防衛産業基盤（DIB）は、国家主導の高度な攻撃者から絶え間なく攻撃を受けています。こうした攻撃は、必ずしも大規模で派手なテイクダウンイベントとは限りません。多くの場合、「低速かつ継続的」な攻撃であり、機密データを静かに盗むように設計されています。そして、盗まれたデータが集積されることで、国家の安全保障が脅かされる可能性があります。米政府と契約を結ぶ大手医療デバイスメーカーStryker社が最近受けた攻撃は、サプライチェーンのあらゆる部分が標的になるということを明確に示しています。今、防衛産業基盤（DIB）が管理対象非機密情報（CUI）に対する防御を強化する必要があることは、これまで以上に明白です。
この課題に対処するため、米国陸軍省（DoW）は、機密情報を扱う委託業者のサプライチェーン全体に、同省の厳格なセキュリティ基準を適用することを義務付けられています。このCUIを、悪意のあるデータ侵害や単なる不適切な内部処理から保護することは、国家防衛における直接的かつ不可欠な要素です。
サイバーセキュリティ成熟度モデル認定（CMMC）は、こうした保護を確実にするための陸軍省（DoW）のフレームワークです。現在、CMMC 2.0は、すべての委託業者および下請業者が要求されるNISTのサイバーセキュリティ基準を確実に実施していることを保証するためのコンプライアンスおよび検証の義務です。現在、DoD（米国国防総省）の契約を獲得するには、適切なCMMC認定レベルの取得が必須条件となります。
シリーズ：CMMC成功のための設計指針
CMMCは幅広いセキュリティドメインを網羅していますが、そのフレームワーク全体はゼロトラストの基盤の上に構築されています。そして、ゼロトラストの基礎となるのがアイデンティティです。Oktaはアイデンティティ管理における独立系の主要パートナーとして、お客様がCMMCの重要なドメインであるアクセス制御（AC）および識別と認証（IA）に対応できるよう支援する独自の立場にあります。
さらに、Oktaはセキュリティエコシステム全体の中央統合プレーンとして機能します。Oktaの堅牢なAPIとOkta Integration Networkを通じて、お客様のアイデンティティプラットフォームを、お客様が信頼する他のセキュリティツールと接続できるようになります。これにより、複数のドメインにわたるCMMC要件にも準拠した、一貫性のある強力な防御体制を構築できます。
この複数回にわたるブログシリーズでは、CMMCレベル2の基礎となる NIST SP 800-171 の主要なファミリーと、CMMCレベル3の基礎となる NIST SP 800-171 の主要なファミリーについて解説します。Oktaが どのように 役立つかを示すだけでなく、CMMCに準拠したアーキテクチャを設計するために利用できる実用的なブループリントを提供し、コンプライアンスを証明するために監査人に提示できる具体的な証拠を詳述します。
CMMCスコアリング：その重要性を理解する
すべてのCMMC管理策が同じように作られているわけではないことを理解することがきわめて重要です。DoWでは、重要度に応じてコントロールに1、3、5点のいずれかの点数を割り当てる加重スコアリングシステムを採用しています。つまり、次のことを意味します：
- 満点は110点です。
- 組織は、最低88点を獲得し、残りのすべてのギャップが1点コントロールに関するものであり、かつ「是正措置計画書（POA&M）」に文書化されていることを条件として、条件付き認定の対象となる場合があります。
- 重要なのは、価値の高い「Big Rock」コントロール（3点または5点）が1つでも「未達成」と評価された場合、スコアに関係なく評価は不合格となることです。これらはすべて、監査の時点で完全に準拠している必要があります。
こうした「Big Rocks」の多くはアイデンティティ関連のものであり、アイデンティティプロバイダーの選択は、CMMCへの取り組みにおいて最も重要な決定事項の1つとなります。本シリーズを通して、それらの習得方法をぜひご覧ください。
Oktaがこうした要件への顧客の対応をどのように支援しているかについては、以下の表をご覧ください。
注：この表は、Oktaが対応またはサポートできるCMMC 2.0の統制のみを対象としています。
| Family | Level 1 Identifier | Level 2 Identifier | Level 3 Identifier | Score | Okta Scope | Supporting Product |
|---|---|---|---|---|---|---|
| Access Control (AC) | AC.L1-3.1.1 Authorized Access Control Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). | 5 | Meet | Universal Directory, Okta Identity Governance | ||
| AC.L1-3.1.2 Transaction and Function Control Limit information system access to the types of transactions and functions that authorized users are permitted to execute. | 5 | Meet | Universal Directory, Okta Identity Governance, Identity Threat Protection | |||
| AC.L3-3.1.2E Organizationally Controlled Assets Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization. | Meet | Universal Directory, Okta Device Access, Adaptive Multifactor Authentication | ||||
| AC.L2-3.1.3 Control CUI Flow Control the flow of CUI in accordance with approved authorizations. | 1 | Support | Universal Directory, Okta Identity Governance | |||
| AC.L3-3.1.3E Secured Information Transfer Employ secure information transfer solutions to control information flows between security domains on connected systems. | Universal Directory, Okta Identity Governance, API Access Management | |||||
| AC.L2-3.1.4 Separation of Duties Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | 1 | Support | Universal Directory | |||
| AC.L2-3.1.5 Least Privilege Employ the principle of least privilege, including for specific security functions and privileged accounts. | 3 | Meet | Universal Directory, Okta Identity Governance, Identity Threat Protection | |||
| AC.L2-3.1.6 Non-Privileged Account Use Use non-privileged accounts or roles when accessing nonsecurity functions. | 1 | Meet | Universal Directory | |||
| AC.L2-3.1.7 Privileged Functions Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | 1 | Meet | Universal Directory | |||
| AC.L2-3.1.8 Unsuccessful Logon Attempts Limit unsuccessful logon attempts. | 1 | Meet | Universal Directory | |||
| AC.L2-3.1.9 Privacy & Security Notices Provide privacy and security notices consistent with applicable CUI rules. | 1 | Support | Universal Directory | |||
| AC.L2-3.1.10 Session Lock Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity | 1 | Support | Okta Device Access | |||
| AC.L2-3.1.11 Session Termination Terminate (automatically) a user session after a defined condition. | 1 | Meet | Universal Directory, Identity Threat Protection, Okta Device Access | |||
| AC.L2-3.1.13 Remote Access Confidentiality Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | 5 | Support | Universal Directory | |||
| AC.L2-3.1.15 Privileged Remote Access Authorize remote execution of privileged commands and remote access to security-relevant information. | 1 | Support | Okta Identity Governance | |||
| AC.L2-3.1.18 Mobile Device Connection Control connection of mobile devices. | 5 | Meet | Universal Directory | |||
| Audit and Accountability (AU) | AU.L2-3.3.1 System Auditing Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. | 5 | Meet | Universal Directory, Identity Threat Protection | ||
| AU.L2-3.3.2 User Accountability Ensure that the actions of individual system users, can be uniquely traced to those users so they can be held accountable for their actions. | 3 | Meet | Universal Directory, Identity Threat Protection | |||
| AU.L2-3.3.3 Event Review Review and update logged events. | 1 | Support | Universal Directory, Identity Threat Protection | |||
| AU.L2-3.3.5 Audit Correlation Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. | 5 | Support | Universal Directory, Identity Threat Protection | |||
| AU.L2-3.3.6 Reduction & Reporting Provide audit record reduction and report generation to support on-demand analysis and reporting. | 1 | Support | Universal Directory, Identity Threat Protection | |||
| AU.L2-3.3.7 Authoritative Time Source Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. | 1 | Meet | Universal Directory | |||
| AU.L2-3.3.8 Audit Protection Protect audit information and audit logging tools from unauthorized access, modification, and deletion. | 1 | Meet | Universal Directory, Identity Threat Protection | |||
| AU.L2-3.3.9 Audit Management Limit management of audit logging functionality to a subset of privileged users. | 1 | Meet | Universal Directory, Identity Threat Protection | |||
| Configuration Management (CM) | CM.L2-3.4.1 System Baselining Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. | 5 | Support | Universal Directory, Adaptive Multifactor Authentication, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection, Okta Device Access | ||
| CM.L2-3.4.2 Security Configuration Enforcement Establish and enforce security configuration settings for information technology products employed in organizational systems. | 5 | Support | Universal Directory, Adaptive Multi-factor Authentication, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection, Okta Device Access | |||
| CM.L3-3.4.2E Automated Detection & Remediation | N/A | Support | Adaptive Multifactor Authentication | |||
| CM.L2-3.4.5 Access Restrictions for Change Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. | 5 | Support | Universal Directory, Okta Identity Governance | |||
| Identification and Authentication (IA) | IA.L1-3.5.1 Identification Identify information system users, processes acting on behalf of users, or devices. | 5 | Meet | Universal Directory | ||
| IA.L3-3.5.1E Bidirectional Authentication Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant. | N/A | Support | Okta Device Access | |||
| IA.L1-3.5.2 Authentication Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. | 5 | Meet | Universal Directory | |||
| IA.L2-3.5.3 Multifactor Authentication Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. | 1 | Meet | Universal Directory | |||
| IA.L3-3.5.3E Block Untrusted Assets Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. | N/A | Support | Universal Directory, Okta Device Access, Adaptive Multifactor Authentication | |||
| IA.L2-3.5.4 Replay-Resistant Authentication Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. | 1 | Meet | Universal Directory | |||
| IA.L2-3.5.5 Identifier Reuse Prevent the reuse of identifiers for a defined period. | 1 | Meet | Universal Directory | |||
| IA.L2-3.5.6 Identifier Handling Disable identifiers after a defined period of inactivity. | 1 | Meet | Universal Directory, Okta Identity Governance, Workflows | |||
| IA.L2-3.5.7 Password Complexity Enforce a minimum password complexity and change of characters when new passwords are created. | 1 | Meet | Universal Directory | |||
| IA.L2-3.5.8 Password Reuse Prohibit password reuse for a specified number of generations. | 1 | Meet | Universal Directory | |||
| IA.L2-3.5.9 Temporary Passwords Allow temporary password use for system logons with an immediate change to a permanent password. | 1 | Meet | Universal Directory | |||
| IA.L2-3.5.10 Cryptographically-Protected Passwords Store and transmit only cryptographically protected passwords. | 5 | Meet | Universal Directory, Adaptive Multi-factor Authentication | |||
| IA.L2-3.5.11 Obscure Feedback Obscure the feedback of authentication information. | 1 | Meet | Universal Directory | |||
| Incident Response | IR.L3-3.6.1E Security Operations Center | N/A | Support | Universal Directory, Workflows | ||
| IR.L3-3.6.2E Cyber Incident Response Team | N/A | Support | Universal Directory, Identity Threat Protection, Workflows | |||
| Maintenance (MA) | MA.L2-3.7.5 Nonlocal Maintenance Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. | 5 | Meet | Universal Directory, Adaptive Multi-factor Authentication, Okta Identity Governance | ||
| Media Protection (MP) | MP.L2-3.8.9 Protect Backups Protect the confidentiality of backup CUI at storage locations. | 1 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | ||
| Personnel Security (PS) | PS.L2-3.9.2 Personnel Actions Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. | 5 | Meet | Lifecycle Management | ||
| PS.L3-3.9.2E Adverse Information Ensure that organizational systems are protected if adverse information develops or is obtained about individuals with access to CUI. | N/A | Support | Universal Directory, Okta Device Access, Identity Threat Protection, Workflows | |||
| Risk Assessment (RA) | RA.L2-3.11.2 Vulnerability Scan Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. | 5 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | ||
| RA.L3-3.11.2E Threat Hunting Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. | N/A | Support | Universal Directory, Identity Threat Protection, Workflows | |||
| RA.L3-3.11.3E Advanced Risk Identification Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components. | N/A | Support | Universal Directory, Identity Threat Protection, Workflows | |||
| RA.L3-3.11.5E Security Solution Effectiveness Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. | N/A | Support | Universal Directory, Identity Threat Protection, Workflows, Okta Identity Governance | |||
| RA.L3-3.11.6E Supply Chain Risk Response Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. | N/A | Support | Universal Directory, Identity Threat Protection, Workflows, Okta Identity Governance | |||
| RA.L3-3.11.7E Supply Chain Risk Plan Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. | N/A | Support | Universal Directory, Identity Threat Protection, Workflows, Okta Identity Governance | |||
| Security Assessment (CA) | CA.L2-3.12.1 Security Control Assessment Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. | 5 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | ||
| CA.L2-3.12.2 Plan of Action Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | 3 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | |||
| CA.L2-3.12.3 Security Control Monitoring Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. | 5 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | |||
| System and Communications Protection (SC) | SC.L1-3.13.1 Boundary Protection Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. | 5 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | ||
| SC.L2-3.13.2 Security Engineering Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. | 5 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | |||
| SC.L2-3.13.3 Role Separation Separate user functionality from system management functionality. | 1 | Meet | Universal Directory | |||
| SC.L2-3.13.4 Shared Resource Control Prevent unauthorized and unintended information transfer via shared system resources. | 1 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | |||
| SC.L3-3.13.4E Isolation Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components. | N/A | Support | Universal Directory, Okta Identity Governance, Org2Org | |||
| SC.L2-3.13.8 Data in Transit Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. | 3 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | |||
| SC.L2-3.13.11 CUI Encryption Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | 1 | Meet | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | |||
| System and Information Integrity (SI) | SI.L3-3.14.1E Integrity Verification Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures. | N/A | Support | Universal Directory | ||
| SI.L2-3.14.3 Security Alerts & Advisories Monitor system security alerts and advisories and take action in response. | 5 | Support | Universal Directory, Adaptive Multifactor Authentication, Okta Device Access, API Access Management, Okta Identity Governance, Workflows, Identity Threat Protection | |||
| SI.L3-3.14.6E Threat-Guided Intrusion Detection Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting. | N/A | Support | Universal Directory, Identity Threat Protection |
Oktaがお客様の組織のCMMC要件への対応をどのように支援できるかについて、詳細をご覧になるには、https://www.okta.com/resources/datasheet-okta-cmmc-discovery-guide/からOktaの「CMMCディスカバリーガイド」をダウンロードしてください。または、okta.com/contact-sales/までお問い合わせください。
本記事は特定の法概念について解説していますが、法的な助言を構成するものではなく、またそのように解釈されるべきではありません。本資料は情報提供のみを目的としています。貴社のコンプライアンス要件に関する法的なアドバイスについては、貴社の法務部門にご相談ください。Oktaは、本記事の内容に関して、いかなる表明、保証、またはその他の保証も行いません。お客様に対するOktaの契約上の保証に関する情報は、okta.com/agreementsをご覧ください。
