Executive Summary
This assessment evaluated Mavis’s Machine Shop, a Defense Industrial Base (DIB) contract manufacturer, against the Protect and Detect functions of NIST CSF 2.0, cross-mapped to NIST SP 800-171 Rev 2 for CMMC Level 2 readiness.
Key Findings
- Overall Posture: Average current maturity is 2.3 against an average target of 3.3.
- Strengths: Identity and access management is the strongest area (3.3), though gaps remain in hardware authentication and physical access logging.
- Weaknesses: Adverse event analysis is the weakest (1.2 against a target of 3). Nine subcategories are two or more levels below target.
Top Risks Identified
1. No centralized log monitoring (SIEM).
2. Undefined incident declaration criteria.
3. MFA applied only to external access.
Limitations: The incident response and BC/DR plans were not provided, and the written policy is dated 2021.
Assessment Methodology
To provide a realistic gap analysis, I evaluated 33 subcategories across the Protect (PR) and Detect (DE) functions. Each subcategory was scored using a 4-tier maturity model and mapped directly to its corresponding NIST SP 800-171 control for CMMC readiness.
| Maturity Score | Tier Definition |
|---|---|
| 1.0 - Partial | Ad-hoc, informal processes. Reactive approach. |
| 2.0 - Risk Informed | Approved processes exist, but not organization-wide. |
| 3.0 - Repeatable | Formally documented, organization-wide policies enforced. |
| 4.0 - Adaptive | Continuous improvement, predictive, automated. |
Risk Register Snapshot
The gap analysis was translated into a business risk register. Below are the top 3 critical risks requiring immediate remediation.
| Risk | Description | Score | Recommendation |
|---|---|---|---|
| R-01 | Undetected Intrusion: Lack of SIEM/centralized log correlation allows attackers to dwell undetected. | 16 (Critical) | Deploy SIEM or managed detection service; define log sources and correlation rules. |
| R-02 | Incident Misclassification: Undefined incident criteria risk missing DoD reporting deadlines (72 hrs). | 20 (Critical) | Formalize IR plan with severity matrix and reporting timelines; run tabletop exercises. |
| R-03 | MFA Gap: MFA is only required for external access, leaving internal networks vulnerable to stolen credentials. | 20 (Critical) | Extend MFA to privileged accounts and general internal network access. |
Project Deliverables
Download the full, redacted Excel workbook containing the complete 33-subcategory Gap Assessment, Risk Register, and Scoring Methodology.
Download Full Assessment (.xlsx) Download Executive Summary (.md)