Service Offerings
Risk and Vulnerability Assessments (RVA)
Identifying and understanding the risks and vulnerabilities facing your organization is critical to all public sector organizations. Our Risk and Vulnerability Assessment (RVA) process is based on appraising the various technical, operational and business threats and vulnerabilities of a system, and providing remediation recommendations for each of the findings.
Gray Tier’s methodology is built through the DHS RVA program, having supported DHS for the past six years and helping DHS develop and mature this program as one of their key contractors. While our DHS support is based on National Institute of Standards and Technology (NIST) standards, incorporating the Cybersecurity Framework and NIST 800-53 controls, we are flexible to apply other frameworks, such as the International Organization for Standardization (ISO) 27002, HIPAA, or other specific frameworks relevant to your situation.
Our RVAs are customizable to your needs and can include vulnerability assessments, penetration testing, web application penetration testing, controls assessments, wireless assessments, STIG assessments, phishing assessments, social engineering assessments, and others as needed to provide a comprehensive look at the risks and vulnerabilities that exist in your enterprise and business processes.
RMF, A&A, & FISMA
Gray Tier's past performance in the validation and assessment of systems and enclaves worldwide, both classified and unclassified, in accordance with the NIST Risk Management Framework (RMF) and the Federal Information Security Management Act (FISMA).
Gray Tier provides top tier security engineering solutions to ensure compliance with RMF and FISMA in accordance with NIST 800-53 controls and to achieve a full Authorization to Operate (ATO). Our team performs over 150 such engagements each year to ensure the security and compliance of federal and defense information technology, weapons, ashore/afloat, and industrial control systems.
Penetration Testing
Our penetration testing service provides an assessment of the target system in its ability to resist an attacker. Starting with a vulnerability scan, we attempt to break into the targeted systems without any additional knowledge regarding the systems being assessed.
Our team will replicate attacker tactics according to the NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments, based on our assessment of likely attack vectors or previously observed attacks. We will make every attempt to compromise systems that are vulnerable and then use tactics to move laterally to other systems and escalate privileges in order to access more systems. During this phase, we will also search hosts for critical information (PII, PCI, user credentials, certificates, etc.) to demonstrate the potential loss impact from an attacker.
We will finish the assessment by preparing a report that details our specific methodology for successful attacks and provide recommendations for remediating all vulnerabilities discovered. We can also conduct a Red Team Assessment where our testers operate in stealth to test the defense’s ability to detect and stop an attacker.
Cybersecurity Exercises
Conducting cyber security exercises is invaluable for an organization to evaluate its current security program. Gray Tier uses risk-based and scenario-based approaches that can be tailored to any public sector organization to help identify strengths and weaknesses in your organization’s incident response program and its ability to detect and respond to cyber threats.
From executing single event exercises to building comprehensive exercise programs, Gray Tier will guide your organization to develop a strong demonstrated capability in cyber incident response by simulating real-world events that your organization must respond to.
At the conclusion of the exercise, the team will provide actionable remediation that will improve your organization’s program, helping to detect and respond to incidents faster. The actions taken to solidify program gaps and close capability weaknesses will give your employees a much more effective process by which they can respond to future incidents.
Governance, Strategy, Policy
Our cyber security professionals possess a wealth of knowledge on the cyber domain specifically relating to the executive-level planning and strategy experience needed for today’s public sector organizations at every level.
Whether you are a local government or a federal agency, our senior cadre has the strategic experience to help guide your organization from supporting a new NIST-based governance structure to providing cyber expertise for the Department of Defense (DoD) Cybersecurity Strategy. Our team brings unmatched experience to the table and can access throughout Gray Tier allows us to provide current and responsible guidance to meet your organization’s needs.
Incident Response & Planning
Security incidents and data breaches can be extremely costly for an organization on many levels. Every public sector agency, no matter the size, must be prepared for any incident, intentional or accidental.
The better you as an organization can plan for a potential incident, the more prepared you are to respond appropriately. Using the NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, Gray Tier’s incident response team can assist with incident response planning services that supplement any organization’s existing incident management plans and capabilities.
No matter your organization’s needs, our experienced team will help your organization be prepared to respond to any security incident.
How to Order
GSA IT 70 holder with 5 Cyber HACS SINS
Federal, state, and local governments can rapidly buy services from Gray Tier by using the following Highly Adaptive Cybersecurity Services (HACS) Special Item Numbers (SIN) on GSA’s IT Schedule 70:
SIN 132 45 A: Penetration Testing
SIN 132 45B: Incident Response Services
SIN 132 45C: Cyber Hunt
SIN 132 45D: Risk & Vulnerability Assessments
Gray Tier also has two additional GSA SINS:
SIN #132-50: Training Services
SIN #132-51: Professional Services
To learn more about how to order go to www.gsa.gov/portal/content/198589
Protecting Government Data with Comprehensive Cyber Defenses
Military & Federal Breach Response Services
If your organization suffers a breach, or you suspect one has already occurred, Gray Tier offers a variety of services to help you respond, including:
- Hunting for current or undiscovered threats affecting your network,
- Coaching your organization through difficult decisions after a breach, and
- Providing a response team with a host of capabilities to deal with an active threat.
