Attachment 01 - FISMA Reporting Metrics v1.1_0.pdf

FY 2023

– 2024 Inspector General

Federal Information Security Modernization Act of 2014 (FISMA) Reporting Metrics

February 10, 2023

FY 2023-2024 Inspector General FISMA Reporting Metrics

Document History Version Date Comments Sec/Page

1.0 1/6/2023 Initial draft sent to stakeholders for comment All

1.1 2/10/2023 Final version All

Contents

GENERAL INSTRUCTIONS

Overview

Background and Methodology

Key Changes to the FY 2023 – 2024 IG FISMA Metrics

FISMA Metric Ratings

Submission Deadline

FISMA Metrics Evaluation Guide

IDENTIFY FUNCTION AREA

Table 8: Risk Management

Table 9: Supply Chain Risk Management (SCRM)

PROTECT FUNCTION AREA

Table 10: Configuration Management

Table 11: Identity and Access Management

Table 12: Data Protection and Privacy

Table 13: Security Training

DETECT FUNCTION AREA

Table 14: Information Security Continuous Monitoring (ISCM)

RESPOND FUNCTION AREA

Table 15: Incident Response

RECOVER FUNCTION AREA

Table 16: Contingency Planning

GENERAL INSTRUCTIONS

Overview This document outlines the Office of Management and Budget’s (OMB) guidance for implementing the requirements outlined in OMB Memorandum M-23-03, Fiscal Year 2023 Guidance on Federal Information Security and Privacy Management Requirements. The guidance below and related metrics were developed in coordination amongst representatives from the OMB and the Council of the Inspectors General on Integrity and Efficiency (CIGIE), with review and feedback provided by several stakeholders, including the Federal CIO and CISO councils. As noted in OMB M-23-03, IGs are required to provide their responses to the FY 2023 FISMA metrics outlined in this document in the CyberScope reporting tool by July 31, 2023.

Background and Methodology The Federal Information Security Modernization Act of 2014 (FISMA) requires each agency inspector general (IG), or an independent external auditor, to conduct an annual independent evaluation to determine the effectiveness of the information security program and practices of its respective agency.

OMB, CIGIE, and other stakeholders worked collaboratively to develop the FY 2023-2024 IG FISMA Reporting Metrics. The FY 2023-2024 IG FISMA Reporting Metrics represent a continuation of the work started in FY 2022, when the IG metrics reporting process was transitioned to a multi-year cycle.

The Fiscal Year 2021-2022 Guidance on Federal Information Security and Privacy Management Requirements (M-22-05) encouraged agencies to shift towards a continuous assessment process for their annual independent assessment. To help facilitate this, the memo also announced that OMB and CIGIE are transitioning the IG FISMA metrics to a multi-year cycle—with a set of core metrics that must be evaluated annually and the remaining metrics that will be evaluated on a two-year cycle, beginning in

FY 2023.1

The core metrics represent a combination of Administration priorities and other highly valuable controls that must be evaluated annually. Specifically, these core metrics align with the Executive Order on Improving the Nation’s Cybersecurity (EO 14028), and guidance from OMB to agencies to improve federal cybersecurity, including:

• Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (M-22-09), sets forth a plan for migrating the federal government to a new cybersecurity paradigm that does not presume that any person or device inside an organization’s perimeter is trusted, and focuses agencies on strengthening their capability to limit, and continuously verify, the access those people and devices have to government data.

• Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents (M-21-31), sets detailed requirements for log management, configuration, and enterprise-level centralization. It also provides a maturity model that prioritizes the most critical software types and requirements.

• Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (M-22-01), directs agencies to coordinate

1 These changes do not in any way limit the scope of IG authority to evaluate information systems on an as-needed or ad-hoc basis.

https://www.whitehouse.gov/wp-content/uploads/2022/12/M-23-03-FY23-FISMA-Guidance-2.pdf https://www.whitehouse.gov/wp-content/uploads/2022/12/M-23-03-FY23-FISMA-Guidance-2.pdf https://cyberscope.dhs.gov/ https://cyberscope.dhs.gov/ https://www.whitehouse.gov/wp-content/uploads/2021/12/M-22-05-FY22-FISMA-Guidance.pdf https://www.whitehouse.gov/wp-content/uploads/2021/12/M-22-05-FY22-FISMA-Guidance.pdf https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf with the Cybersecurity and Infrastructure Security Agency (CISA) to accelerate their adoption of robust EDR solutions, an essential component for zero trust architecture that combines real-time continuous monitoring and collection of endpoint data with rules-based automated response and analysis capabilities.

• Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (M-22-18), initiates a government-wide shift towards requiring agencies to use software developed in a secure manner. This will minimize the risks associated with running unvetted technologies on agency networks, increasing the resilience of Federal technology against cyber threats.

The IG FISMA metrics are aligned with the five function areas in the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover (table 1). The Cybersecurity Framework provides agencies with a common structure for identifying and managing cybersecurity risks across the enterprise and provides IGs with guidance for assessing the maturity of controls to address those risks.

Table 1: IG Metrics and NIST Cybersecurity Framework Function Areas and Categories

IG Metric Function Area and Related Domainsa Related Cybersecurity Framework Categories Identify (Risk Management) Asset Management (ID.AM), Business Environment

(ID.BE), Governance (ID.GV), Risk Assessment (ID.RA), and Risk Management Strategy (ID.RM)

Identify (Supply Chain Risk Management) Supply Chain Risk Management (ID.SC) Protect (Configuration Management) Information Protection Processes and Procedures

(PR.IP)

Protect (Identity and Access Management) Identity Management and Access Control (PR.AC) Protect (Data Protection and Privacy) Data Security (PR.DS) Protect (Security Training) Awareness and Training (PR.AT) Detect (Information Security Continuous Monitoring)

Security Continuous Monitoring (DE.CM)

Respond (Incident Response) Response Planning (RS.RP), Communications (RS.CO), Analysis (RS.AN), Mitigation (RS.MI), and Improvements (RS.IM)

Recover (Contingency Planning) Recovery Planning (RC.RP), Improvements (RC.IM), and Communications (RC.CO) a Refer to the NIST glossary for definitions of the function areas and domains.

https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf https://csrc.nist.gov/glossary

Key Changes to the FY 2023 – 2024 IG FISMA Metrics One of the goals of the annual FISMA evaluations is to assess agencies’ progress toward achieving outcomes that strengthen Federal cybersecurity. The FY 2023 – 2024 FISMA IG metrics have been updated to determine agency progress in implementing these requirements, as follows:

• OMB M-23-03, Fiscal Year 2023 Guidance on Federal Information Security and Privacy Management Requirements – By the end of FY 2023, agencies are required to report at least 80% of government-furnished equipment through the DHS’ CDM program. As such, metric #2 regarding hardware asset management has been updated to reflect this new requirement.

• DHS Binding Operational Directive 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks – By April 3, 2023, agencies are required to take specific actions for asset discovery, vulnerability enumeration, and automated reporting.

Metrics #2, #20, and #21 regarding hardware asset management, configuration settings, and flaw remediation, respectively, have been updated accordingly.

• OMB M-21-30, Protecting Critical Software through Enhanced Security Measures – This memorandum provides guidance on the implementation of security measures for EO-critical software. As such, metric #3 regarding software asset management has been updated.

• OMB M-22-18, Enhancing the Security of the Software Supply Chain Through Secure Software Development Practices – This memorandum requires agencies to comply with NIST guidance and any subsequent updates related to software supply chain security.

Metric #14 regarding third-party security has been updated to reflect requirements regarding software producer self-attestations.

• OMB M-21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents – This memorandum directs agencies to take action to strengthen audit logging, log retention, and log management capabilities.

As such, Metrics #32 and #54 regarding privileged account management and incident detection and analysis, respectively, have been updated to reflect these requirements.

• OMB M-22-01, Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response – This memorandum directs agencies to take action to strengthen their endpoint detection and response solutions and capabilities. As such, metric #37 regarding data exfiltration and enhanced network defenses has been updated to reflect these requirements.

FISMA Metric Ratings

IGs are required to assess the effectiveness of information security programs on a maturity model spectrum, in which the foundational levels ensure that agencies develop sound policies and procedures and the advanced levels capture the extent that agencies institutionalize those policies and procedures.

The five maturity model levels are ad hoc, defined, consistently implemented, managed and measurable, and optimized (table 2). Within the context of the maturity model, OMB believes that achieving a Level 4 (managed and measurable) or above represents an effective level of security. NIST provides additional guidance for determining the effectiveness of security controls.2 IGs should consider both their and the agency’s assessment of unique missions, resources, and challenges when determining information security program effectiveness. IGs have the discretion to determine whether an agency is effective in each of the Cybersecurity Framework Function (e.g., protect, detect) and whether the agency’s overall information security program is effective based on the results of the determinations of effectiveness in each function and the overall assessment. Therefore, an IG has the discretion to determine that an agency’s information security program is effective even if the agency does not achieve a Level 4 (managed and measurable).

Table 2: IG Evaluation Maturity Levels

Maturity Level Maturity Level Description

Level 1: Ad Hoc Policies, procedures, and strategies are not formalized; activities are performed in an ad-hoc, reactive manner.

Level 2: Defined Policies, procedures, and strategies are formalized and documented but not consistently implemented.

Level 3: Consistently Implemented

Policies, procedures, and strategies are consistently implemented, but quantitative and qualitative effectiveness measures are lacking.

Level 4: Managed and Measurable

Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategies are collected across the organization and used to assess them and make necessary changes.

Level 5: Optimized Policies, procedures, and strategies are fully institutionalized, repeatable, self-generating, and regularly updated based on a changing threat and technology landscape and business/mission needs.

Reflecting OMB’s shift in emphasis away from compliance in favor of risk management-based security outcomes, IGs are encouraged to evaluate the IG metrics based on the risk tolerance and threat model of their agency and to focus on the practical security impact of weak control implementations, rather than strictly evaluating from a view of compliance or the mere presence or absence of controls.

In response to the threat environment and technology ecosystem which continue to evolve and change at a faster pace each year, OMB implemented a new framework regarding the timing and focus of assessments in FY2022. The goal of this new framework was to provide a more flexible but continued focus on annual assessments for the federal community. This effort yielded two distinct groups of metrics: Core and Supplemental.

Core Metrics – Metrics that are assessed annually and represent a combination of Administration priorities, high impact security processes, and essential functions necessary to determine security program effectiveness.

2 NIST Special Publication (SP) 800-53, Rev. 5, Security and Privacy Controls for Information Systems and Organizations, defines security control effectiveness as the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the information system in its operational environment or enforcing/mediating established security policies.

https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Supplemental Metrics – Metrics that are assessed at least once every two years and represent important activities conducted by security programs and contribute to the overall evaluation and determination of security program effectiveness.

IGs should leverage the core metrics to gain a clear picture of where agencies stand as it relates to the priority objectives outlined above. However, those priorities do not account for the totality of efforts made by agencies to secure their environments. IGs are encouraged to leverage supplemental metric scores, additional reports (including past evaluations where results have had little variance year over year), and any additional evidence of information security program effectiveness to provide context within the evaluation period (or past periods, as applicable). These additional considerations should be documented in Cyberscope to justify the effectiveness determinations made by IGs.

Scoring Methodology

In previous years, IGs have been directed to utilize a mode-based scoring approach to assess agency maturity levels. Under this approach, ratings throughout the reporting domains were determined by a simple majority, where the most frequent level (i.e., the mode) across the questions served as the domain rating. The same logic was applied at the function and overall information security program level. However, in FY 2021, OMB and CIGIE conducted a pilot to score agencies based on a weighted average for certain priority metrics. One purpose of this pilot was to help evaluate the impacts of these priority metrics and prepare agencies for the possibility of changing the maturity calculation process in the future.

Through analyses of the data obtained through this pilot and the FY2020 – FY2022 governmentwide IG FISMA reporting, OMB and CIGIE determined that a non-weighted (e.g., calculated) average more closely aligned with the OIG’s assessed maturity levels expressed in a numeric format. This result highlights that maturity levels assigned by IGs at the domain, function, and information security program levels align more closely to an approach based on a calculated average than one based on the mode. Further, with the introduction of Core metrics in FY 2022, a mode-based scoring approach, where all metrics are weighted equally, may not provide an accurate assessment of maturity in cases where specific domains and function areas may not have a large number of metrics. Therefore, ratings in FY 2023 will focus on a calculated average approach, wherein the average of the metrics in a particular domain will be used by IGs to determine the effectiveness of individual function areas (identify, protect, detect, respond, and recover) and the overall program.

To provide IGs with additional flexibility and encourage evaluations that are based on agencies’ risk tolerance and threat models, calculated averages will not be automatically rounded to a particular maturity level. In determining maturity levels and the overall effectiveness of the agency’s information security program, OMB strongly encourages IGs to focus on the results of the core metrics, as these tie directly to Administration priorities and other high-risk areas. IGs should use the calculated averages of the supplemental metrics as a data point to support their risk-based determination of overall program and function level effectiveness. Other data points that IGs may consider include:

• The results of cybersecurity evaluations, including system security control reviews, vulnerability scanning, and penetration testing conducted during the review period;

• The progress made by agencies in address outstanding IG recommendations; and,

• Reported security incidents reported during the review period.

As in previous years, IGs should provide comments in Cyberscope to explain the rationale for their overall effectiveness ratings at the domain, function, and information security program levels.

Additionally, for any metrics rated lower than level 4, IGs will be required to provide comments.

Comments in Cyberscope should reference how the agency’s risk appetite and tolerance level with respect to adequate security, including compensating controls, were factored into the IGs maturity level determinations.

IGs continue to retain the discretion to determine the overall effectiveness of their respective agency’s information security program, in accordance with Cybersecurity Framework function effectiveness (e.g., identify, protect), and the individual domain ratings (e.g., risk management, configuration management) at the maturity level based on their evaluations. Using this approach, IGs may determine that a particular domain, function area, and/or the agency’s information security program is effective at a calculated maturity level lower than Level 4.

To that end, this document introduces a calculated average scoring model for FY 2023 and FY 2024. As part of this approach, Core metrics and Supplemental metrics will be averaged independently to determine a domain’s maturity calculation and provide data points for the assessed program and function effectiveness. For example, if the calculated Core metric maturity of two of the function areas is Level 3 (consistently implemented) and the calculated Core metric maturity of the remaining three function areas is Level 4 (managed and measurable), then the information security program rating would average a 3.60. A hypothetical example of an IG evaluation for Core and Supplemental metrics in the risk management domain and the overall program evaluation is shown in the tables below.3

Table 3: Example of Calculated Average for Core Metrics Maturity Calculation in FY 2023

Core Metrics Metric

Number Function Metric Descriptor

Review Cycle FY23 IG Rating

1 Identify System inventory Core Metric Level 4 2 Identify Hardware asset management Core Metric Level 4 3 Identify Software asset management Core Metric Level 3

5 Identify Cybersecurity risk management and ERM integration Core Metric Level 3

10 Identify Automated view of risk Core Metric Level 4 TOTAL 5 core metrics in FY23 18

3 This example does not take into consideration the ratings of the supply chain risk management domain metrics, which Cyberscope will include in the calculation for the identify function area.

https://cyberscope.dhs.gov/Warning.aspx

Table 4: Example of Calculated Average for Supplemental Metrics Maturity Calculation in FY23

FY23 Supplemental Metrics Metric

Number Function Metric Descriptor

Review Cycle FY23 IG Rating

7 Identify Roles and responsibilities FY23 Level 3 8 Identify Plan of action and milestones FY23 Level 4 9 Identify Risk communication FY23 Level 3

TOTAL 3 supplemental metrics in FY23 10

Table 5: Example of Calculated Average FY24 Supplemental Metrics Maturity Calculation in FY24

FY24 Supplemental Metrics Metric

Number Function Metric Descriptor

Review Cycle FY24 IG Rating

4 Identify System categorization FY24 Level 4

6 Identify Information security architecture FY24 Level 3

TOTAL 2 supplemental metrics in FY24 7

Table 6: Example of Overall Calculated Averages Maturity Calculation in FY23

FY23 Summary

Function Core Metrics

FY23 Supp.

Metrics

FY24 Supp.

Metrics

FY23 Assessed Maturity

FY23

Justification

Identify 3.6 3.3 N/A Effective Ipsum lorem.

Protect 4.0 3.7 N/A Effective Ipsum lorem.

Detect 3.0 3.1 N/A Not Effective Ipsum lorem.

Respond 4.0 4.0 N/A Effective Ipsum lorem.

Recover 3.4 3.1 N/A Not Effective Ipsum lorem.

Overall Maturity 3.6 3.4 N/A Not Effective Ipsum lorem.

Table 7: Example of Overall Calculated Averages Maturity Calculation in FY24

FY24 Summary

Function Core Metrics

FY23 Supp.

Metrics

FY24 Supp.

Metrics

FY24 Assessed Maturity

FY24

Justification

Identify 3.7 3.3 3.5 Effective Ipsum lorem.

Protect 4.0 3.7 3.6 Effective Ipsum lorem.

Detect 3.2 3.1 3.2 Not Effective Ipsum lorem.

Respond 4.0 4.0 3.9 Effective Ipsum lorem.

Recover 3.4 3.1 3.2 Not Effective Ipsum lorem.

Overall

Maturity 3.7 3.4 3.5 Not Effective Ipsum lorem.

Table 6 shows that this agency’s information security program is struggling to mature their detection capability in FY23 and the IG believes that the detect and recover capabilities are not effective based on the combination of OMB’s recommendation for a Level 4 – Managed and Measurable rating, relevant OMB Memoranda, additional reports and tests conducted during the period, results demonstrated during the evaluation period, and have taken the agency’s unique missions, resources, and challenges into consideration. However, the IG has determined that the agency is effective in the identify domain based the same criteria and based on professional judgment has determined that the agency is operating effectively in this area.

Tables 5 and 7 show a potential agency result in FY24 and while the agency has improved in some areas, the IG has reassessed and reached the same conclusion as the previous year. Variation will occur from the examples above, however, the justification provided by the IG will outline the judgments made in a particular agency’s evaluation.

These examples are intended to be illustrative and, while demonstrating a potential outcome, should only be used as a reference point to understand the lines between the evaluation of the maturity of an organization and the relationship to the IG’s professional judgment of the security program’s effectiveness and the program’s effectiveness in the respective function areas. Each agency will have different missions and implementations of such missions and the IG should take that into account when comparing against the desired level outlined by OMB.

Submission Deadline Historically, the evaluation of agency effectiveness by IGs finished in October; however, this timing limited agency leadership’s ability to request resources in the next budget year to provide for remediations. As such, OMB M-22-05 adjusted the timeline for the IG evaluation of agency information security effectiveness to better align with the budget submission cycle. OMB is requesting that agency IGs submit FY23 FISMA metric data from agency evaluations via Cyberscope no later than July 31, 2023.

Cyberscope will also provide supplementary fields to allow the IG to provide additional comments and data supporting their evaluation results.

FISMA Metrics Evaluation Guide To promote consistency in IG annual FISMA evaluations, an evaluation guide will be developed for IGs to use in their FY 2023 and FY 2024 FISMA evaluations. This guide provides a baseline of suggested sources of evidence and test steps/objectives that can be used by IGs as a part of their FISMA evaluations. The guide, which is a companion document to the FY 2023-2024 IG FISMA Reporting Metrics, also includes suggested types of analysis that IGs may perform to assess capabilities in given areas. As in previous years, the FISMA evaluation guidance will be published on DHS’ FISMA website.

https://www.whitehouse.gov/wp-content/uploads/2021/12/M-22-05-FY22-FISMA-Guidance.pdf http://www.dhs.gov/fisma

IDENTIFY FUNCTION AREA

Table 8: Risk Management

Question Criteria Review Cycle

Maturity Level

Ad Hoc Defined Consistently Implemented Managed and Measurable Optimized

1. To what extent does the organization maintain a comprehensive and accurate inventory of its information systems (including cloud systems, public facing websites, and third-party systems), and system interconnections?

• NIST SP 800-37

(Rev. 2)

• NIST SP 800-53

(Rev. 5): CA-3, PM-5, and CM-8

• NIST Cybersecurity

Framework (CSF):

ID.AM-1 – 4

• FY 2023 CIO FISMA

Metrics: 1.1 and 1.5

• OMB A-130

• OMB M-23-03

Core

Metric

The organization has not defined its policies, procedures, and processes for developing and maintaining a comprehensive and accurate inventory of its information systems and system interconnections.

The organization has defined its policies, procedures, and processes for developing and maintaining a comprehensive and accurate inventory of its information systems and system interconnections.

The organization consistently implements its policies, procedures, and processes to maintain a comprehensive and accurate inventory of its information systems (including cloud systems, public-facing websites, and third-party systems), and system interconnections.

The organization ensures that the information systems included in its inventory are subject to the monitoring processes defined within the organization's ISCM strategy.

The organization uses automation to develop and maintain a centralized information system inventory that includes hardware and software components from all organizational information systems.

The centralized inventory is updated in a near-real time basis.

2. To what extent does the organization use standard data elements/taxonomy to develop and maintain an up-to-date inventory of hardware assets (including GFE and Bring Your Own Device (BYOD) mobile devices) connected to the organization’s network with the detailed information necessary for tracking and reporting?

• NIST SP 800-37

(Rev. 2): Tasks P-10 and P-16

• NIST SP 800-53

(Rev. 5): CA-7 and CM-

• NIST SP 800-137

• NIST SP 800-207

• NIST 1800-5

• NIST IR 8011

• NIST CSF: ID.AM-1

• Federal Enterprise

Architecture (FEA) Framework

• FY 2023 CIO FISMA

Metrics: 1.2, 1.3, and 10.8

• CIS Top 18 Security

Controls: Control 1

• OMB M-23-03

• DHS Binding

Operational Directive

(BOD) 23-01

• BOD 23-01

Implementation Guidance

The organization has not defined policies, procedures, and processes for using standard data elements/taxonomy to develop and maintain an up-to-date inventory of hardware assets connected to the organization’s network (including through automated asset discovery) with the detailed information necessary for tracking and reporting.

The organization has defined policies, procedures, and processes for using standard data elements/taxonomy to develop and maintain an up-to-date inventory of hardware assets connected to the organization’s network (including through automated asset discovery) with the detailed information necessary for tracking and reporting.

The organization consistently uses its standard data elements/taxonomy to develop and maintain an up-to-date inventory of hardware assets connected to the organization’s network (including through automated asset discovery) and uses this taxonomy to inform which assets can/cannot be introduced into the network.

The organization is making sufficient progress towards reporting at least 80% of its GFEs through DHS’ CDM program.

The organization ensures that the hardware assets connected to the network are covered by an organization-wide hardware asset management capability and are subject to the monitoring processes defined within the organization's ISCM strategy.

For mobile devices, the agency enforces the capability to deny access to agency enterprise services when security and operating system updates have not been applied within a given period based on agency policy or guidance.

The organization employs automation to track the life cycle of the organization's hardware assets with processes that limit the manual/procedural methods for asset management. Further, hardware inventories are regularly updated as part of the organization’s enterprise architecture current and future states.

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://www.nist.gov/cyberframework/framework-documents https://www.nist.gov/cyberframework/framework-documents https://www.nist.gov/cyberframework/framework-documents https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource https://www.whitehouse.gov/wp-content/uploads/2022/12/M-23-03-FY23-FISMA-Guidance-2.pdf https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-137/final https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1800-5.pdf https://csrc.nist.gov/publications/detail/nistir/8011/vol-1/final https://www.nist.gov/cyberframework/framework-documents https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.cisecurity.org/controls/cis-controls-list https://www.cisecurity.org/controls/cis-controls-list https://www.whitehouse.gov/wp-content/uploads/2022/12/M-23-03-FY23-FISMA-Guidance-2.pdf https://www.cisa.gov/binding-operational-directive-23-01 https://www.cisa.gov/binding-operational-directive-23-01 https://www.cisa.gov/binding-operational-directive-23-01 https://www.cisa.gov/implementation-guidance-binding-operational-directive-23-01 https://www.cisa.gov/implementation-guidance-binding-operational-directive-23-01 https://www.cisa.gov/implementation-guidance-binding-operational-directive-23-01

Question Criteria Review Cycle

Maturity Level

Ad Hoc Defined Consistently Implemented Managed and Measurable Optimized

3. To what extent does the organization use standard data elements/taxonomy to develop and maintain an up-to-date inventory of the software and associated licenses used within the organization with the detailed information necessary for tracking and reporting?

• NIST SP 800-37

(Rev. 2): Task P-10

• NIST SP 800-53

(Rev. 5): CA-7, CM-8, CM-10, and CM-11

• NIST SP 800-137

• NIST SP 800-207:

Section 7.3

• NIST 1800-5

• NIST IR 8011

• NIST Security

Measures for EO- Critical Software Use

• NIST CSF: ID.AM-2

• FEA Framework

• FY 2023 CIO FISMA

Metrics: 1.4 and 4.1

• OMB M-21-30

• OMB M-22-09

• OMB M-22-18

• OMB M-23-03

• CIS Top 18 Security

Controls: Control 2

• CISA Cybersecurity

Incident Response Playbooks

The organization has not defined policies, procedures, and processes for using standard data elements/taxonomy to develop and maintain an up-to-date inventory of software assets and licenses, including for EO-critical software and mobile applications, used in the organization's environment with the detailed information necessary for tracking and reporting.

The organization has defined policies, procedures, and processes for using standard data elements/taxonomy to develop and maintain an up-to-date inventory of software assets and licenses, including for EO-critical software and mobile applications, used in the organization's environment with the detailed information necessary for tracking and reporting.

The organization consistently uses its standard data elements/taxonomy to develop and maintain an up-to-date inventory of software assets and licenses, including for EO-critical software and mobile applications, used in the organization's environment and uses this taxonomy to inform which assets can/cannot be introduced into the network.

The organization establishes and maintains a software inventory for all platforms running EO-critical software and all software (both EO-critical and non-EO-critical) deployed to each platform.

The organization ensures that the software assets, including EO-critical software and mobile applications as appropriate, on the network (and their associated licenses), are covered by an organization-wide software asset management (or Mobile Device Management) capability and are subject to the monitoring processes defined within the organization's ISCM strategy.

For mobile devices, the agency enforces the capability to prevent the execution of unauthorized software (e.g., blacklist, whitelist, or cryptographic containerization).

The organization employs automation to track the life cycle of the organization's software assets (and their associated licenses), including for EO-critical software and mobile applications, with processes that limit the manual/procedural methods for asset management. Further, software inventories are regularly updated as part of the organization’s enterprise architecture current and future states.

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-137/final https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1800-5.pdf https://csrc.nist.gov/publications/detail/nistir/8011/vol-1/final https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/security-measures-eo-critical-software-use https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/security-measures-eo-critical-software-use https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/security-measures-eo-critical-software-use https://www.nist.gov/cyberframework/framework-documents https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-30.pdf https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf https://www.whitehouse.gov/wp-content/uploads/2022/12/M-23-03-FY23-FISMA-Guidance-2.pdf https://www.cisecurity.org/controls/cis-controls-list https://www.cisecurity.org/controls/cis-controls-list https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf

Maturity Level

Ad Hoc Defined Consistently Implemented Managed and Measurable Optimized

4. To what extent has the organization categorized and communicated the importance/priority of information systems in enabling its missions and business functions, including for high value assets?

• NIST SP 800-37

(Rev. 2): Tasks C-2, C- 3, P-4, P-12, P-13, S-1

– S-3

• NIST SP 800-53

(Rev. 5): RA-2, PM-7, and PM-11

• NIST SP 800-60

• NIST IR 8170

• NIST CSF: ID.BE-3,

ID.AM-5, and ID.SC-2

• FIPS 199

• FY 2023 CIO FISMA

Metrics: 1.1

• OMB M-19-03

FY24

The organization has not defined policies, procedures, and processes for categorizing, reviewing, and communicating the importance/priority of information systems in enabling its missions and business functions, including for high value assets, as appropriate.

In addition, the organization has not defined its policies, procedures, and processes for controls allocation, selection, and tailoring based on the importance/ priority of its information systems.

The organization has defined policies, procedures, and processes for categorizing, reviewing, and communicating the importance/priority of information systems in enabling its missions and business functions, including for high value assets, as appropriate.

In addition, the organization has defined policies, procedures, and processes for controls allocation, selection and tailoring based on the importance/ priority of its information systems.

The organization consistently implements its policies, procedures, and processes for system categorization, review, and communication, including for high value assets, as appropriate.

Security categorizations consider potential adverse impacts to organization operations, organizational assets, individuals, other organizations, and the Nation. System categorization levels are used to guide risk management decisions, such as the allocation, selection, and implementation of appropriate control baselines.

The organization ensures the risk-based allocation of resources based on system categorization, including for the protection of high value assets, as appropriate, through collaboration and data-driven prioritization.

The organization uses impact-level prioritization for additional granularity, and cybersecurity framework profiles, as appropriate, to support risk-based decision-making.

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/nistir/8170/final https://www.nist.gov/cyberframework/framework-documents https://www.nist.gov/cyberframework/framework-documents https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.cisa.gov/sites/default/files/publications/FY23_FISMA_CIO_Metrics_FINAL.pdf https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf

Maturity Level

Ad Hoc Defined Consistently Implemented Managed and Measurable Optimized

5. To what extent does the organization ensure that information system security risks are adequately managed at the organizational, mission/business process, and information system levels?

• NIST SP 800-37

(Rev. 2): Tasks P-2, P- 3, P-14, R-2, and R-3

• NIST SP 800-39

• NIST SP 800-53

(Rev. 5): RA-3 and PM-

• NIST IR 8286

• NIST IR 8286A

• NIST IR 8286B

• NIST IR 8286C

• NIST IR 8286D

• NIST CSF: ID RM-1 –

ID.RM-3

• OMB A-123

• OMB M-16-17

• OMB M-23-03

The organization has not defined and communicated the policies, procedures and processes it uses to manage the cybersecurity risks associated with operating and maintaining its information systems.

At a minimum, the policies, procedures, and processes do not cover the following areas from a cybersecurity perspective:

• Risk framing

• Risk assessment

• Risk response

• Risk monitoring

The organization has defined and communicated the policies, procedures and processes it uses to manage the cybersecurity risks associated with operating and maintaining its information systems.

The policies, procedures, and processes cover cybersecurity risk management at the organizational, mission/business process, and information system levels and address the following components

• Risk framing

• Risk assessment

• Risk response

• Risk monitoring

The organization consistently implements its policies, procedures, and processes to manage the cybersecurity risks associated with operating and maintaining its information systems. The organization ensures that decisions to manage cybersecurity risk at the information system level are informed and guided by risk decisions made at the organizational and mission/business levels.

System risk assessments are performed [according to organizational defined time frames] and appropriate security controls to mitigate risks identified are implemented on a consistent basis. The organization uses the common vulnerability scoring system, or similar approach, to communicate the characteristics and severity of software vulnerabilities.

Further, the organization uses a cybersecurity risk register to manage risks, as appropriate, and is consistently capturing and sharing lessons learned on the effectiveness of cybersecurity risk management processes and updating the program accordingly.

The organization uses the results of its system level risk assessments, along with other inputs, to perform and maintain an organization-wide cybersecurity and privacy risk assessment. The result of this assessment is documented in a cybersecurity risk register and serve as an input into the organization’s enterprise risk management program. The organization consistently monitors the effectiveness of risk responses to ensure that risk tolerances are maintained at an appropriate level.

The organization ensures that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to (i) quantify and aggregate security risks, (ii) normalize cybersecurity risk information across organizational units, and (iii) prioritize operational risk response.

The cybersecurity risk management program is fully integrated at the organizational, mission/business process, and information system levels, as well as with the entity’s enterprise risk management program.

Further, the organization's cybersecurity risk management program is embedded into daily decision making across the organization and provides for continuous identification and monitoring to ensure that risk remains within organizationally-defined acceptable levels.

The organization uses Cybersecurity Framework profiles and enterprise risk profiles to align cybersecurity outcomes with mission or business requirements, risk tolerance, and resources of the organization.

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/nistir/8286/final https://nvlpubs.nist.gov/nistpubs/ir/2021/NIST.IR.8286A.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8286B.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8286C.pdf https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8286D.pdf https://www.nist.gov/cyberframework/framework-documents https://www.nist.gov/cyberframework/framework-documents https://www.osec.doc.gov/opog/privacy/Memorandums/OMB_Circular_A-123.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2016/m-16-17.pdf https://www.whitehouse.gov/wp-content/uploads/2022/12/M-23-03-FY23-FISMA-Guidance-2.pdf

Maturity Level

Ad Hoc Defined Consistently Implemented Managed and Measurable Optimized

6. To what extent does the organization use an information security architecture to provide a disciplined and structured methodology for managing risk, including risk from the organization’s supply chain?

• NIST SP 800-37

(Rev. 2): Task P-16

• NIST SP 800-39

• NIST SP 800-53

(Rev. 5): PL-8, SA-3, SA-8. SA-9, SA-12, and

PM-9

• NIST SP 800-160

• NIST SP 800-163,

(Rev. 1)

• NIST SP 800-218

• NIST CSF: ID.SC-1

and PR.IP-2

• FEA Framework

• OMB M-15-14

• OMB M-19-03

• OMB M-22-18

• SECURE Technology

Act: s. 1326

• Federal Information

Technology Acquisition Reform Act (FITARA) not defined an information security architecture and its processes for ensuring that new/acquired hardware/software, including mobile apps, are consistent with its security architecture prior to introducing systems into its development environment.

The organization has defined an information security architecture and described how that architecture is integrated into and supports the organization’s enterprise architecture.

In addition, the organization has defined how it implements system security engineering principles and software assurance processes for mobile applications, within its system development life cycle (SDLC).

The organization has consistently implemented its security architecture across the enterprise, business process, and system levels.

System security engineering principles are followed and include assessing the impacts to the organizations information security architecture prior to introducing information system changes into the organization’s environment.

In addition, the organization employs a software assurance process for mobile applications.

The organization’s information security architecture is integrated with its systems development lifecycle and defines and directs implementation of security methods, mechanisms, and capabilities to both the Information and Communications Technology (ICT) supply chain and the organization’s information systems.

The organization uses advanced technologies and techniques for managing supply chain risks. To the extent practicable, the organization can quickly adapt its information security and enterprise architectures to mitigate supply chain risks.

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-160/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-163/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-163/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-218/final https://www.nist.gov/cyberframework/framework-documents https://www.nist.gov/cyberframework/framework-documents https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2015/m-15-14.pdf https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf https://www.congress.gov/bill/115th-congress/house-bill/7327/text https://www.congress.gov/bill/115th-congress/house-bill/7327/text https://www.nist.gov/system/files/documents/2017/05/11/doc2017financialmanagementconference-fitara.pdf https://www.nist.gov/system/files/documents/2017/05/11/doc2017financialmanagementconference-fitara.pdf https://www.nist.gov/system/files/documents/2017/05/11/doc2017financialmanagementconference-fitara.pdf https://www.nist.gov/system/files/documents/2017/05/11/doc2017financialmanagementconference-fitara.pdf

Maturity Level

Ad Hoc Defined Consistently Implemented Managed and Measurable Optimized

7. To what extent have the roles and responsibilities of internal and external stakeholders involved in cybersecurity risk management processes been…