Attach 7-Task 5a -- 5.1.1 Grading Criteria (Fixed-Price Assessors).pdf

AMKJG-230-50668 Rev. 1.5 09/27/2022

Security Control Test Results Individual Control Grading Criteria

TPWS 5.1.1

Meets Standards Does Not Meet Standards* Contract Assessor Test Results for one control meets standards when the following is true:

• Original text describing:

• What the Assessor observed

• What artifacts were reviewed

• If an artifact referenced is longer than one page, the specific location of the relevant content must be listed.

• Relationship, if any, to any claimed Control Inheritance

• Text must be unique for each Determine If (Assessment Objective)

• Citations of artifacts supporting the Assessor’s determination regarding the control’s implementation status (Satisfied or Other Than Satisfied)

• Citations of any full/partial Inheritance from other accredited system environments

• If a Finding is merited, the shortfall against the control requirement must be annotated in writing. The associated Recommendation must address the control requirement shortfall, be system-specific and actionable.

Contract Assessor Test Results for one control does not meet standards if one or more of the following criteria applies to an assigned Control when that ‘final’ Control is evaluated by the Government during the Test Director Review phase:

• Test Results were copied (even with minor edits) from any prior Assessment

• Cited Control Inheritance, full/partial does not apply to the system being assessed

• Full/Partial Control Inheritance should have been cited, but was not, for the control being assessed

• Artifacts cited do not support the Assessor’s determination

• Text describing artifacts does not reference the specific location of the material supporting the Assessor’s determination regarding the control’s implementation status.

• A Technical Control only cites the System Security Plan (SSP) and/or Procedures as artifacts

• Artifacts cited do not to support a Satisfied determination for the control

• Rationale for how the Assessor arrived at his/her determination is not described in the Test Results text. The text should show the reader the logic used to arrive at the stated conclusion.

• A Finding issued against a control does not articulate the specifics of the shortfall in the context of the system being assessed

• A Recommendation issued to remediate a shortfall does not address the shortfall cited in the Finding in the context of the system being assessed

• The Control needed to be retested due to an assessment issue with any of the standards listed in this section

• A Finding needed to be added/removed on a Control due to an assessment issue with any of the standards listed this section

• The Test Results simply mirror the NIST control requirement text

Controls are graded at the Control level (i.e., all subordinate Determine If, Assessment Objective, results roll up to the Control level).

At the Government’s discretion, Controls not meeting standards may be grouped together (for grading purposes) if the identified shortfall is common across multiple Controls. This grouping will help improve the overall score for Control Testing Quality.

*Note: The Contract Task Lead will be included on all feedback to include the Test Director Review where the grade assignment is determined. Disputes in regard to Grading on Test Results must be documented in writing and submitted to the COR within five (5) business days of grade determination.

Contract test results are graded on a project-by-project, percentage basis. Projects may have more than one Contract Assessor assigned. However, project scores are measured based on total assessed controls and are not dependent upon the number of contract personnel assigned to a project. Additionally, if ANY test results were submitted late, without justifiable (as determined by the government) pre-coordination with the government, a 10% scoring penalty is imposed.

Example 1:

A single contract Assessor was assigned to assess 100 controls.

Control test results were submitted on time (i.e., no 10% deduction)

Controls Meeting Standards = 97

Controls Not Meeting Standards = 3

Score for this project = 97%

Example 2:

Two contract Assessors were assigned to assess a total of 200 controls.

Control test results were submitted late (i.e., 10% deduction)

Total controls Meeting Standards = 190

Total controls Not Meeting Standards = 10

Score for this project = 100 - 10%(late) - 5% (missed controls) = 85%

Monthly Grading for 5.1.1:

For each monthly reporting period, individual project percentage scores from all projects graded during the period are averaged together. Using the two (2) examples above, had those been the only two (2) projects during that reporting period, the overall grade for the 5.1.1 task would be 91%.