DHA System-Level Continuous Monitoring Plan 23MAY2018.pdf

Security

Control

Security

Control / … Comments Criticality Frequency Method Reporting Tracking Comments

CA-3(2) System Interconnections |

Classified National Security

Since this control has immediate implications to

CRWG Red

Criticality

Quarterly Manual via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IR-9 Information Spillage

Response

Spillage implies the potential for loss of

CRWG Red

Criticality

Constantly Manual via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

POAM & IR

Team

Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7 Boundary Protection Ensures protection at the boundary. Publically

CRWG Red

Criticality

Constantly Semi-Automated via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7(14) Boundary Protection |

Protect Against

Unintended physical connections are the worst

CRWG Red

Criticality

Constantly Automated via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

IDS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7(18) Boundary Protection | Fail

Secure

Primary defense mechanism which could

CRWG Red

Criticality

Constantly Automated via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

IDS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-8 Transmission

Confidentiality and Integrity

Given the addition of

"Confidentiality" to the

CRWG Red

Criticality

Quarterly Manual via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SI-3 Malicious Code Protection Core capability that if not running will not thwart

CRWG Red

Criticality

Constantly Automated via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

HBSS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SI-4 Information System

Monitoring

If we lose the monitoring ability, that is immediate

CRWG Red

Criticality

Constantly Automated via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

HBSS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SI-4(4) Information System

Monitoring | Inbound and

Failure to monitor at ingress/egress points is loss

CRWG Red

Criticality

Constantly Automated via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

IDS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SI-4(5) Information System

Monitoring | System-

Failure of alerts means we do not know if we are

CRWG Red

Criticality

Constantly Automated via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the

Enterprise

Logging Tool

Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-2 Account Management The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-2(10) Account Management |

Shared/ Group Account

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-2(11) Account Management |

Usage Conditions

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-2(13) Account Management |

Disable Accounts For High-

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-3 Access Enforcement The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-4 Information Flow

Enforcement

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-6(1) Least Privilege | Authorize

Access to Security

This control requires investigation because non-

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-6(2) Least Privilege | Non-

Privileged Access For Non-

This control requires investigation because non-

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-6(3) Least Privilege | Network

Access to Privileged

This control requires investigation because non-

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-6(5) Least Privilege | Privileged

Accounts

This control requires investigation because non-

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-6(7) Least Privilege | Review of

User Privileges

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-6(8) Least Privilege | Privilege

Levels for Code Execution

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-6(10) Least Privilege | Prohibit

Non-privileged Users from

The security control should be further investigated

CRWG Yellow

Criticality

Monthly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-7 Unsuccessful Login

Attempts

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

Enterprise

Logging Tool

Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-12 Session Termination The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-12(1) Session Termination |User-

Initiated Logouts/ Message

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-17(1) Remote Access |

Automated Monitoring/

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

Enterprise

Logging Tool

Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-17(2) Remote Access | Protection of Confidentiality/ Integrity

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-17(3) Remote Access | Managed

Access Control Points

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-17(4) Remote Access | Privileged

Commands/ Access

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-17(6) Remote Access | Protection of Information

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-18(1) Wireless Access Restrictions

| Authentication and

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-18(3) Wireless Access Restrictions

| Disable Wireless

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-18(4) Wireless Access Restrictions

| Restrict Configurations by

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-18(5) Wireless Access Restrictions

| Antennas/ Transmission

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-19 Access Control For Mobile

Devices

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-19(4) Access Control For Mobile

Devices | Restrictions For

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AC-19(5) Access Control For Mobile

Devices | Full Device/

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-5 Response To Audit

Processing Failures

The security control should be further investigated

CRWG Yellow

Criticality

Monthly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-5(1) Response To Audit

Processing Failures | Audit

The security control should be further investigated

CRWG Yellow

Criticality

Monthly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-5(2) Response To Audit

Processing Failures | Real-

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

Enterprise

Logging Tool

Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-6(1) Audit Review, Analysis, And

Reporting | Process

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

Enterprise

Logging Tool

Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-6(3) Audit Review, Analysis, And

Reporting | Correlate Audit

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-6(10) Audit Review, Analysis, And

Reporting | Audit Level

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-9 Protection Of Audit

Information

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-10 Non-Repudiation The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-12 Audit Generation The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

Enterprise

Logging Tool

Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-12(3) Audit Generation |

Changes by Authorized

The security control should be further investigated

CRWG Yellow

Criticality

Weekly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-13 Monitoring for Information

Disclosure

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

DLP Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per AU-13(1) Monitoring for Information

Disclosure | Use of

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

DLP Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CA-3 System Interconnections The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CA-3(1) System Interconnections |

Unclassified National

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CA-3(2) System Interconnections |

Classified National Security

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CA-3(3) System Interconnections |

Unclassified Non-National

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CA-3(5) System Interconnections |

Restrictions on External

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CA-6 Security Authorization The control will be changed to yellow. The cause of the

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CA-9 Internal System

Connections

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-2 Baseline Configuration The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-2(1) Baseline Configuration |

Reviews and Updates

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-2(2) Baseline Configuration |

Automation Support for

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per

Continuous Monitoring StrategyImplementation Status / Security Control Status

Security

Control / … Comments Criticality Frequency Method Reporting Tracking Comments

Continuous Monitoring StrategyImplementation Status / Security Control Status

CM-2(3) Baseline Configuration |

Retention of Previous

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-2(7) Baseline Configuration |

Configure Systems, The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-3 Configuration Change

Control

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-3(1) Configuration Change

Control | Automated

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-3(2) Configuration Change

Control | Test/ Validate/

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-3(4) Configuration Change

Control | Security

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-3(5) Configuration Change

Control | Automated

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-3(6) Configuration Change

Control | Cryptography

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-4(1) Security Impact Analysis |

Separate Test

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-5 Access Restrictions For

Change

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-5(1) Access Restrictions For

Change | Automated

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-5(2) Access Restrictions For

Change | Review System

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-5(3) Access Restrictions For

Change | Signed

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-5(5) Access Restrictions For

Change | Limit Production/

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-5(6) Access Restrictions For

Change | Limit Library

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-6 Configuration Settings The security control should be further investigated

CRWG Yellow

Criticality

Monthly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

OS Scans Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-6(1) Configuration Settings |

Automated Central

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-6(2) Configuration Settings |

Respond to Unauthorized

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-7 Least Functionality The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-7(1) Least Functionality |

Periodic Review

The security control should be further investigated

CRWG Yellow

Criticality

Monthly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

ACAS/SCAP Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-7(2) Least Functionality |

Prevent Program Execution

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-7(5) Least Functionality |

Authorized Software/

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-8 Information System

Component Inventory

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-8(1) Information System

Component Inventory |

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-8(3) Information System

Component Inventory |

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-9 Configuration Management

Plan

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-10 Software Usage Restrictions The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-11 User-Installed Software The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

SCCM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-11(1) User-Installed Software |

Alerts For Unauthorized

The security control should be further investigated

CRWG Yellow

Criticality

Monthly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

SCCM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CM-11(2) User-Installed Software |

Prohibit Installation without

The security control should be further investigated

CRWG Yellow

Criticality

Constantly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

OS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-2 Contingency Plan The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-2(1) Contingency Plan |

Coordinate with Related

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-2(2) Contingency Plan | Capacity

Planning

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-2(3) Contingency Plan | Resume

Essential Missions/

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-2(4) Contingency Plan | Resume

All Missions/ Business

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-2(5) Contingency Plan |

Continue Essential

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-2(8) Contingency Plan | Identify

Critical Assets

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-4 Contingency Plan Testing The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-6 Alternate Storage Site The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per CP-7 Alternate Processing Site The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IA-2 Identification And

Authentication

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IA-2(11) Identification And

Authentication

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IA-3 Device Identification And

Authentication

The security control should be further investigated

CRWG Yellow

Criticality

Monthly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IA-5 Authenticator Management The security control should be further investigated

CRWG Yellow

Criticality

Monthly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IA-7 Cryptographic Module

Authentication

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IR-4 Incident Handling The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IR-4(4) Incident Handling |

Information Correlation

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IR-4(6) Incident Handling | Insider

Threats - Specific

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IR-6 Incident Reporting The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per IR-8 Incident Response Plan The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per MA-4 Nonlocal Maintenance The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per MA-4(1) Nonlocal Maintenance |

Auditing and Review

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per MA-4(6) Nonlocal Maintenance |

Cryptographic Protection

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per MP-3 Media Marking The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per MP-6 Media Sanitization The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per MP-7 Media Use The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per PE-3 Physical Access Control The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per PE-4 Access Control For

Transmission Medium

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per PE-6 Monitoring Physical Access The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per PS-4 Personnel Termination The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Security

Control / … Comments Criticality Frequency Method Reporting Tracking Comments

Continuous Monitoring StrategyImplementation Status / Security Control Status

PS-8 Personnel Sanctions The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per RA-5 Vulnerability Scanning The security control should be further investigated

CRWG Yellow

Criticality

Weekly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

ACAS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-4 Acquisition Process The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-4(2) Acquisition Process |

Design/ Implementation

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-9 External Information

System Services

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-9(2) External Information

System Services |

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-12(9) Supply Chain Protection |

Operations Security

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-12(11) Supply Chain Protection |

Penetration Testing/

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-15(7) Development Process, Standards, and Tools |

The security control should be further investigated

CRWG Yellow

Criticality

Weekly Automated via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

ACAS Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-17 Developer Security

Architecture and Design

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-19 Component Authenticity The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SA-22 Unsupported System

Components

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-2 Application Partitioning The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-4 Information In Shared

Resources

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-5 Denial Of Service Protection The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-5(3) Denial of Service Protection

| Detection/ Monitoring

The security control should be further investigated

CRWG Yellow

Criticality

Annually Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7(4) Boundary Protection |

External

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7(5) Boundary Protection | Deny by Default/ Allow by

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7(7) Boundary Protection |

Prevent Split Tunneling for

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7(9) Boundary Protection |

Restrict Threatening

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per SC-7(10) Boundary Protection |

Prevent Unauthorized

The security control should be further investigated

CRWG Yellow

Criticality

Quarterly Manual via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not

POAM Attributes for Criticality, Frequency,…