Security Policy essay

RMF Tasks

Status (done/not done)

How the status are determined

External documents needed for task

RMF Step 1: Categorize Information Systems

1.1

Security Categorization

Not done

As highlighted in the risk assessment, there is no security plan done (p.18). Add the security categorization information to the security plan.

The security categorization that was completed in the risk assessment can be included in the security plan. The full categorization can be found on pp. 14-16. The categorization done in the risk analysis is based on FIPS 199.

FIPS 199 for conational security systems, CNSS 1253 for national security systems

1.2

Information System Description

Done

In P.9, the system boundary has been described as ste&shy&shyp 1in the risk assessment

No external document will be needed.

1.3

Information System Registration

Not done

As presented on page 19.24 of the findings, there is no information registration with copyright or patent office.

The management system certification needs to certify the system

IMS number and registry probate court for system developer

RMF Step 2: Select Security Controls

2.1

Common Control Identification

Done

In page 9, there is a risk assessment approach: the first step defines the system boundary

FIPS Publication, 200, 199 CNSS instructions 123 and special publication

2.2

Security Control Selection

Not done

There is no security control selection.

The management system certification needs to certify the selection

FIPS publications 199,

CNSS Instruction 1253

2.3

Monitoring Strategy

Not done

As presented in the findings, no control strategy has been submitted for effectiveness of security controls

NIST publication 800-30, 800-39 CNSS Instruction 1253

2.4

Security Plan Approval

Not Done

A system security plan has not been developed

Develop an SSP that addresses the training personnel, rules of the system, rules of the system and technical security. CNSS Instruction 1253

RMF Step 3: Implement Security Controls

3.1

Security Control Implementation

Done

Security control has been done. Additional security controls will be added to protect the integrity inherent in the application

Does not require documentation since it has already been done

3.2

Security Control Documentation

Done

Adequate security documentation has been considered by reviewing the relevant INFOSEC documents

Does not require documentation since it has already been done

RMF Step 4: Assess Security Controls

4.1

Assessment Preparation

Done

Risk assessment has been prepared by determining the relative value of SHGTS based on sensitivity and criticality of the data, determining risks and developing countermeasures

Does not require documentation since it has already been done

4.2

Security Control Assessment

Not done

Security control assessment has not been developed, approved and reviewed to provide the objectives of control assessment

NIST publication 800-53-A

4.3

Security Assessment Report

Done

The risk assessment report has been reviewed to identify vulnerabilities and threats applicable to SHGT, probability that vulnerability will be exploited and impacts

Does not require documentation since it has already been done

4.4

Remediation Action

Not done

The initial remediation actions based on security controls have not been done to provide the visibility into specific weaknesses during development of the system

NIST special publication 800-30 and 800-53A

RMF Step 5: Authorize Information System

5.1

Plan of Action and Milestones

Not done

The plan of milestones and action prepared for authorizing officials by the owner has not been done

OMB Memorandum 02-01, NIST 800-30, 800-53A

5.2

Security Authorization Package

Not done

Security authorization package has not been assembled

None

5.3

Risk Determination

Done

Risk determination has been done in risk assessment where SHGTS is measured regarding data and system critically

NIST 800-39, 800-30

5.4

Risk Acceptance

Not done

The explicit acceptance of risk is the responsibility of the authorized officials has not been done

NIST 800-39

RMF Step 6: Monitor Security Controls

6.1

Information System and

Environment Change

Done

Adequate documentation is considered as an integral aspect of the information systems and should be completed before the system is ready for use

NIST SP 500-169

6.2

Ongoing Security Control Assessments

Done

Technical control focuses on the safety control that will be executed by the computer. Additional security controls will be added to protect the integrity of the application and public confidence (Davis, CISSP, &amp Analyst)

Does not require documentation since it has already been done

6.3

Ongoing Remediation Action

Done

Periodic evaluation and testing of security controls are needed

Based on FISMA provisions

6.4

Key Updates

Done

The executives allow report and capacity to update the key fields dealing with grants assignment. It has included the real time risk management with use and operation of information system

NIST 800-53A

6.5

Security Status Reporting

Done

A weekly status report is prepared for the offices. The grant assignor is briefed on document with reports in the database

Does not require documentation since it has already been done