DRAFT SAM 2023 12 Ascend BPA Appendix XX Information References and Tools.pdf

Appendix <<XX>>: Information, References, and Tools

Table XX: Information, References, and Tools

Global Electronics Council (GEC)

XX Global Electronics Council https://globalelectronicscouncil.org/

XX EPEAT Registry https://www.epeat.net/

The Linux Foundation

XX The Linux Foundation https://www.linuxfoundation.org/

— Software Package Data Exchange® (SPDX®)

XX The Software Package Data Exchange®

(SPDX®)

https://spdx.dev/

MITRE Corporation

XX ATT&CK https://attack.mitre.org/

XX CVE(R)Program https://cve.mitre.org/

North American Electric Reliability Corporation (NERC)

XX Midwest Reliability Organization (MRO) https://mro.net/

XX NERC https://www.nerc.com

XX NERC Interconnections https://www.nerc.com/AboutNERC/k eyplayers/PublishingImages/NERC %20Interconnections.pdf

XX Northeast Power Coordinating Council

(NPCC)

https://www.npcc.org/

XX ReliabilityFirst (RF) https://rfirst.org/

XX SERC Reliability Corporation (SERC) https://www.serc1.org/

XX Texas Reliability Entity (Texas RE) https://www.texasre.org/

XX Western Electricity Coordinating Council

(WECC)

https://www.wecc.org/

Open Worldwide Application Security Project® (OWASP)

Sam ple

Draf t https://globalelectronicscouncil.org/ https://www.epeat.net/ https://www.linuxfoundation.org/ https://spdx.dev/ https://attack.mitre.org/ https://cve.mitre.org/ https://mro.net/ https://www.nerc.com/ https://www.nerc.com/AboutNERC/keyplayers/PublishingImages/NERC%20Interconnections.pdf https://www.nerc.com/AboutNERC/keyplayers/PublishingImages/NERC%20Interconnections.pdf https://www.nerc.com/AboutNERC/keyplayers/PublishingImages/NERC%20Interconnections.pdf https://www.npcc.org/ https://rfirst.org/ https://www.serc1.org/ https://www.texasre.org/ https://www.wecc.org/

Table XX: Information, References, and Tools

XX Open Worldwide Application Security Project® (OWASP) https://owasp.org/

— CycloneDX

XX CycloneDX https://cyclonedx.org/

United States Federal Government

— Acquisitions.gov

XX Acqusitions.gov https://www.acquisition.gov/

XX Category Management Leadership Council (CMLC) https://www.acquisition.gov/content/ category-management

XX Federal Acquisition Regulation (FAR) https://www.acquisition.gov/browse/i ndex/far

XX General Services Acquisition Manual

(GSAM)

https://www.acquisition.gov/browse/i ndex/gsam

XX Product and Service Code Manual https://www.acquisition.gov/psc-man ual

— Department of Commerce

— — National Telecommunications and Information Administration (NTIA)

XX Software Bill of Materials https://ntia.gov/page/software-bill-m aterials

— Department of Defense (DoD)

XX DoD Cloud Computing Security Requirements Guide (DoD CC SRG) https://public.cyber.mil/dccs/dccs-do cuments/

XX DoD Cloud Strategy https://dodcio.defense.gov/Library/

XX DoD Outside the Continental United States (OCONUS) Cloud Strategy https://dodcio.defense.gov/Library/

XX DoD Zero Trust Reference Architecture https://dodcio.defense.gov/Library/

XX DoDD 8140.01 Cyberspace Workforce Management https://www.esd.whs.mil/Directives/i ssuances/dodd/

XX DoDI 5200.48: Controlled Unclassified Information (CUI) https://www.esd.whs.mil/Directives/i ssuances/dodi/ https://owasp.org/ https://cyclonedx.org/ https://www.acquisition.gov/ https://www.acquisition.gov/content/category-management https://www.acquisition.gov/content/category-management https://www.acquisition.gov/browse/index/far https://www.acquisition.gov/browse/index/far https://www.acquisition.gov/browse/index/gsam https://www.acquisition.gov/browse/index/gsam https://www.acquisition.gov/psc-manual https://www.acquisition.gov/psc-manual https://ntia.gov/page/software-bill-materials https://ntia.gov/page/software-bill-materials https://public.cyber.mil/dccs/dccs-documents/ https://public.cyber.mil/dccs/dccs-documents/ https://dodcio.defense.gov/Library/ https://dodcio.defense.gov/Library/ https://dodcio.defense.gov/Library/ https://www.esd.whs.mil/Directives/issuances/dodd/ https://www.esd.whs.mil/Directives/issuances/dodd/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/

XX DoDI 5220.22: National Industrial Security Program (NISP) https://www.esd.whs.mil/Directives/i ssuances/dodi/

XX DoDI 8500.01: Cybersecurity https://www.esd.whs.mil/Directives/i ssuances/dodi/

XX DoDI 8510.01: Risk Management Framework (RMF) for DoD Information Technology (IT) https://www.esd.whs.mil/Directives/i ssuances/dodi/

XX DoDI 8582.01: Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information https://www.esd.whs.mil/Directives/i ssuances/dodi/

XX DoDM 5220.32, Volume 1 National Industrial Security Program: Industrial Security Procedures for Government Activities https://www.esd.whs.mil/Directives/i ssuances/dodm/

XX DoDM 5220.32, Volume 2 National Industrial Security Program: Procedures for Government Activities Relating to Foreign Ownership, Control, or Influence

(FOCI)

https://www.esd.whs.mil/Directives/i ssuances/dodm/

XX DoDM 5400.07, DoD Freedom Of Information Act (FOIA) Program https://www.esd.whs.mil/Directives/i ssuances/dodm/

XX DoDM 8570.01-M Information Assurance Workforce Improvement Program https://www.esd.whs.mil/Directives/i ssuances/dodm/

XX Office of the Director, Operational Test and Evaluation https://www.dote.osd.mil

XX US Cyber Command https://www.cybercom.mil/

—— Defense Counterintelligence and Security Agency (DCSA)

XX Defense Counterintelligence and Security Agency (DCSA) https://www.dcsa.mil/

XX.X Central Verification System (CVS) https://www.dcsa.mil/Systems-Appli cations/Central-Verification-System-

CVS/

XX.X Defense Information System for Security

(DISS)

https://www.dcsa.mil/Systems-Appli cations/Defense-Information-Syste m-for-Security-DISS/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.dote.osd.mil https://www.cybercom.mil/ https://www.dcsa.mil/ https://www.dcsa.mil/Systems-Applications/Central-Verification-System-CVS/ https://www.dcsa.mil/Systems-Applications/Central-Verification-System-CVS/ https://www.dcsa.mil/Systems-Applications/Central-Verification-System-CVS/ https://www.dcsa.mil/Systems-Applications/Defense-Information-System-for-Security-DISS/ https://www.dcsa.mil/Systems-Applications/Defense-Information-System-for-Security-DISS/ https://www.dcsa.mil/Systems-Applications/Defense-Information-System-for-Security-DISS/

XX.X Facility Clearance https://www.dcsa.mil/Industrial-Secu rity/Entity-Vetting-Facility-Clearance s-FOCI/Facility-Clearances/

XX.X National Industrial Security Program

(NISP)

https://www.dcsa.mil/Industrial-Secu rity/

Personnel Security https://www.dcsa.mil/Personnel-Sec urity/

—— Defense Information Systems Agency (DISA)

XX DISA https://disa.mil/

——— Department of Defense Cloud Authorization Services (DCAS)

XX Comply-to-Connect (C2C) Program Office [Pending DISA URL]

XX DCAS Authorized Commercial Cloud Services https://storefront.disa.mil/kinetic/disa /service-catalog#/forms/cloud-servic e-support

—— Department of Defense Cyber Crime Center (DC3)

XX Department of Defense Cyber Crime Center (DC3) https://www.dc3.mil/

XX.X Defense Industrial Base (DIB) Collaborative Information Sharing Environment (DCISE) https://www.dc3.mil/Missions/DIB-C ybersecurity/DIB-Cybersecurity-DCI

SE/

XX.X Defense Industrial Base (DIB) Cybersecurity Portal https://dibnet.dod.mil/portal/intranet/

XX.X Defense Industrial Base (DIB) Cybersecurity (CS) Program https://dibnet.dod.mil/portal/intranet/

XX.X Defense Industrial Base (DIB) Cyber Reports https://dibnet.dod.mil/portal/intranet

—— United States Air Force (USAF)

XX Sixteenth Air Force (Air Forces Cyber) https://www.16af.af.mil

—— United States Army (USA)

XX US Army Cyber Command http://www.arcyber.army.mil

——— Department of the Army, G-2 Intelligence https://www.dcsa.mil/Industrial-Security/Entity-Vetting-Facility-Clearances-FOCI/Facility-Clearances/ https://www.dcsa.mil/Industrial-Security/Entity-Vetting-Facility-Clearances-FOCI/Facility-Clearances/ https://www.dcsa.mil/Industrial-Security/Entity-Vetting-Facility-Clearances-FOCI/Facility-Clearances/ https://www.dcsa.mil/Industrial-Security/ https://www.dcsa.mil/Industrial-Security/ https://www.dcsa.mil/Personnel-Security/ https://www.dcsa.mil/Personnel-Security/ https://disa.mil/ https://storefront.disa.mil/kinetic/disa/service-catalog#/forms/cloud-service-support https://storefront.disa.mil/kinetic/disa/service-catalog#/forms/cloud-service-support https://storefront.disa.mil/kinetic/disa/service-catalog#/forms/cloud-service-support https://www.dc3.mil/ https://www.dc3.mil/Missions/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/ https://www.dc3.mil/Missions/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/ https://www.dc3.mil/Missions/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/ https://dibnet.dod.mil/portal/intranet/ https://dibnet.dod.mil/portal/intranet/ https://dibnet.dod.mil/portal/intranet/ https://www.16af.af.mil http://www.arcyber.army.mil/

XX Scattered Castles https://www.dami.army.pentagon.mil /site/sci/ScatCastles.aspx

—— United States Navy (USN)

XX US Fleet Cyber Command https://www.fcc.navy.mil

——— US Marine Corps (USMC)

XX Marine Corps Forces Cyberspace Command https://www.marforcyber.marines.mil

— Department of Homeland Security (DHS)

XX REAL ID https://www.dhs.gov/real-id

—— Cybersecurity & Infrastructure Security Agency (CISA)

XX AMAC Malware Analysis Submissions https://www.malware.us-cert.gov

XX Continuous Diagnostic and Mitigation Program https://www.cisa.gov/cdm

XX Coordinated Vulnerability Disclosure Program https://www.cisa.gov/coordinated-vu lnerability-disclosure-process

XX Critical Infrastructure Sectors https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors

XX.X Chemical Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/chemi cal-sector

XX.X Commercial Facilities Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/comm ercial-facilities-sector

XX.X Communications Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/comm unications-sector

XX.X Critical Manufacturing Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/critical -manufacturing-sector https://www.dami.army.pentagon.mil/site/sci/ScatCastles.aspx https://www.dami.army.pentagon.mil/site/sci/ScatCastles.aspx https://www.fcc.navy.mil/ https://www.dhs.gov/real-id https://www.malware.us-cert.gov/ https://www.cisa.gov/cdm https://www.cisa.gov/coordinated-vulnerability-disclosure-process https://www.cisa.gov/coordinated-vulnerability-disclosure-process https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/chemical-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/chemical-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/chemical-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/chemical-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/commercial-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/commercial-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/commercial-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/commercial-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/critical-manufacturing-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/critical-manufacturing-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/critical-manufacturing-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/critical-manufacturing-sector

XX.X Dams Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/dams-sector

XX.X Defense Industrial Base Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/defens e-industrial-base-sector

XX.X Emergency Services Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/emerg ency-services-sector

XX.X Energy Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/energ y-sector

XX.X Financial Services Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/financi al-services-sector

XX.X Food and Agriculture Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/food-a nd-agriculture-sector

XX.X Government Facilities Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/gover nment-facilities-sector

XX.X Healthcare and Public Health Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/health care-and-public-health-sector

XX.X Information Technology Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/inform ation-technology-sector

XX.X Nuclear Reactors, Materials, and Waste Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/nuclea r-reactors-materials-and-waste-sect https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/dams-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/dams-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/dams-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/dams-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/defense-industrial-base-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/defense-industrial-base-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/defense-industrial-base-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/defense-industrial-base-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/emergency-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/emergency-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/emergency-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/emergency-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/financial-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/financial-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/financial-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/financial-services-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-facilities-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/information-technology-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/information-technology-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/information-technology-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/information-technology-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/nuclear-reactors-materials-and-waste-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/nuclear-reactors-materials-and-waste-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/nuclear-reactors-materials-and-waste-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/nuclear-reactors-materials-and-waste-sector or

XX.X Transportation Systems Sector https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/transp ortation-systems-sector

XX.X Water and Wastewater Systems https://www.cisa.gov/topics/critical-i nfrastructure-security-and-resilience /critical-infrastructure-sectors/water-and-wastewater-sector

XX Cyber Information Sharing and Collaboration Program (CISCP) https://www.cisa.gov/ciscp

XX Cyber Threat Indicator and Defensive Measure Submission System https://us-cert.cisa.gov/forms/share-i ndicators

XX EINSTEIN https://www.cisa.gov/einstein

XX Guidance on Consent Banners https://www.cisa.gov/resources-tool s/resources/guidance-consent-bann ers

XX Incident Reporting System https://us-cert.cisa.gov/forms/report

XX Moving the U.S. Government Toward Zero Trust Cybersecurity Principles https://zerotrust.cyber.gov/

XX National Cybersecurity Protection System

(NCPS)

https://www.cisa.gov/resources-tool s/programs/national-cybersecurity-p rotection-system

XX.X NCPS Cloud Interface Reference Architecture (NCIRA) https://www.cisa.gov/resources-tool s/resources/national-cybersecurity-p rotection-system-documents

XX.X

.X

NCPS Cloud Interface Reference Architecture Volume 1 https://www.cisa.gov/resources-tool s/resources/national-cybersecurity-p rotection-system-documents

XX.X

.X

[Draft] NCPS Cloud Interface Reference Architecture Volume 2 https://www.cisa.gov/resources-tool s/resources/national-cybersecurity-p rotection-system-documents

XX Post-Quantum Cryptography Initiative https://www.cisa.gov/quantum

XX Secure by Design, Secure by Default https://www.cisa.gov/securebydesig n https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/nuclear-reactors-materials-and-waste-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector https://www.cisa.gov/ciscp https://us-cert.cisa.gov/forms/share-indicators https://us-cert.cisa.gov/forms/share-indicators https://www.cisa.gov/einstein https://www.cisa.gov/resources-tools/resources/guidance-consent-banners https://www.cisa.gov/resources-tools/resources/guidance-consent-banners https://www.cisa.gov/resources-tools/resources/guidance-consent-banners https://us-cert.cisa.gov/forms/report https://zerotrust.cyber.gov/ https://www.cisa.gov/resources-tools/programs/national-cybersecurity-protection-system https://www.cisa.gov/resources-tools/programs/national-cybersecurity-protection-system https://www.cisa.gov/resources-tools/programs/national-cybersecurity-protection-system https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/resources-tools/resources/national-cybersecurity-protection-system-documents https://www.cisa.gov/quantum https://www.cisa.gov/securebydesign https://www.cisa.gov/securebydesign

XX.X Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default https://www.cisa.gov/resources-tool s/resources/secure-by-design-and-d efault

XX Trusted Internet Connections https://www.cisa.gov/resources-tool s/programs/trusted-internet-connecti ons-tic

XX.X Trusted Internet Connections (TIC) 3.0 Core Guidance Documents https://www.cisa.gov/resources-tool s/resources/trusted-internet-connect ions-tic-30-core-guidance-document s

XX.X Trusted Internet Connections 3.0 Cloud Use Case https://www.cisa.gov/resources-tool s/resources/trusted-internet-connect ions-tic-30-core-guidance-document s

XX US-CERT https://www.cisa.gov/uscert/

XX US-CERT Federal Incident Notification Guidelines https://www.cisa.gov/uscert/incident-notification-guidelines

—— Federal Emergency Management Agency (FEMA)

XX Declared Disasters https://www.fema.gov/disaster/decla rations

XX National Flood Hazard Layer https://www.fema.gov/flood-maps/na tional-flood-hazard-layer

— Department of Justice

XX FOIA.gov https://www.foia.gov/

— Department of the Treasury

XX Office of Foreign Assets Control - Sanctions Programs and Information https://home.treasury.gov/policy-issu es/office-of-foreign-assets-control-s anctions-programs-and-information

XX Sanctions Programs and Country Information https://home.treasury.gov/policy-issu es/financial-sanctions/sanctions-pro grams-and-country-information

— Department of State

XX State Sponsors of Terrorism https://www.state.gov/state-sponsor s-of-terrorism/ https://www.cisa.gov/resources-tools/resources/secure-by-design-and-default https://www.cisa.gov/resources-tools/resources/secure-by-design-and-default https://www.cisa.gov/resources-tools/resources/secure-by-design-and-default https://www.cisa.gov/resources-tools/programs/trusted-internet-connections-tic https://www.cisa.gov/resources-tools/programs/trusted-internet-connections-tic https://www.cisa.gov/resources-tools/programs/trusted-internet-connections-tic https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/uscert/ https://www.cisa.gov/uscert/incident-notification-guidelines https://www.cisa.gov/uscert/incident-notification-guidelines https://www.fema.gov/disaster/declarations https://www.fema.gov/disaster/declarations https://www.fema.gov/flood-maps/national-flood-hazard-layer https://www.fema.gov/flood-maps/national-flood-hazard-layer https://www.foia.gov/ https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information https://www.state.gov/state-sponsors-of-terrorism/ https://www.state.gov/state-sponsors-of-terrorism/

— Environmental Protection Agency (EPA)

XX Certified Electronic Recyclers https://www.epa.gov/smm-electronic s/certified-electronics-recyclers

XX ENERGY STARⓇ https://www.energystar.gov/

XX.X ENERGY STARⓇ, Data Centers https://www.energystar.gov/products /data_centers

XX Electronic Product Environmental Assessment Tool (EPEAT) https://www.epa.gov/greenerproduct s/electronic-product-environmental-assessment-tool-epeat

XX Hazardous Waste Electronic Manifest (e-Manifest) https://www.epa.gov/e-manifest

— Federal Risk and Authorization Management Program (FedRAMP)

XX FedRAMP https://www.fedramp.gov/

XX FedRAMP Marketplace https://marketplace.fedramp.gov/

— General Services Administration (GSA)

XX Acquisition Gateway https://hallways.cap.gsa.gov/

XX.X Acquisition Gateway - Best In Class https://hallways.cap.gsa.gov/app/#/g ateway/category-management?tid=

XX.X Acquisition Gateway - Category Management https://hallways.cap.gsa.gov/app/#/g ateway/category-management

XX Acquisition Policy https://www.gsa.gov/policy-regulatio ns/policy/acquisition-policy-overview

XX.X Eligibility Determinations https://www.gsa.gov/policy-regulatio ns/policy/acquisition-policy/eligibility -determinations

XX Contractor Performance Assessment Reporting System (CPARS) https://www.cpars.gov/

XX.X Guidance for the Contractor Performance Assessment Reporting System (CPARS) https://www.cpars.gov/help.htm

XX Cooperative Purchasing Program https://www.gsa.gov/buying-selling/p urchasing-programs/gsa-schedule/s chedule-buyers/state-and-local-gov https://www.epa.gov/smm-electronics/certified-electronics-recyclers https://www.epa.gov/smm-electronics/certified-electronics-recyclers https://www.energystar.gov/ https://www.energystar.gov/products/data_centers https://www.energystar.gov/products/data_centers https://www.epa.gov/greenerproducts/electronic-product-environmental-assessment-tool-epeat https://www.epa.gov/greenerproducts/electronic-product-environmental-assessment-tool-epeat https://www.epa.gov/greenerproducts/electronic-product-environmental-assessment-tool-epeat https://www.epa.gov/e-manifest https://www.fedramp.gov/ https://marketplace.fedramp.gov/ https://hallways.cap.gsa.gov/ https://hallways.cap.gsa.gov/app/#/gateway/category-management?tid=9371 https://hallways.cap.gsa.gov/app/#/gateway/category-management?tid=9371 https://hallways.cap.gsa.gov/app/#/gateway/category-management?tid=9371 https://hallways.cap.gsa.gov/app/#/gateway/category-management https://hallways.cap.gsa.gov/app/#/gateway/category-management https://www.gsa.gov/policy-regulations/policy/acquisition-policy-overview https://www.gsa.gov/policy-regulations/policy/acquisition-policy-overview https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations https://www.gsa.gov/policy-regulations/policy/acquisition-policy/eligibility-determinations https://www.cpars.gov/ https://www.cpars.gov/help.htm https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/cooperative-purchasing https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/cooperative-purchasing https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/cooperative-purchasing ernments/cooperative-purchasing

XX Disaster Purchasing Program https://www.gsa.gov/buying-selling/p urchasing-programs/gsa-schedule/s chedule-buyers/state-and-local-gov ernments/state-and-local-disaster-p urchasing

XX eBuy https://www.ebuy.gsa.gov/ebuy/

XX eOffer / eMod https://eoffer.gsa.gov

XX Interact https://buy.gsa.gov/interact/

XX.X Cloud and Software Community https://buy.gsa.gov/interact/commun ity/205/activity-feed

XX Order Level Materials (OLM) https://www.gsa.gov/buying-selling/p urchasing-programs/gsa-schedule/s chedule-features/orderlevel-material s-olms

XX Public Health Emergencies Program https://www.gsa.gov/buying-selling/p urchasing-programs/gsa-schedule/s chedule-buyers/state-and-local-gov ernments/public-health-emergencie s-program

XX Transaction Data Reporting (TDR) https://vsc.gsa.gov/TDR/

XX Verified Products Portal (VPP) www.gsa.gov/vpp

XX Zero Trust Architecture (ZTA) Buyer's Guide Version 1.0 June 2021 https://www.gsa.gov/cdnstatic/Zero %20Trust%20Architecture%20Buye rs%20Guide%20v11%2020210610 %20(2).pdf

— Health and Human Services (HHS)

XX Public Health Emergency Declarations https://www.phe.gov/emergency/ne ws/healthactions/phe/Pages/default.

aspx

— Office of the Director of National Intelligence (ODNI)

XX Office of the Director of National Intelligence https://www.dni.gov/

— Office of Federal Procurement Policy (OFPP) https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/cooperative-purchasing https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/state-and-local-disaster-purchasing https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/state-and-local-disaster-purchasing https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/state-and-local-disaster-purchasing https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/state-and-local-disaster-purchasing https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/state-and-local-disaster-purchasing https://www.ebuy.gsa.gov/ebuy/ https://eoffer.gsa.gov https://buy.gsa.gov/interact/ https://buy.gsa.gov/interact/community/205/activity-feed https://buy.gsa.gov/interact/community/205/activity-feed https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-features/orderlevel-materials-olms https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-features/orderlevel-materials-olms https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-features/orderlevel-materials-olms https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-features/orderlevel-materials-olms https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/public-health-emergencies-program https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/public-health-emergencies-program https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/public-health-emergencies-program https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/public-health-emergencies-program https://www.gsa.gov/buying-selling/purchasing-programs/gsa-schedule/schedule-buyers/state-and-local-governments/public-health-emergencies-program https://vsc.gsa.gov/TDR/ http://www.gsa.gov/vpp https://www.gsa.gov/cdnstatic/Zero%20Trust%20Architecture%20Buyers%20Guide%20v11%2020210610%20(2).pdf https://www.gsa.gov/cdnstatic/Zero%20Trust%20Architecture%20Buyers%20Guide%20v11%2020210610%20(2).pdf https://www.gsa.gov/cdnstatic/Zero%20Trust%20Architecture%20Buyers%20Guide%20v11%2020210610%20(2).pdf https://www.gsa.gov/cdnstatic/Zero%20Trust%20Architecture%20Buyers%20Guide%20v11%2020210610%20(2).pdf https://www.phe.gov/emergency/news/healthactions/phe/Pages/default.aspx https://www.phe.gov/emergency/news/healthactions/phe/Pages/default.aspx https://www.phe.gov/emergency/news/healthactions/phe/Pages/default.aspx https://www.dni.gov/

XX Emergency Acquisitions Guide https://www.whitehouse.gov/omb/m anagement/office-federal-procureme nt-policy/

— National Archives

XX Controlled Unclassified Information (CUI) https://www.archives.gov/cui

XX Controlled Unclassified Information (CUI) Categories https://www.archives.gov/cui/registry /category-list

XX Controlled Unclassified Information (CUI) Markings List https://www.archives.gov/cui/registry /category-marking-list

XX Marking Classified National Security Information https://www.archives.gov/isoo/trainin g/training-aids

— National Institute of Standards and Technology (NIST)

XX Internet Time Service (ITS) https://www.nist.gov/pml/time-and-fr equency-division/time-distribution/int ernet-time-service-its

XX National Vulnerability Database (NVD) https://nvd.nist.gov/

XX Security Content Automation Protocol

(SCAP)

https://csrc.nist.gov/projects/Securit y-Content-Automation-Protocol

XX SWID Tag Validation Tool https://csrc.nist.gov/projects/softwar e-identification-swid/resources

XX USGv6 Program https://www.nist.gov/programs-proje cts/usgv6-program

— National Security Agency / Central Security Service (NSA / CSS)

XX National Security Agency https://www.nsa.gov/

XX NSA Cybersecurity Collaboration Center https://www.nsa.gov/About/Cyberse curity-Collaboration-Center/

— System for Award Management (SAM)

XX System for Award Management (SAM.gov) https://sam.gov/

XX Service Contract Reporting (SCR) https://sam.gov/content/entity-report ing

— Section508.gov https://www.whitehouse.gov/omb/management/office-federal-procurement-policy/ https://www.whitehouse.gov/omb/management/office-federal-procurement-policy/ https://www.whitehouse.gov/omb/management/office-federal-procurement-policy/ https://www.archives.gov/cui https://www.archives.gov/cui/registry/category-list https://www.archives.gov/cui/registry/category-list https://www.archives.gov/cui/registry/category-marking-list https://www.archives.gov/cui/registry/category-marking-list https://www.archives.gov/isoo/training/training-aids https://www.archives.gov/isoo/training/training-aids https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its https://nvd.nist.gov/ https://csrc.nist.gov/projects/Security-Content-Automation-Protocol https://csrc.nist.gov/projects/Security-Content-Automation-Protocol https://csrc.nist.gov/projects/software-identification-swid/resources https://csrc.nist.gov/projects/software-identification-swid/resources https://www.nist.gov/programs-projects/usgv6-program https://www.nist.gov/programs-projects/usgv6-program https://www.nsa.gov/ https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/ https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/ https://sam.gov/ https://sam.gov/content/entity-reporting https://sam.gov/content/entity-reporting

XX Section508.gov https://www.section508.gov/

XX Sell Accessible Products and Services https://www.section508.gov/sell/

XX Voluntary Product Accessibility Template

(VPAT(™))

https://www.section508.gov/sell/vpat https://www.section508.gov/ https://www.section508.gov/sell/ https://www.section508.gov/sell/vpat/