01 / Network · Field guide
Four weeks, start to finish.
The four weeks start the day our read-only access works. How the Fix-and-Prove Sprint runs, for the business owner, the IT lead or MSP, and anyone who has to sign off on a change window.
01 / Week 1: agree the scope, then score it
In the first call we agree four things:
- Which devices. One boundary firewall (an HA pair counts as one), up to 12 switches, and up to 10 servers. Firewalls: Cisco ASA, Cisco FTD, or Palo Alto PAN-OS. Switches: Cisco IOS or IOS-XE. Anything else is out, in writing, or quoted as a change before we start.
- What we check against. The NIST SP 800-171 requirements in scope, and the DISA STIG or CIS benchmark for each device, by version.
- How we get in. Read-only access your IT lead sets up and can switch off.
- Where the evidence lives. In your storage, not ours.
Then we run read-only checks. Nothing changes. You get every finding, what it costs you in SPRS points, and your starting score.
Don't send configs or diagrams through the website form. We'll set up a proper way to share them.
02 / Who does what
- You, the business owner
- Decide what's in scope and who can approve changes. Sign off on the handoff.
- Your IT lead or MSP
- Gives us access, tells us which services can't go down, and runs your change process. If you have an MSP, they stay your MSP. We work alongside them.
- Us
- Run the checks, write up the findings, plan and make the approved fixes, and hand over the evidence.
03 / Weeks 2 and 3: the change window
We fix the firewall and switch findings in one planned window in week 3. In week 2 we agree with your change approver:
- What's changing, and what might blink while it does.
- When the window is, and the latest time we'll stop and roll back.
- How we roll back, and that we've tested it.
- How your team will check its own services afterward.
If any of these is unclear, we don't start. If something breaks that we didn't expect, we roll back first and talk second.
04 / What a finding looks like
Made-up example · Not a real client
Two switches still accept Telnet
- What we saw
- Two of six access switches allow Telnet on their management lines. Telnet sends the admin password in clear text.
- What it breaks
- NIST SP 800-171 3.4.7 (disable nonessential protocols, 5 points) and 3.5.10 (send passwords only in encrypted form, 5 points). The real report names the STIG rule ID too.
- The fix
- Allow SSH only on the management lines. Made in the week-3 window, with the old config saved and the rollback tested first.
- The proof
- A Telnet attempt to each switch fails, an SSH login works, and the before and after configs are filed next to the finding.
Not every finding is a clean pass or fail. Some checks need evidence a config can't show, like whether logs actually reach your log server. We mark those "not verified" and say what would settle them, instead of guessing.
05 / Week 4: the handoff
- Your SPRS score before and after, calculated with the DoD Assessment Methodology. Requirements we don't test count as you currently report them.
- STIG or CIS checklists for every device in scope.
- An evidence exhibit for each requirement we covered, filed the way an assessor reads it.
- The change record: what changed, when, and the checks that proved it worked.
- What's still open, and who owns it. Policy, physical, and personnel requirements go to a policy partner.
- Our access removed.
We walk through it with you, and you sign off when it matches what we agreed.
06 / The worksheet
A one-page checklist of everything above: scope, people, access, the change window, and the handoff. Fill it in with your IT lead before the first call, or with us during it. Keep it in your own files.
The fine print
This guide explains how we work. Your statement of work sets the actual scope, price, and terms. The score covers the requirements the Sprint checks; anything outside it, like your policies, is scored as you currently report it. We don't write policies, and we don't certify you. Only an authorized C3PAO certifies.
Further reading: NIST SP 800-128 on controlled changes and back-out plans, and NIST SP 800-171A on how requirements are assessed.