Solution Brief

Business Challenges• Protect Controlled Unclassified
Information• Avoid data breaches that result inloss of public trust, and which canlead to losing contracts and grants• Improve overall network security• Demonstrate and maintain DFARS
compliance• Ensure subcontractor compliancewith DFARSTechnical Challenges• Keep targeted attacks fromstealing CUI data or forcing
network downtime• Discover connected devices andidentify their level of compliance• Prevent infected or non-compliant
devices from spreading malware• Measure effectiveness of security
controls and demonstratecompliance with NIST 800-171• Orchestrate unified, automateddevice remediation and threatresponse capabilities

ForeScout Can Help You
Accelerate and Maintain NIST
800-171 Compliance
We secure federal assets today. We can help
you keep your contracts and grants by helping
you to accelerate and maintain NIST 800-171
compliance!
Supply-chain vulnerabilities can result inbreaches in national security. Several U.S.
government contractors have experienced apublicly disclosable data breach in the past twoyears.1 Contractors must implement NIST 800171 and report deficiencies within 30 days ofcontract award. ForeScout provides support for
approximately 87 percent of the technical NIST
800-171 controls,2 simplifying compliance anddisclosing gaps.
The Challenge
The Department of Defense (DoD) requires all contractors that process, store
or transmit Controlled Unclassified Information (CUI) to have met the Defense
Federal Acquisition Regulation Supplement (DFARS) minimum security standards
by December 31, 2017 or risk losing their DoD contracts.3
NIST 800-171 provides a framework for all companies that conduct business with
the DoD to protect CUI. Whether you represent a prime contractor, subcontractor,
research university, chemicals/pharma manufacturer—or you have other businessinterests with the DoD—you are required to implement the controls and comply
with 800-171 to continue to do business with the DoD.
The ForeScout platform helps with 800-171 preparedness by automating andaccelerating your path to compliance, reducing overall risk and maintaining anddemonstrating ongoing compliance.

Ask Yourself:• Is your staff equipped to interpret and apply all 110 controls of 800-171?
• Can you afford the time to devote potentially billable resources to creating andenforcing policies, as well as monitoring compliance to this framework?
• If you’re manually monitoring compliance today, can you effectively demonstrate
immediate responsiveness to a breach so as to report it within 72 hours?
• Have you identified every device that is responsible for using/transferring/handling CUI data?
1

Solution Brief

How ForeScout helped a defense contractor satisfy DFARS
requirements:
Critical DFARS 252.204.7012
Requirements for Contractors:3• Adequate security (7012-b):
Provide adequate security on all
covered contractor informationsystems.
• Subject to NIST 800-171 (7012b(2)(i)): Be subject to the security
requirements in National Instituteof Standards and Technology(NIST) Special Publication (SP)
800-171, “Protecting Controlled
Unclassified Information in
Nonfederal Information Systemsand Organizations”• Be compliant as of December 31,
2017 and notify DoD CIO within
30 days of contract award if notcompliant ((7012-b(2)(ii)(A))• Have a System Security Plan(SSP) and other measures fornon-standard devices. Applyother measures especially for
non-standard devices (7012b(3)): Apply other information
systems security measureswhen the Contractor reasonably
determines that information
systems security measures, inaddition to those identified inparagraphs (b)(1) and (2) of thisclause, may be required to provide
adequate security in a dynamic
environment or to accommodate
special circumstances (for example,medical devices) and any individual,
isolated, or temporary deficiencies
based on an assessed risk orvulnerability.
• Rapidly report all cybersecurity
breaches within 72 hours: ((7012-c(1)(ii))

Before ForeScout
A defense contractor that works directly with the U.S. DoD had a challenge withDFARS NIST 800-171 compliance, specifically, gaining real-time visibility into
devices connected to the network and the ability to identify and take action
on rogue devices. ForeScout conducted a trial that found a high percentage ofmachines that were not managed, out of compliance, had broken agents or werenot accessible. The analysis showed the company that they were dealing with anacute level of risk. Reports revealed that 64 percent of their Windows machines
had critical patches missing and 62 percent had no antivirus running.

How ForeScout helped
ForeScout installed rapidly on a production network and immediately started
collecting data. The company’s SecOps personnel quickly observed when
new devices joined the network, and created policies to quarantine or block
unauthorized devices. The company was able to choose not to use 802.1X andprovide support for a heterogeneous infrastructure without adding additional
agents to an already “agent-heavy” environment.

Why ForeScout for 800-171 compliance?
By providing visibility into devices connected to the network, ForeScout offers
direct component support for over 50 of the 109 NIST 800-171 controls as well as
supplemental support across over 90 controls. The ForeScout platform agentlessly
detects devices as they connect to the network, automates simple and repeatable
tasks, and infuses those elements into existing IT security and management
services. As a result, it can illuminate blind spots and improve process workflow
automation. The following table shows key use cases for protecting CUI data incontractor networks.
Use Case

NIST 800-171 Control4

How ForeScout Helps

Configuration Management

NIST 800-171 3.4.1:

Recent research by BitSight
showed that nearly one
in five Technology andAerospace/Defense
contractors use an outdated
Internet browser in theworkplace, increasing
exposure to compromise.1Establish and maintainbaseline configurations andinventories of organizational
information systems(including hardware,software, firmware anddocumentation) throughout
the respective systemdevelopment life cycles.

You can leverage theForeScout platform tohelp enhance and ensure
your CMDB is up to datein real time with the latest
versions of software foundon the devices. You canmanage other data pointsof your devices for otherrequirements. The benefit ofthis integration is that theCMDB is a real-time rather
than point-in-time database.

• Require all of the above fromsubcontractors (7012-m(1): Include
this clause…in subcontracts, orsimilar contractual instruments, for
operationally critical support, or forwhich subcontract performance
will involve covered defense
information.

2

Solution Brief

Remote Access

NIST 800-171 3.1.12:

Many prime contractors
allow remote access totheir networks to the subcontractors with whom theywork.

Monitor and control remote
access sessions.

Incident Response

DFARS ((7012-c (1)(ii))

Campus Security Operations
Centers must not only
provide safeguards that
ensure inappropriate accessto campus networks canbe swiftly identified butmust remediate and reportbreaches within 72 hours.

NIST 800-171 3.6.1 and 3.6.2:
Establish an operational
incident-handling capability
for organizational systems
that includes adequate
preparation, detection,analysis, containment,recovery, and user response
activities, and provides
mapping to the relevant
security controls that
address incident handling,monitoring and reportingtechniques.

Use ForeScout to monitor
and control remote access,including VPN, WLC andMDM integrations. The
ForeScout platform helps
organizations ensure
connections are appropriate
and configured for compliantcommunications. ForeScout
can take remediation action
to address connection issues,
including sending pop-up
messages to users, alerting
operations, or quarantining
the device, to name a few.
This helps ensure remoteconnections are compliant
and secure at all times.
You can automate
responses to breaches andnotify personnel acrossmultiple teams throughthe ForeScout platform’s
ability to detect changes
on devices and anomalous
behavior in real time. Thisdata is provided to your
SIEM or integrated with yourapplications.

ForeScout helps government agencies at the federal, state and municipal
levels meet their numerous access control and continuous device compliancerequirements with an agentless, easy-to-deploy and scalable solution. The productprovides these groups with continuous visibility and compliance. Government
agencies use the ForeScout platform today to protect their critical network
infrastructure and sensitive data, improve their risk posture, measure compliancewith security policies and improve operational efficiency.
The ForeScout platform helps to protect many of the network infrastructuresof the DoD as well as those of its military contractors and suppliers. ForeScoutCounterACT® is NIAP Common Criteria – Protection Profile Compliant. It is includedin the DoD’s Defense Information Systems Agency (DISA) Unified Capabilities
Approved Products List (UC APL) of those that have completed Interoperability(IO) and Information Assurance (IA) certification, demonstrating that it meetsthe government’s high standards for security, ease of use and deployment, low
end-user impact and interoperability with existing remediation solutions andinfrastructure-agnostic requirements.

3

Solution Brief

See The ForeScout platform offers the unique ability to see devices theinstant they connect to your networks without requiring software agentsor prior knowledge of the device. It sees devices other products simply
can’t, such as smartphones, tablets, laptops and other agency-owned andpersonal mobile devices as well as Internet of Things (IoT) devices, andeven detects stealthy sniffer devices that do not utilize an IP address.

Control Unlike systems that tag violations and send alerts to IT andsecurity staff, the ForeScout platform actually enforces network access
control, endpoint compliance, mobile device security and threat control in
one automated system. As a result, citizens, contractors and government
employees can access networks without compromising security. In
addition, this visibility and control platform continuously monitors devices
on your network and improves the effectiveness of your security policies
so you can demonstrate compliance with regulations.

Orchestrate The ForeScout platform integrates with more than 70
network, security, mobility and IT management products.* This ability toorchestrate information sharing and operation among myriad security tools
allows you to:• Share contextual insights with IT, security and management systems• Automate common workflows, IT tasks and security processes
across systems• Accelerate system-wide threat response to quickly mitigate risks anddata breaches

Network access control to protect CUI data
ForeScout offers comprehensive NAC capabilities and more based on real-time
visibility of devices the instant they access the network. Our platform continuously
scans the network and monitors the activity of known, company-owned devices
as well as unknown devices such as personally owned and rogue endpoints. And
it lets you automate and enforce policy-based network access control, endpointcompliance and mobile device security. In fact, the ForeScout platform provides anextensive range of automated controls that preserve the user experience and keepbusiness operations running to the maximum extent possible.

Continuous firewall and device monitoring
ForeScout Extended Modules for Next-Generation Firewalls (NGFWs) enable ITteams to orchestrate dynamic network segmentation and create context-aware
security policies within next-generation firewalls based on continuous device
monitoring and extensive endpoint insight from the ForeScout platform. Combined
solutions from ForeScout and Palo Alto Networks® or Check Point® Softwareare designed to detect advanced persistent threats (APTs) and indicators ofcompromise (IOCs). The Extended Modules feed user ID information into theNGFWs as well as exact classifications of actual devices for automated policy
enforcement and threat response.

4Solution Brief

Automated compliance and assessments
ForeScout’s Advanced Compliance Module automates on-connect and continuous
device configuration assessment to comply with security benchmarks. It lets you
leverage standards-based security benchmarks and content published in the SCAP
format to:
1. Improve device hygiene for greater device security.
2. Verify system configuration settings and increase compliance against 800-171,
DFARS and many other regulatory requirements.
3. Reduce usage of outdated application versions.
4. Gather and aggregate assessment results for audit preparation.
5. Streamline existing processes and automate compliance and remediation
workflows.

Learn More
Government Solutions Brief
Campus Compliance Solution Brief
Continuous Compliance White Paper

ForeScout Technologies is transforming security through visibility, providing Global
2000 enterprises and government agencies with agentless visibility and controlof traditional endpoints, IoT devices and operational technologies the instantthey connect to the network. Our technology continuously assesses, remediates
and monitors devices and works with disparate security tools to help accelerate
incident response, break down silos, automate workflows and optimize existing
investments. As of December 31, 2017 more than 2,700 customers in over 80
countries improve their network security and compliance posture with ForeScoutsolutions. See devices. Control them. Orchestrate system-wide threat response.

ForeScout Technologies, Inc.
190 West Tasman Drive
San Jose, CA 95134, USAToll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support 1-708-237-6591*As of December 31, 20171
Beyond Uncle Sam/Analyzing the Security Posture of U.S. Government Contractors and Subcontractors
https://cdn2.hubspot.net/hubfs/277648/Insights/BitSight_Insights_Analyzing_Security_Federal_Contractors.pdf?t=1518627701354&utm_
campaign=Q117%20BitSight%20Insights&utm_source=hs_automation&utm_medium=email&utm_content=60575255&_hsenc=p2ANqtz_0z9olHk3qpgNnQhxOINyQPmlLIiMjQTPr6Ks3LCU-fr6ydfnLGhVyB-ryJQIZuqazl9cvjhhhS1wl6_Qo9VomXiw2mA&_hsmi=60575255
2
ForeScout addresses these controls fully or partially depending on architecture, applications and dependencies. For a complete list ofcontrols supported by ForeScout, please contact your account team.
3
Text of DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting: https://www.acq.osd.mil/dpap/
dars/dfars/html/current/252204.htm#252.204-7012
4
Text of NIST 800-171 rev 1: https://csrc.nist.gov/publications/detail/sp/800-171/rev-1/final
5
As of March 31, 2018

© 2018 ForeScout Technologies, Inc. All rights reserved. ForeScout Technologies, Inc. is a Delaware corporation. A
list of our trademarks and patents can be found at https://www.forescout.com/company/legal/intellectual-propertypatents-trademarks. Other brands, products, or service names may be trademarks or service marks of theirrespective owners. Version 12_185