Attachment_1_FederalPolicies_and_FTC_Policies.pdf

ATTACHMENT #1: APPLICABLE FEDERAL POLICIES AND PROCEDURES

All Federal references listed below can be found online.

• Federal Information Security Modernization Act (FISMA) of 2014 (44 U.S.C. 3541, et seq., Public Law (P.L.) 113-283).

• OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Controls

• OMB Circular A-130, Managing Information as a Strategic Resource

• OMB Memorandum M-19-02, Fiscal Year 2018-2019 Reporting Instructions for the

Federal Information Security Management Act (FISMA) and Agency Privacy Management

• OMB Memorandum M-16-04, Cybersecurity Strategy and Implementation Plan (CSIP)

• FIPS 199, Standards for Security Categorization of Federal Information and Information

Systems

• FIPS 200, Minimum Security Requirements for Federal Information and Information

Systems

• FIPS 201-2, Personal Identity Verification of Federal Employees and Contractors

• NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems

• NIST SP 800-30, Guide for Conducting Risk Assessments

• NIST SP 800-34, Contingency Planning Guide for Information Technology Systems

• NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal

Information Systems

• NIST SP 800-39, Managing Information Security Risk

• NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and

Organizations

• NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information

Systems and Organizations

• NIST SP 800-55, Performance Measurement Guide for Information Security

• NIST SP 800-60 (Volume I), Guide for Mapping Types of Information and Information

Systems to Security Categories

• NIST SP 800-60 (Volume II), Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

• NIST SP 800-122 – Guide to Protecting the Confidentiality of Personally Identifiable

Information (PII)

• NIST SP 800-137, Information Security Continuous Monitoring for Federal Information

Systems and Organizations

• NIST SP 800-145, The NIST Definition of Cloud Computing

• NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal

Information Systems and Organizations

• NIST Supplemental Guidance, Ongoing Authorization

ATTACHMENT #1 (Continued): APPLICABLE FTC POLICIES AND PROCEDURES

The following table lists the applicable FTC Policies and Procedures. The text of each policy and procedure is available upon request.

Procedure for Assessing Risk for External Systems OCIO-18-RA-001P

Information System Inventory Management Procedures OCIO-18-PM-001P

Security Assessment Procedures OCIO-18-CA-001P

IT Hardware Asset Management Policy Handbook OCIO-11-400-01

Plan Of Action and Milestones (POA&M) Procedure OCIO-18-PM-002P

FISMA - Mandated IT Controls Policy Regarding Foreign National Visitors

OCIO-11-AC-003

Enterprise Architecture Integration with Capital Planning and Systems Development Policy OCIO 12-SA-001

Incident Response Plan OCIO-18-IR-001P

Security Awareness and Training Procedures OCIO-14-AT-100P

Meeting Management Procedure OCIO-18-OM-001P

System Authorization and Maintenance Procedure OCIO-18-RA-002P

IT Program Plan Procedure OCIO-18-PM-003P

Recommendation Management and Closure Procedure OCIO-18-OM-002P

Enterprise Vulnerability Management Procedures OCIO-18-RA-003P

Situation Threat and Benefit (STaB) Worksheet Information Technology Policy and Procedure Manual Information Systems Continuous Monitoring Strategy FTC System Authorization Process Guide Documentation Guide for Systems Operated by the FTC FTC Priority Security Controls Documentation Guide for Systems Used by the FTC

FISMA Policies

Access Control Policy OCIO-18-AC-001

Security Awareness and Training Policy OCIO-18-AT-001

Audit and Accountability Policy OCIO-18-AU-001

Assessment, Authorization, and Monitoring Policy OCIO-18-CA-001

Enterprise Configuration Management Policy OCIO-18-CM-001

Contingency Planning Policy OCIO-18-CP-001

Identification & Authentication Policy OCIO-18-IA-001

Incident Response Policy OCIO-18-IR-001

System Maintenance Policy OCIO-18-MA-001

Data and Media Protection Policy OCIO-18-MP-001

Physical and Environmental Protection Policy OCIO-12-PE-100

Information Security Planning Policy OCIO-18-PL-001

Personnel Security Policy OCIO-12-PS-100

System Risk Assessment Policy OCIO-18-RA-001

Acquisition of Information Systems and Services Security Policy OCIO-18-SA-001

System & Communications Protection Policy OCIO-18-SC-001

System and Information Integrity Policy OCIO-18-SI-001

Program Management OCIO-12-PM-100 https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-RA-001P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-PM-001P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-CA-001P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-11-400-01.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-PM-002P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/FISMA-Foreign%20Vistors%20Policy%20.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-12-SA-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-IR-001P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-14-AT-100P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-OM-001P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-RA-002P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-PM-003P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-OM-002P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-RA-003P.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/STaB_Worksheet.docx https://ftcintranet.ftc.gov/cfportal/ia/uploads/IT_Policy_and_Procedure_Manual.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/Information_Systems_Continuous_Monitoring_Strategy.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/System_Authorization_Process_Guide.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/Guide_For_Systems_FTC.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/FTC_Priority_Security_Controls.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/Guide_Systems_Systems_FTC.pdf https://ftcintranet.ftc.gov/cfportal/ia/page.cfm?page_id=8305 https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-AC-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-AT-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-AU-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-CA-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-CM-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-CP-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-IA-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-IR-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-MA-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-MP-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/Physical%20and%20Environmental%20Protection%20Policy%20Rev4%20RV.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-PL-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-12-PS-100.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-RA-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-SA-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-SC-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-18-SI-001.pdf https://ftcintranet.ftc.gov/cfportal/ia/uploads/OCIO-12-PM-1002.pdf