RSI Security

Blog

  • Streamline Your CMMC Certification with Control Mapping

    Streamline Your CMMC Certification with Control Mapping

    CMMC Certification will soon be a requirement for nearly all Department of Defense (DoD) contractors. For many organizations, achieving compliance may feel overwhelming. A practical way to streamline the process is through control mapping aligning existing security controls from other frameworks you already follow with CMMC requirements.

    (more…)

  • Top Healthcare Internal Data Security Challenges

    Top Healthcare Internal Data Security Challenges

    While HIPAA (Health Insurance Portability and Accountability Act of 1996) is widely known for protecting against external cyber threats, many healthcare organizations overlook the dangers lurking inside their own systems. Internal security challenges, like employee errors, unauthorized access, and weak internal processes, can put sensitive patient data at risk just as much as outside attacks. To truly safeguard healthcare data, organizations must address both external and internal threats. (more…)

  • Understanding PCI 6.4.3

    Understanding PCI 6.4.3

    Organizations across the payment card industry (PCI) often face challenges meeting evolving compliance standards. One of the most complex updates in the latest PCI DSS framework is Requirement 6.4.3, which focuses on change management and security validation. For e-commerce businesses especially, maintaining compliance requires careful planning, continuous monitoring, and adaptable security controls.

    Is your organization prepared to comply with PCI DSS 6.4.3? Request a consultation with RSI Security to strengthen your compliance posture and protect sensitive payment data.

    (more…)

  • How much does CMMC Certification Cost?

    How much does CMMC Certification Cost?

    CMMC certification cost is one of the biggest concerns for Department of Defense (DoD) contractors today. Whether you’re a prime contractor or subcontractor, certification is now required to bid on and maintain DoD contracts.

    Unlike previous self-attestation models, contractors must now undergo a third-party CMMC assessment to verify compliance. The total cost of CMMC certification depends on several factors, including your required CMMC level, current cybersecurity maturity, remediation needs, and assessment scope.

    So, how much should your organization budget for CMMC certification? In this guide, we’ll break down CMMC certification costs by level, explain what drives pricing, and outline how contractors can reduce compliance expenses.


    What Is CMMC?

    The Cybersecurity Maturity Model Certification (CMMC) is the cybersecurity framework required for companies that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) within the Department of Defense (DoD) supply chain. Any contractor or subcontractor bidding on DoD contracts must meet the applicable CMMC requirements.

    CMMC was developed to strengthen cybersecurity across more than 300,000 organizations in the defense industrial base. Prior to CMMC, contractors relied largely on self-attestation to confirm compliance with security standards such as NIST SP 800-171. Under the updated CMMC model, independent third-party assessments are required for many contractors to verify compliance.

    The framework establishes multiple certification levels based on the sensitivity of the information handled and the cybersecurity maturity of the organization. The higher the required level, the more extensive the security controls, documentation, and assessment requirements,  which directly impacts overall CMMC certification cost.

    Understanding how CMMC works is critical before estimating certification expenses, since required level, scope, and remediation needs all influence total cost.


    What Are the CMMC Levels?

    Under CMMC 2.0, the framework is structured into three certification levels, each based on the sensitivity of information handled and the cybersecurity maturity required. The level your organization must achieve directly impacts your overall CMMC certification cost, since higher levels require more controls, documentation, and assessment rigor.

    Each level builds upon the previous one.


    Level 1 – Foundational

    Level 1 applies to contractors that handle Federal Contract Information (FCI). Organizations must implement basic cybersecurity practices such as:

    • Access control measures
    • Regular password updates
    • Antivirus and endpoint protection
    • Basic data safeguarding policies

    At this level, companies typically perform an annual self-assessment. Because requirements are limited, Level 1 generally involves the lowest CMMC certification cost.


    Level 2 – Advanced

    Level 2 applies to organizations that process or store Controlled Unclassified Information (CUI). This level aligns with NIST SP 800-171 and requires implementation of 110 security controls.

    Requirements include:

    • Documented security policies and procedures
    • Risk assessments
    • Incident response planning
    • System security plans (SSPs)
    • Plan of Action & Milestones (POA&M)

    Most Level 2 contractors must undergo a third-party assessment (C3PAO) every three years. Because of expanded documentation and audit requirements, Level 2 significantly increases total CMMC certification cost.


    Level 3 – Expert

    Level 3 is designed for contractors supporting the most sensitive DoD programs. In addition to Level 2 requirements, organizations must implement enhanced security controls aligned with federal cybersecurity standards.

    Level 3 includes:

    • Advanced threat detection and response
    • Ongoing security monitoring
    • Additional federal security controls beyond NIST 800-171

    Assessments are conducted by government-led teams. Due to the complexity, Level 3 carries the highest CMMC certification cost.

    Key Points About CMMC Levels

    • Levels build on each other, you must fully meet lower-level requirements before advancing.
    • Certification level determines which DoD contracts you can bid on.
    • Higher levels require more documentation, controls, and audit oversight.
    • Your required level is one of the biggest factors influencing CMMC certification cost. 

    [su_button url=”https://www.rsisecurity.com/request-demo/” target=”blank” style=”flat” size=”11″ center=”yes”]Request a Free Consultation[/su_button]


    What Will CMMC Certification Cost?

    The total CMMC certification cost depends on your required certification level, current cybersecurity maturity, scope of systems handling FCI or CUI, and whether remediation is needed before assessment.

    While exact pricing varies, organizations can generally expect costs in three primary categories:

    1. Assessment Costs

    Assessment fees depend on certification level and assessment type:

    • Level 1 (Self-Assessment) – Minimal direct audit cost, but internal compliance preparation expenses still apply.
    • Level 2 (Third-Party Assessment – C3PAO) – Typically ranges from $30,000 to $60,000+, depending on scope and complexity.
    • Level 3 (Government-Led Assessment) – Costs vary significantly due to additional federal oversight and enhanced security requirements.

    Assessment scope, number of users, number of locations, and network complexity all impact final pricing.


    2. Remediation & Implementation Costs

    For many contractors, remediation represents the largest expense. Costs may include:

    • Implementing NIST SP 800-171 controls
    • Purchasing security tools (MFA, SIEM, endpoint detection)
    • Updating policies and documentation
    • Conducting risk assessments
    • Developing a System Security Plan (SSP) and POA&M

    Organizations with mature cybersecurity programs will generally face lower remediation costs than those starting from scratch


    3. Ongoing Compliance & Recertification Costs

    CMMC certification is not a one-time expense. Contractors must maintain compliance continuously.

    • Level 1 requires annual self-assessments.
    • Level 2 requires reassessment every three years.
    • Level 3 involves additional federal review requirements.

    Ongoing monitoring, policy updates, and security improvements contribute to long-term CMMC compliance costs.


    Are CMMC Certification Costs Reimbursable?

    In many cases, CMMC-related expenses are considered allowable costs under DoD contracts. Assessment and certain remediation expenses may be recoverable, depending on contract structure. However, contractors are still responsible for upfront implementation investments.


    The Cost of Ignoring CMMC Certification

    While many contractors focus on CMMC certification cost, the financial risk of non-compliance can be significantly higher.

    CMMC requirements incorporate NIST SP 800-171 controls and Defense Federal Acquisition Regulation (DFARS) cybersecurity clauses. Failure to meet these standards can expose contractors to serious financial, legal, and operational consequences.


    Potential Consequences of CMMC Non-Compliance

    • Contract termination if Controlled Unclassified Information (CUI) is compromised and compliance requirements were not met
    • Loss of eligibility for future DoD contracts
    • Withholding or loss of federal funding
    • Civil penalties or False Claims Act liability
    • Criminal investigations in cases of severe negligence or misrepresentation
    • Mandatory government reviews or audits

    Beyond regulatory penalties, organizations may also face:

    • Reputational damage within the defense industrial base
    • Increased scrutiny from prime contractors
    • Loss of competitive positioning in contract bids

    For many organizations, the long-term financial impact of a breach or compliance failure can exceed the upfront investment required for CMMC certification.

    In short, while CMMC certification cost requires planning and budgeting, the cost of ignoring certification can jeopardize revenue, contracts, and long-term business viability.


    Getting Ahead of CMMC Certification Costs

    Organizations can reduce overall CMMC certification cost by taking proactive steps before a formal assessment begins. Early preparation not only minimizes audit findings but also reduces remediation expenses and assessment delays.

    Here are practical steps contractors can take:

    1. Determine Your Required CMMC Level

    Your required certification level determines the scope of controls, documentation, and assessment type. Understanding whether your organization must meet Level 1, Level 2, or Level 3 requirements allows you to align resources efficiently and avoid over- or under-investing in compliance efforts.


    2. Conduct a Gap Assessment

    Before engaging a third-party assessor, perform an internal or consultant-led gap analysis against applicable CMMC requirements. Identifying weaknesses early helps prevent costly surprises during a formal assessment.


    3. Budget for Total Certification Costs

    Your CMMC certification cost should account for:

    • Assessment fees
    • Remediation and technology upgrades
    • Policy development and documentation
    • Employee training
    • Ongoing monitoring and compliance maintenance

    Building a realistic compliance budget reduces financial strain and improves project planning.


    4. Align with NIST SP 800-171 Requirements

    For Level 2 and above, aligning systems and processes with NIST SP 800-171 controls is critical. Implementing controls methodically — rather than reactively — helps control remediation costs and accelerates certification readiness.


    5. Develop and Maintain Required Documentation

    A strong System Security Plan (SSP) and Plan of Action & Milestones (POA&M) demonstrate structured compliance management. Clear documentation reduces audit friction and helps maintain long-term certification status.


    6. Plan for Ongoing Compliance

    CMMC is not a one-time project. Continuous monitoring, policy updates, and periodic reassessments are necessary to maintain certification and control long-term compliance costs.

    Organizations that invest early in cybersecurity maturity often experience significantly lower CMMC certification costs than those attempting last-minute compliance.


    Conclusion

    For Department of Defense contractors, CMMC certification is no longer optional.  it is a prerequisite for bidding on and maintaining federal contracts. The framework is designed to strengthen cybersecurity across the defense industrial base and reduce the financial and operational impact of compromised Controlled Unclassified Information (CUI).

    While many organizations focus on CMMC certification cost, the greater financial risk often lies in non-compliance. Contract termination, loss of eligibility for future bids, regulatory penalties, and reputational damage can significantly exceed the upfront investment required to achieve certification.

    The total CMMC certification cost ultimately depends on your required level, existing cybersecurity maturity, and scope of systems handling sensitive data. Contractors that prepare early, align with NIST requirements, and address gaps proactively are typically able to control both remediation expenses and long-term compliance costs.

    Working with experienced CMMC advisors can streamline preparation, reduce audit friction, and help ensure a smoother certification process. RSI Security  compliance specialists support contractors through readiness assessments, remediation planning, and third-party audit preparation,  helping organizations achieve certification efficiently and cost-effectively.

    Download Our CMMC Checklist



     

  • What is a C3PAO?

    What is a C3PAO?

    If your business works with the Department of Defense (DoD) or operates within the Defense Industrial Base (DIB), you’ve likely heard about CMMC certification. But understanding how to navigate CMMC 2.0—especially Level 2 assessments—requires working with a special kind of partner: a C3PAO. So, what exactly is a C3PAO, and why does it matter for your compliance journey? This blog breaks down the definition, responsibilities, and strategic value of a C3PAO—and explains how to choose the right one for your organization. (more…)

  • What Happens If You Violate HIPAA?

    What Happens If You Violate HIPAA?

    The Health Insurance Portability and Accountability Act (HIPAA), signed into law in 1996, established strict requirements for protecting the privacy and security of individuals’ health information. Its primary goal is to ensure that sensitive patient data, known as protected health information (PHI), is properly safeguarded by healthcare organizations and their business associates. HIPAA is divided into five titles, each designed to improve health insurance portability, standardize administrative processes, and enforce consistent protections for PHI across the healthcare industry. Before HIPAA, there were few universally accepted standards for securing health data, leaving patients vulnerable to misuse, loss, or unauthorized disclosure. The introduction of HIPAA policies and enforcement mechanisms marked a turning point for healthcare compliance. Patients gained greater confidence that their personal health information would remain private, while healthcare organizations were held to clear accountability standards. However, HIPAA compliance is still not prioritized by every organization. Some healthcare entities cut corners in an effort to reduce costs, placing sensitive PHI at risk. These lapses often result in data breaches, regulatory investigations, and the consequences of HIPAA violations.

    The consequences of HIPAA violations can be costly. In 2016 alone, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) collected a record-breaking $23 million in HIPAA fines, far exceeding the previous record of $7.4 million set in 2014.

    To avoid the consequences of HIPAA violations, including financial, legal, and reputational damage, organizations must understand which types of violations most commonly lead to enforcement actions. Learning from past compliance failures can help healthcare organizations strengthen their HIPAA programs and reduce their risk of costly penalties. (more…)

  • Overview of CMMC Level 2 Requirements

    Overview of CMMC Level 2 Requirements

    CMMC Level 2 requirements are part of the U.S. Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) framework and apply to contractors that handle Controlled Unclassified Information (CUI). This guide provides a clear, practical overview of what CMMC Level 2 requires, who it applies to, and how organizations can prepare for compliance.

    As the second installment in our CMMC series, this article focuses specifically on Level 2 requirements. If you’re looking for information on other maturity levels, explore our detailed guides on CMMC Levels 1, 3, 4, and 5. (more…)

  • What Does Protected Health Information Include?

    What Does Protected Health Information Include?

    The Health Insurance Portability and Accountability Act of 1996 (HIPAA) designates forms of patient-related records that need to be protected. These records are “protected health information” (PHI). Guarding these documents is critical to the safety of patients and providers alike. Read on for several examples of protected health information, the US Department of Health and Human Services’ (HHS) strict regulations surrounding them, and how to safeguard your company.


    What Does Protected Health Information Include?

    Given how critical safeguarding PHI is, all businesses in and adjacent to the healthcare industry need to understand its importance, why it’s so essential, and how to protect it per HIPAA standards. This blog will break down:

    • Everything protected health information includes and its basic definition
    • How to protect physical and digital PHI per the HIPAA Privacy Rule
    • How the HIPAA Security Rule applies to electronic PHI (ePHI) specifically
    • How the Breach Notification Rule applies to all forms of PHI and ePHI

     

    Personal Health Information Examples and Definition

    The best way to understand what protected health information involves understanding what protected health information includes. The primary examples of PHI are all patients’ medical and payment documents that contain personally identifiable information, such as records of doctor visits, prescriptions, bills, and privileged communications with providers. This includes nearly all patient-related documents stored or processed by covered entities.

    HIPAA applies unilaterally to all businesses in the healthcare field and many other businesses adjacent to it. Covered entities comprise healthcare providers, health plans, and health clearinghouses. Furthermore, the business associates of these parties are also required to be compliant.

    [su_button url=”https://www.rsisecurity.com/request-demo/” target=”blank” style=”flat” size=”11″]Request a Free Consultation[/su_button]

    Identifiable Characteristics for Protected Health Information

    PHI is health information with personally identifiable information about a patient. If all 18 kinds of personally identifiable data are removed or redacted from a PHI document, it may no longer qualify as PHI under the “safe harbor” provision. The identifying categories include:

    • The names associated with a patient, including first, last, initials, and aliases
    • The location of a patient, including geographical identifiers smaller than a state
    • All essential dates associated with a patient (birth, etc.) other than the year of birth
    • All phone numbers associated with the patient, including home, cell, and work
    • All fax numbers associated with the patient, including home, cell, and work
    • All personal and professional email addresses related to the patient
    • The patient’s social security number and equivalent tax-relevant identifiers
    • The numbers and codes related to all of a patient’s medical records
    • The health insurance beneficiary details related to a patient’s plan
    • The account numbers tied to a patient’s medical and financial accounts
    • All certificate and license numbers related to the patient’s vehicles
    • All vehicle identifiers, such as license plate and vehicle serial numbers
    • All serial or identification numbers associated with a patient’s devices
    • Uniform Resource Locators (URLs) related to a patient’s web presence
    • Internet Protocol (IP) addresses or numbers related to a patient’s devices
    • All biometric identifiers of a patient, such as a finger, retinal, or voiceprints
    • The likeness of a patient, as captured in full-face photographic images
    • All other unique identifying numbers, characteristics, or codes of the patient

    The process of removing all these identifiers is called the de-identification of PHI. Companies can also achieve de-identification via expert determination that the document is not identifiable.


    The HIPAA Privacy Rule: Uses and Disclosures of PHI

    The Privacy Rule within the HIPAA framework applies to all PHI, both physical and digital, and delineates the specific use cases under which parties other than PHI subjects can access PHI. It also guarantees that PHI is accessible by its subjects or representatives, along with select other parties, such as law enforcement.

    Protections under the Privacy Rule may be considered a “whitelist” approach, wherein use cases are disallowed unless otherwise specified. To that effect, the rule’s “basic principles” include that a covered entity may not disclose or use PHI in any way except those defined as permitted or required or as formally requested in writing by the PHI’s subject or representative.


    Rules and Requirements for Privacy Rule Protection of PHI

    The HHS’s Privacy Rule Summary breaks down the following permitted use cases for PHI:

    • Use by, of, or for or disclosure to the individual subject or a designated representative.
    • Uses and disclosures are undertaken for treatment, payment, and healthcare operations.
    • Uses or disclosures for which the subject has been granted an opportunity to consent.
    • Incidental uses or disclosures related to other permitted or required uses or disclosures.
    • Uses or disclosures undertaken in the general public interest or for a public benefit project.
    • Use of a limited data set needed for approved research or public health care operations.

    All permitted uses and disclosures except select required cases, such as to the subject of law enforcement, must also be limited to the minimum necessary extent to avoid breach conditions.


    The HIPAA Privacy Rule: Safeguards for Electronic PHI

    The second prescriptive rule applicable to PHI in the HIPAA framework is the Security Rule. The Security Rule applies to electronic PHI (ePHI) only, unlike the Privacy Rule, which applies to PHI in all formats. The Security Rule resulted from the HITECH Act of 2009, which increased HIPAA’s oversight on electronically generated and processed PHI, along with increases to enforcement penalties.

    In particular, the Security Rule exists to ensure the confidentiality, integrity, and availability of ePHI. It also specifies risk analysis or assessment methods to identify and address credible threats to the Security and Privacy of ePHI and prevent them before they turn into total breaches. It does this by detailing specific safeguards all covered entities must implement.


    Rules and Requirements for the Security of Electronic PHI

    The HHS’s Security Rule Summary breaks down three kinds of safeguards for ePHI security:

    • Administrative safeguards – Controls to guide company-wide procedures:
        • Establishment of security management processes and resources
        • Allocation of security personnel and resources to enforce policy
        • Management of information access for all uses and disclosures
        • Training and assessment of behaviors across all security staff
        • Evaluation of IT and security measures consistent with HIPAA
    • Physical safeguards – Controls for the level of individual spaces and hardware:
        • Restriction of physical access to defined security perimeters
        • Restriction of physical access to individual workstations
    • Technical safeguards – Controls for devices, software, and network infrastructure:
      • Monitoring and restricting access to ePHI in transit or storage
      • Regular auditing and audit logging for privacy and security
      • Visibility and assurance of ePHI integrity (no undue changes)
      • Monitoring and restriction of communications involving ePHI

    These protections ultimately build on the Privacy Rule’s guidance to define parameters for PHI’s safekeeping. If any statute is broken, the PHI will be considered breached.


    Breach Notification for Compromises to PHI or ePHI

    Finally, the last HIPAA rule pertaining to PHI is not a prescription for its protection but a failsafe if compromised. The Breach Notification Rule applies to all PHI and ePHI; it requires covered entities to notify three distinct parties if any element of the Security or Privacy Rule is breached:

    • Individuals impacted by a breach of PHI or ePHI must be notified by the covered entities in writing as soon as possible and within 60 days of the breach’s discovery in all cases.
    • The secretary of the HHS must be notified as soon as possible (within 60 days) in cases impacting 500 or more individuals or within 30 days of year’s end if more are affected.
    • Local media outlets must be notified as soon as possible in cases impacting 500 or more individuals within a defined geographical location serviced by the specific media outlet.

    Failure to meet these requirements does more than compromise PHI. It can also result in civil money penalties or criminal charges, per the Enforcement Rule.


    Safeguard Protected Health Information Professionally

    To avoid non-compliance penalties and other potentially dangerous cybercrime threats, working with a qualified HIPAA compliance advisor can offer an optimal return on investment. There are countless examples of protected health information-related crimes and HIPAA violations that involve well-meaning companies with inadequate staffing or resources. If compliance is a concern for you, contact RSI Security today to see how easy it can be.

    Download Our HIPPA Checklist


  • The Five-Step Process to HITRUST Healthcare Auditing

    The Five-Step Process to HITRUST Healthcare Auditing

    The healthcare industry faces unique security and privacy challenges due to the constant exchange of sensitive patient data. Meeting compliance requirements for regulations like HIPAA, PCI DSS, and SOC 2 can be complex — especially while staying competitive in the marketplace. HITRUST healthcare auditing helps organizations simplify compliance by aligning security controls with multiple regulatory frameworks while strengthening data protection. Through HITRUST assessments, healthcare organizations can demonstrate their commitment to safeguarding protected health information (PHI) and maintaining a strong cybersecurity posture.
    (more…)

  • Q&A: The DoD’s Acquisition and Sustainment CISO Talks Compliance Best Practices

    Q&A: The DoD’s Acquisition and Sustainment CISO Talks Compliance Best Practices

    DoD contractors and vendors must constantly stay one step ahead in the ever-changing compliance landscape. The DoD, along with other U.S. federal agencies, regularly introduces new frameworks and requirements to protect sensitive government and military information.

    For vendors and contractors looking to work with the DoD or U.S. military, compliance isn’t optional,  it’s a critical business necessity. Navigating these requirements can be complex, but understanding them is key to maintaining eligibility and operational security.

    We recently spoke with Katherine Arrington, the DoD’s Chief Information Security Officer (CISO) for Acquisition and Sustainment (A&S), for insights on DoD contractor compliance. Katherine also serves as a former House Representative of South Carolina’s 94th Congressional District and previously held the position of DoD-wide CISO.

    In our conversation, she shared her perspective on new regulatory frameworks like the Cybersecurity Maturity Model Certification (CMMC) the evolving compliance landscape, and practical steps DoD contractors can take to prepare themselves.

    (more…)