Tera Insights as a Service Provider
An external service provider (ESP) is an outside party that delivers IT or cybersecurity services to your organization and whose systems hold your CUI or your security protection data. Tera Insights supplies tiCrypt as software that your organization installs, operates, and administers. Tera Insights has no access to your deployment, so it is not an ESP in your assessment unless you choose to give it data or a role that makes it one.
Why assessors ask about the vendor
The CMMC Level 2 scoping guidance gives the test: "To be considered an ESP, data (specifically CUI or Security Protection Data, e.g., log data, configuration data) must reside on the ESP assets." The rest of this page applies that test to Tera Insights.
What Tera Insights can reach
The following table describes Tera Insights' relationship to each part of a deployment.
| Part of the deployment | What Tera Insights can reach |
|---|---|
| Backend, VM hosts, storage, and audit server | Nothing. Tera Insights staff have no access to your deployment. |
| Research data | Nothing. File and drive content is encrypted with keys that only your users hold. |
| Audit logs and configuration | Nothing, unless your staff choose to send an excerpt with a support request. |
| Software and updates | Tera Insights publishes signed packages. Your administrators download and install them. |
How support works without access
Support is given as guidance. When a problem needs Tera Insights staff to look at the running system, the session follows the rule in the System Security Plan: vendor maintenance access requires pre-approval, and your personnel are present through screen sharing for the whole session. Your administrator operates the system. Tera Insights staff see only what your administrator shows them, and no credential changes hands.
When Tera Insights would become an ESP
Two choices by your organization would change the answer.
- Sending data to support: Logs and configuration files are security protection data. If you send them to Tera Insights, they reside on Tera Insights' systems, which is the condition in the scoping guidance. Keep CUI out of support requests, redact what you send, and record in your SSP whether sending logs or configuration is permitted.
- Engaging Tera Insights to administer the deployment: A provider that manages your system on your behalf is an ESP. Under FAQ question E-Q4 it is assessed as part of your scope against the applicable requirements and does not need a CMMC certification of its own.
What Tera Insights supplies to your assessment
The scoping guidance asks that an ESP's services be described in "the ESP's service description and customer responsibility matrix". Tera Insights publishes the equivalent material for the software, whether or not it is an ESP for you.
- CMMC Level 2 control guide: the responsibility matrix. Each of the 110 practices is marked as implemented by tiCrypt, shared, or yours, with the action your organization still takes. The page downloads as a workbook.
- NIST SP 800-171 Rev 3 control guide: the same matrix against Revision 3.
- System Security Plan: implementation statements for each control, written to be adapted.
- Cryptographic Modules: the validated module and certificate behind each cryptographic operation.
- Scoping Guide: the asset category of each component, with a network diagram.
- Assessment Evidence: the artifact to show for each practice.
What to write in your SSP
Adapt the following statement to your deployment. Replace the bracketed text. If you send data to support or use Tera Insights for administration, revise every sentence that this makes untrue: who operates and can reach the deployment, what data Tera Insights receives, how support is given, and the closing sentence on external service provider status.
tiCrypt is software licensed from Tera Insights and installed, operated, and administered by [organization] on infrastructure that [organization] controls. Tera Insights has no access to the deployment and receives no CUI and no security protection data. Software updates are delivered as signed packages and installed by [organization] administrators. Vendor support is given as guidance. A session in which Tera Insights staff view the system requires prior approval and takes place by screen sharing operated by [organization] personnel for its whole duration. Tera Insights is therefore not an external service provider for this system.