Gap analysis

Northfield Precision Works

SPRS score at intake

-128

of a possible 110

32 of 110 requirements were met. The remaining 78 carry 238 points, which is what separates this environment from 110.

Where the points are

14 families

Ordered by points at risk rather than by family code, because that is the order the work gets done in.

5 of 78

Each of these is a 5-point requirement under the DoD Assessment Methodology. Closing these five returns more score than closing thirty 1-point items.

IA3.5.3 · 5 points
Multifactor authentication is not enforced
Microsoft 365 has MFA for email. The shop-floor file server, the VPN, and every local administrator account do not, and those are the paths into the environment holding CUI.
Remediation. Enforce MFA on the VPN and all privileged accounts before extending it to general users.
CM3.4.1 · 5 points
No documented baseline configuration
Workstations are imaged from a template last updated in 2023 and modified by hand since. There is no record of what a correct machine looks like, so no deviation can be detected.
Remediation. Establish and document baselines for each system type, then bring the estate to them.
AU3.3.1 · 5 points
Audit records are not created or retained
The domain controller keeps default log sizes and rolls over in under two days. There is nothing to reconstruct an event from.
Remediation. Centralise logging with retention that meets the requirement, then define what gets reviewed.
IR3.6.1 · 5 points
No operational incident-handling capability
There is no plan, no named responder, and no reporting path. The DFARS 72-hour clock has no owner.
Remediation. Stand up the plan, name the roles, then exercise it so testing can be evidenced.
CA3.12.1 · 5 points
Controls have never been assessed
No periodic assessment has been performed, so nothing establishes whether the controls that do exist are effective.
Remediation. Assess on a defined interval and record the result — this is also what feeds the POA&M.