Evolving Cybersecurity Landscape

The defense industry and commercial businesses are increasingly concerned about cybersecurity. In most cases, to qualify as a contractor for government contracts, adherence to established cybersecurity standards is a requirement.

Given the amount of work Infinity Fuel conducts with NASA and the federal government, the company was obligated to conform to cybersecurity requirements. To help them fulfill their cyber compliance, Infinity partnered with CONNSTEP, the Manufacturer Extension Partnership (MEP) representative in Connecticut.

Initiating the Compliance Process

As a government contractor, Infinity Fuel Cell and Hydrogen must comply with Defense Federal Acquisition Regulation Supplement (DFARS) requirements that all companies doing business with the U.S. Department of Defense (DoD) safeguard sensitive defense-related data and report cybersecurity incidents. Adequate security includes implementing the requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.

Infinity needed to complete a system assessment, implement new policies, conduct staff training, and strengthen their Information Technology (IT) hardware and software configurations.

In order to improve the safeguards of defense-related data, CONNSTEP collaborated with Infinity Fuel to:

• Perform a gap analysis to NIST SP 800-171 requirements
• Create a Plan of Action (POA)
• Customize policies and procedures
• Define milestones in the POA
• Create a System Security Plan (SSP)
• Create an Incident Response Plan (IRP)
• Train employees on new policies and procedures

Infinity’s implementation of NIST SP 800-171 controls is a key step towards the development of a sustainable Cybersecurity Maturity Model Certification (CMMC) program.

Compliance with DoD cybersecurity measures was well-documented by Infinity management with guidance and assistance by CONNSTEP.

Specifically, CONNSTEP conducted an assessment of Infinity’s understanding of the DFARS and NIST SP 800-171 requirements. The effectiveness of security controls was evaluated and any gaps in the performance of these controls were identified as they related to NIST SP 800-171 and delivered in a report.

With findings from the gap analysis report, a Plan of Action was created with risk prioritization. It included policies and procedures structured to help Infinity achieve compliance with DFARS 252.204-7012 and NIST SP 800-171 cybersecurity protocols and requirements.

The Infinity Fuel team and their IT resources worked with CONNSTEP on an SSP and IRP for the company. Infinity’s System Security Plan contains their:

• Cybersecurity assessments
• Network and interconnection diagrams
• Plan of Action information
• Policies and procedures for NIST SP 800-171 compliance

The Incident Response Plan developed by the Infinity team prescribes timely and protective procedures for employees to handle cyber incidents at the company and their IT network, necessary to be compliant with NIST SP 800-171.

Infinity Fuel management has taken the necessary steps and followed the processes required to achieve compliance in good standing as a contractor for federal government programs.

Next Steps

Infinity management will train their employees on policies and procedures to ensure cybersecurity compliance at all levels of the company.

In addition, CONNSTEP will assist Infinity Fuel in development of a sustainable CMMC program, building on their implementation of NIST SP 800-171 controls. The program provides assurance to the DoD that Infinity has the ability to meet cybersecurity requirements and manage information risk.