DHA System-Level Continuous Monitoring Plan 23MAY2018.xlsx
XLSX spreadsheet 75 KB Posted
- Solicitation number
- W9127S22Q6001
About this file
This is a solicitation for an initial outfitting project at Building 99 of the Misawa Air Base Hospital in Japan. The solicitation requests quotes by December 6, 2021 for outfitting the building, including furniture, finishes, artwork, and medical equipment. It is a 100% small business set-aside being conducted by the Department of the Army Corps of Engineers Engineering District Little Rock on behalf of the Defense Health Agency. The solicitation includes specifications, drawings, equipment cut sheets, and a past performance questionnaire for the outfitting work.
View the file
Other files
Show all 44
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Ordered by Criticality
| Implementation Status / Security Control Status | Continuous Monitoring Strategy |
| Security |
Control Number Security Control / Enhancement
| Name | … | Comments | Criticality | Frequency | Method | Reporting | Tracking | Comments | ||
| CA-3(2) | System Interconnections | Classified National Security System Connections | Since this control has immediate implications to National Security, the AO should be contacted for an Authorization Decision immediately. | CRWG Red Criticality Control | Quarterly | Manual | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| IR-9 | Information Spillage Response | Spillage implies the potential for loss of confidentiality for classified information. Failure to identify, alert, isolate, eradicate, etc. will undoubtedly lead to compromise of classified information. | CRWG Red Criticality Control | Constantly | Manual | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | POAM & IR Team | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SC-7 | Boundary Protection | Ensures protection at the boundary. Publically accessible systems are provided protections by DMZ. | CRWG Red Criticality Control | Constantly | Semi-Automated | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SC-7(14) | Boundary Protection | Protect Against Unauthorized Physical Connections | Unintended physical connections are the worst kind, far worse than a logical connection. With a physical connection, all bets are off, the outsider (could be a system the adversary has compromised) now has direct access to internal network components. | CRWG Red Criticality Control | Constantly | Automated | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | IDS | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SC-7(18) | Boundary Protection | Fail Secure | Primary defense mechanism which could effect multiple missions and network transmissions. | CRWG Red Criticality Control | Constantly | Automated | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | IDS | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SC-8 | Transmission Confidentiality and Integrity | Given the addition of "Confidentiality" to the wording, the criticality has increased significantly. Loss of confidentiality is more impactful than loss of integrity; therefore, a Red criticality is now warranted. Note also that the "Confidentiality" aspects from SC-9 are what were incorporated into this control, and SC-9 criticality was Red. | CRWG Red Criticality Control | Quarterly | Manual | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SI-3 | Malicious Code Protection | Core capability that if not running will not thwart even the less advanced adversary exploits. | CRWG Red Criticality Control | Constantly | Automated | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | HBSS | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SI-4 | Information System Monitoring | If we lose the monitoring ability, that is immediate escalation to the DAA. | CRWG Red Criticality Control | Constantly | Automated | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | HBSS | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SI-4(4) | Information System Monitoring | Inbound and Outbound Communications Traffic | Failure to monitor at ingress/egress points is loss of core capability. This is where we are most likely to identify attacks. DAA notification for disconnect is critical due to the compromise of integrity of the system. | CRWG Red Criticality Control | Constantly | Automated | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | IDS | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| SI-4(5) | Information System Monitoring | System-Generated Alerts | Failure of alerts means we do not know if we are under attack. Adversary gains access and gets in deep before we have a chance to do anything about it. | CRWG Red Criticality Control | Constantly | Automated | via telephone or high-priority e-mail, the system-level ISSM reports the situation immediately and directly to the AO, while keeping the cybersecurity chain of command informed of status and response actions; if time permits, an authorization/connection decision recommendation is provided to the AO | Enterprise Logging Tool | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-2 | Account Management | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-2(10) | Account Management | Shared/ Group Account Credential Termination | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If credentials are not terminated, users who are no longer part of the group, or more importantly shared root groups, will inappropriately retain rights and privileges. Access control is jeopardized, compounding over time. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-2(11) | Account Management | Usage Conditions | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control limits the ability to deter or prevent insider threat activity. Failure could have mission impact by denying legitimate use. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-2(13) | Account Management | Disable Accounts For High-Risk Individuals | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Given we are talking about users posing a significant risk, if the accounts are not disabled in a timely manner, that significant risk will be quickly realized. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-3 | Access Enforcement | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-4 | Information Flow Enforcement | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-6(1) | Least Privilege | Authorize Access to Security Functions | This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-6(2) | Least Privilege | Non-Privileged Access For Non-security Functions | This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-6(3) | Least Privilege | Network Access to Privileged Commands | This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-6(5) | Least Privilege | Privileged Accounts | This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-6(7) | Least Privilege | Review of User Privileges | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. While this is something the organization does, it has a technical component to it - reassign/remove privileges. If the control becomes non-compliant, users may inappropriately retain elevated privileges, which poses an unacceptable risk for extended periods, potentially indefinitely if a review is never conducted. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-6(8) | Least Privilege | Privilege Levels for Code Execution | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If not prevented from elevating privileges, authorized AND UNAUTHORIZED users can easily subvert protections and modify information or processes, potentially gaining even higher levels of access. This is a common method adversaries use to get root access once they gain normal user access. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-6(10) | Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Must prevent authorized and unauthorized users from elevating privileges and potentially gaining root access. | CRWG Yellow Criticality Control | Monthly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-7 | Unsuccessful Login Attempts | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Constantly | Automated | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | Enterprise Logging Tool | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-12 | Session Termination | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If unattended sessions are left open, adversaries could hijack the session or multiple sessions could create DOS. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-12(1) | Session Termination |User-Initiated Logouts/ Message Displays | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without a distinct logout notification to the user, user sessions could be left hanging, and adversaries could hi-jack the session. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-17(1) | Remote Access | Automated Monitoring/ Control | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Constantly | Automated | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | Enterprise Logging Tool | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-17(2) | Remote Access | Protection of Confidentiality/ Integrity Using Encryption | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-17(3) | Remote Access | Managed Access Control Points | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-17(4) | Remote Access | Privileged Commands/ Access | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-17(6) | Remote Access | Protection of Information | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-18(1) | Wireless Access Restrictions | Authentication and Encryption | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-18(3) | Wireless Access Restrictions | Disable Wireless Networking | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-18(4) | Wireless Access Restrictions | Restrict Configurations by Users | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-18(5) | Wireless Access Restrictions | Antennas/ Transmission Power Levels | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-19 | Access Control For Mobile Devices | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-19(4) | Access Control For Mobile Devices | Restrictions For Classified Information | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AC-19(5) | Access Control For Mobile Devices | Full Device/ Container-Based Encryption | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Loss of the ability to protect confidentiality (and integrity) of the information on mobile devices is especially damaging if the devices are lost or stolen. Adversaries would have full access to sensitive data. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-5 | Response To Audit Processing Failures | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Monthly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-5(1) | Response To Audit Processing Failures | Audit Storage Capacity | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Monthly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-5(2) | Response To Audit Processing Failures | Real-Time Alerts | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Constantly | Automated | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | Enterprise Logging Tool | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-6(1) | Audit Review, Analysis, And Reporting | Process Integration | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Constantly | Automated | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | Enterprise Logging Tool | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-6(3) | Audit Review, Analysis, And Reporting | Correlate Audit Repositories | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-6(10) | Audit Review, Analysis, And Reporting | Audit Level Adjustment | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-9 | Protection Of Audit Information | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-10 | Non-Repudiation | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Quarterly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-12 | Audit Generation | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Constantly | Automated | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | Enterprise Logging Tool | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-12(3) | Audit Generation | Changes by Authorized Individuals | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If an emergent situation dictates that we very quickly ramp up our auditing capability but we cannot, we will likely not be aware of increased activities designed to exploit our systems. We will not be able to respond to the increased risk. | CRWG Yellow Criticality Control | Weekly | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-13 | Monitoring for Information Disclosure | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without notification, we don't know integrity has been lost, and adversary gains a foothold. | CRWG Yellow Criticality Control | Constantly | Automated | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | DLP | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| AU-13(1) | Monitoring for Information Disclosure | Use of Automated Tools | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without notification, we don't know integrity has been lost, and adversary gains a foothold. | CRWG Yellow Criticality Control | Constantly | Automated | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | DLP | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| CA-3 | System Interconnections | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| CA-3(1) | System Interconnections | Unclassified National Security System Connections | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| CA-3(2) | System Interconnections | Classified National Security System Connections | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| CA-3(3) | System Interconnections | Unclassified Non-National Security System Connections | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| CA-3(5) | System Interconnections | Restrictions on External Network Connections | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If the selection were, for example, deny all permits by exception and we suddenly lost that control, there is a high potential that previously denied traffic (because it is dangerous traffic) would be allowed. Adversaries could be making their way in enfettered, and we be operating as if they're blocked. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| CA-6 | Security Authorization | The control will be changed to yellow. The cause of the lapse in authorization needs to be identified and determination made if the AO needs to advised. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide | ||
| CA-9 | Internal System Connections | The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. While this is something the organization does, if we do not identify what types of new and potentially dangerous devices (e.g., smart phones, tablets) may or may not be connected in whatever configuration, users may believe that at will they may connect their devices, presumable with few if any protections employed. These devices then become an attack vector for our adversaries. | CRWG Yellow Criticality Control | Annually | Manual | via telephone or e-mail, the system-level ISSM reports to the cybersecurity chain of command, and after appropriate (but not prolonged) investigation into the severity/urgency of the situation, the AO is advised and provided an authorization/connection decision recommendation | POAM | Attributes for Criticality, Frequency, Method, Reporting, and Tracking are selected per guidance from DoD Guide for Developing a System-Level Continuous Monitoring Strategy and the DHA System-Level Continuous Monitoring of Security Controls Guide |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .