Attachment_A_(FIPS_200_and_NIST_SP_800-53).pdf

Federal Information Technology Standards Guide

Security Controls

Federal information systems must meet the minimum security requirements. These requirements are defined in Federal Information Processing Standards Publication (FIPS) 200. Organizations must meet the minimum security requirements by selecting the appropriate security controls and assurance requirements as described in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53. The process of selecting the appropriate security controls and assurance requirements for organizational information systems to achieve adequate security is a multifaceted, risk-based activity involving management and operational personnel within the organization. Agencies have flexibility in applying the baseline security controls in accordance with the tailoring guidance provided in SP 800-53. This allows agencies to adjust the security controls to more closely fit their mission requirements and operational environments. The controls selected or planned must be documented in the System Security Plan (SSP), further explained below.

Risk Assessment

The combination of FIPS 200 and NIST SP 800-53 requires a foundational level of security for all federal information and information systems. The agency's risk assessment validates the security control set and determines if any additional controls are needed to protect agency operations, assets, individuals, other organizations, or the Nation. The resulting set of security controls establishes a baseline for the federal agency and its contractors. A risk assessment essentially identifies potential threats and vulnerabilities and calculates the likelihood and impact to determine the overall risk to the agency. A determination is then made to either accept the given risk or mitigate the possibility of exploitation.

System Security Plan Agencies should develop policy on the system security planning process.

NIST SP 800-18 introduces the concept of a SSP, which are living documents requiring periodic review, modification, and plans of action and milestones for implementing security controls.

Procedures should be in place outlining who reviews the plans, keeps the plan current, and follows up on planned security controls.

The SSP is the major input to the security Certification and Accreditation (C&A) process for the system. During the C&A process, the SSP is analyzed, updated, and accepted. A certification agent confirms that the security controls described in the SSP are consistent with the FIPS 199 security category determined for the information system, and that the threat and vulnerability identification and initial risk determination are identified and documented in the system security plan, risk assessment, or equivalent document.

Certification and Accreditation

Once the system documentation and risk assessment has been completed, the system's controls must be reviewed and certified to be functioning appropriately. Based on the results of the review, the information system is accredited. The C&A process is defined in NIST SP 800-37.

Security accreditation is the official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to agency operations, assets, or individuals based on the implementation of an agreed-upon set of security controls. Required by OMB Circular A-130, Appendix III, security accreditation provides a form of quality control and challenges managers and technical staffs at all levels to implement the most effective security controls possible in an information system, given mission requirements, technical and operational constraints, and cost/schedule constraints. By accrediting an information system, an agency official accepts responsibility for the security of the system and is fully accountable for any adverse impacts to the agency if a breach of security occurs.

Continuous Monitoring

All accredited systems are required to monitor a selected set of security controls and the system documentation is updated to reflect changes and modifications to the system. Large changes to the security profile of the system should trigger an updated risk assessment, and controls that are significantly modified may need to be re-certified.

Continuous monitoring activities include configuration management, control of information system components, security impact analyses of changes to the system, ongoing assessment of security controls, audit reviews, and status reporting. The agency establishes the selection criteria and subsequently selects a subset of the security controls employed within the information system for assessment. The agency also establishes the schedule for control monitoring to ensure adequate coverage is achieved.