospace, defense, medical, and other fields. I am the Director of I.T., responsible for keeping our systems protected and running smoothly across four physical locations.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Totem.Tech?

I attended a cybersecurity live course specifically related to NIST 800-171 compliance and CMMC certification preparation.

What were your goals for this project?

Learn more about what needs to be done and how far we actually need to go in order to comply with NIST 800-171.

SOLUTION

How did you select Totem.Tech?

The instructor, Adam Austin, was a presenter at a large-scale webinar that I attended. His part of the presentation was by far the most interesting, engaging, and informative. For that reason, I reached out to him directly with some specific questions on these topics, and he suggested I consider signing up for one of their live, interactive courses.

Describe the project in detail.

The classes were held twice per week over a three week period via a web-based collaboration tool. Adam provided a series of guidelines and tools intended to help translate the overwhelming and often ambiguous NIST 800-171 specification into manageable actions using real world examples.

What was the team composition?

The class size was small and intimate (only four to five attendees). Mostly I.T. administrators in a situation similar to my own.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Using what was learned in this class, I was able to discern that we do not actually process the types of data that dictate compliance with NIST 800-171. This was not only a huge relief, but also allowed me to save the company hundreds of thousands of dollars in infrastructure and facility upgrades that would have been required in order to fully comply.

How effective was the workflow between your team and theirs?

Everything about this course and the instructor was exemplary.

What did you find most impressive about this company?

Adam is an amazing asset who is personable and really knows his stuff. He's in the trenches and has a deep desire to help anyone else who is preparing for a similar journey.

Are there any areas for improvement?

I have no complaints. This was, by far, the best money I've spent all year.

BACKGROUND

Please describe your company and your position there.

I'm the Director of Quality and Compliance at an aerospace and defense manufacturing organizations

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Totem.Tech?

We contracted Totem to assist both companies with the monumental challenge of becoming compliant to CMMC (Cybersecurity Maturity Model Certification).

The requirements flowed down through DFAR 7012 and NIST 800-171 in the last few years are nothing like what we've experienced before. The scope of becoming compliant was larger than what our IT team, which is staffed with brilliant, devoted individuals, could support.

What were your goals for this project?

The goal for both companies was and is to become certified to Level 3 of the CMMC.

SOLUTION

How did you select Totem.Tech?

Totem impressed us from the outset with their knowledge of the requirements for cybersecurity and the solutions available in the marketplace. They are unique in that they know what will meet the controls and satisfy audit requirements and what may pose a potential risk.

Totem also helped create a team of reputable providers around us to meet the various requirements such as 24/7 threat monitoring. The government's cybersecurity initiative is all about managing risk. I strongly believe Totem is helping our organizations identify and avoid risk and will prepare us adequately to pass the coming certification audits.

Describe the project in detail.

We spent time utilizing the various templates that Totem has assembled to define the boundaries of the IT structure and the necessary controls required. CMMC is a whole other level of beyond IT.

It's all inclusive from implementing and managing hardware and software controls, operational security (OPSEC) and internal and external electronic communication to name a few. Totem expertly covered all controls (130 controls with CMMC L3) so we could identify and implement effective, compliant solutions.

What was the team composition?

Representatives from IT and the ISO were present and actively involved the entire time with Totem. Totem sent multiple representatives to support our efforts.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

An SSP, POA&M, IRP and AUP documents have been created and we are focusing on the close out of the action items from the POA&M. Totem also assisted us in obtaining the reporting mechanisms (medium assurance certificates) required for reporting suspected incidents to DIBNET.

How effective was the workflow between your team and theirs?

If we hadn't used Totem's approach, their experts, and their structured online system, the time required to identify solutions in order to complete our documents would have been a factor of at least 3 or 4, probably more.

CMMC (which is being integrated into the revised DFAR 7012) is progressing essentially site unseen unless you have a means to track its progress through the government or you have participated in the recent webinars by Mrs. Katie Arrington. CMMC is real and it's coming quickly. I feel confident that we will be ready so that we can continue providing products to the US government.

What did you find most impressive about this company?

The ongoing support from Totem has been awesome. Adam Austin's knowledge of the requirements and solutions available in the industry is staggering. Adam has quickly answered every question (some relatively easy while others are complex) that I have had in the last year since we began this effort to my satisfaction. He's a wealth of information that is unmatched in the industry.

Are there any areas for improvement?

No, Totem is awesome. They exceeded all expectations and have gone way above and beyond the scope of what we contracted.