Task 2 RMF_Program Management Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Program Management Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information Technology (IT)"

ii. DoD Instruction 8500.01, "Cybersecurity", as amended

iii. Committee on National Security Systems (CNSS) Instruction No. 1253, " Security Categorization and Control Selection for National Security Systems"

iv. NIST Special Publication 800-55 Revision 1a, “Performance Measurement Guide for Information Security”

Table of Contents

Table 1 - SP-800-53v4 Compliance Matrix 1

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

PROGRAM MANAGEMENT PLAN

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The objective of program management is to ensure that security considerations are planned for early and handled consistently in the project lifecycle.

The DoD has established an integrated enterprise-wide decision structure for cybersecurity risk management (the Risk Management Framework (RMF)) that includes cybersecurity requirements for DoD information technologies will be managed through the RMF consistent with the principals established in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37.

This plan ensures that {ACRONYM} follows the established guidelines and requirements for program management. The formal System Security Plan is documented separately. The purpose of this document is to consolidate information and provide traceability to security control requirements.

The following subject areas are considered Tier-1 requirements and are covered at the DoD level:

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

2.0 INFORMATION SECURITY RESOURCES

Increased competition for limited federal budgets and resources requires that system owners allocate available funding toward their highest-priority information security investments to ensure the appropriate degree of security for their needs.

Do planning and investment requests include the resources needed to implement the information security program for {ACRONYM}?

☐ No

☐ Yes

Is an OMB Exhibit 300 required for {ACRONYM}?

☐ No

☐ Yes

If Yes, has the OMB Exhibit 300 been approved?

☐ No

☐ Yes

Are information security resources available for expenditure as planned for {ACRONYM}?

☐ No

☐ Yes

3.0 PLAN OF ACTION AND MILESTONES PROCESS

The Plan of Action and Milestones (POA&M) is a key document in the {ACRONYM} information security program and is subject to federal reporting requirements established by OMB. With the increasing emphasis on organization-wide risk management across all three tiers in the risk management hierarchy (i.e., organization, mission/business process, and information system), organizations view POA&Ms from an organizational perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. POA&M updates are based on findings from security control assessments and continuous monitoring activities.

The following process is used by {ACRONYM} to ensure compliance with POA&M requirements:

1. The POA&M is required and will be maintained in eMASS

2. The POA&M will be updated based on assessment and continuous monitoring activities. At a minimum, the eMASS PO&AM will be updated quarterly

3. All ongoing findings in the POA&M will contain an adequate risk mitigation

4. PO&AM reporting will be executed in accordance with higher-level guidance

5. All {ACRONYM} stakeholders will review the POA&M annually to ensure consistency

4.0 INFORMATION SYSTEM INVENTORY

The {ACRONYM} inventory is contained within the Hardware and Software lists. The {ACRONYM} is maintained by the Configuration Control Board (CCB). {ACRONYM} does not have OMB or annual FISMA reporting requirements for its inventory.

5.0 INFORMATION SECURITY MEASURES OF PERFORMANCE

The requirement to measure information security performance is driven by regulatory, financial, and organizational reasons. A number of existing laws, rules, and regulations cite information performance measurement in general, and information security performance measurement in particular, as a requirement. These laws include the Clinger-Cohen Act, the Government Performance and Results Act (GPRA), the Government Paperwork Elimination Act (GPEA), and the Federal Information Security Management Act (FISMA).

Information security measures are used to facilitate decision making and improve performance and accountability through the collection, analysis, and reporting of relevant performance-related data. The purpose of measuring performance is to monitor the status of measured activities and facilitate improvement in those activities by applying corrective actions based on observed measurements.

5.1 Roles and Responsibilities

This section outlines the key roles and responsibilities for developing and implementing information security measures.

Program Manager / Information System Owner Program managers, as well as information system owners, are responsible for ensuring that proper security controls are in place to address the confidentiality, integrity, and availability of information and information systems. The program manager/information system owner has the following responsibilities related to information security measurement:

· Participating in information security measurement program development and implementation by providing feedback on the feasibility of data collection and identifying data sources and repositories;

· Educating staff on the development, collection, analysis, and reporting of information security measures and how it will affect information security policy, requirements, resource allocation, and budget decisions;

· Ensuring that measurement data is collected consistently and accurately and is provided to designated staff who are analyzing and reporting the data;

· Directing full participation and cooperation of staff, when required;

· Reviewing information security measures data regularly and using it for policy, resource allocation, and budget decisions; and

· Supporting implementation of corrective actions, identified through measuring information security performance.

Information System Security Officer (ISSO) The ISSO has the following responsibilities related to information security measurement:

· Participating in information security measurement program development and implementation by providing feedback on the feasibility of data collection and identifying data sources and repositories; and

· Collecting data or providing measurement data to designated staff that are collecting, analyzing, and reporting the data.

5.2 Types of Measures

The following types of measures will be maintained:

· Implementation Measures - used to demonstrate progress in implementing information security programs, specific security controls, and associated policies and procedures. Examples of implementation measures related to information security programs include the percentage of information systems with approved system security plans and the percentage of information systems with password policies configured as required.

· Effectiveness/efficiency Measures - used to monitor if program-level processes and system- level security controls are implemented correctly, operating as intended, and meeting the desired outcome. These measures concentrate on the evidence and results of assessments and may require multiple data points quantifying the degree to which information security controls are implemented and the resulting effect(s) on the organization’s information security posture. For example, the percentage of enterprise operating system vulnerabilities for which patches have been applied or that have been otherwise mitigated is both an implementation and effectiveness measure.

· Impact Measures - used to articulate the impact of information security on an organization’s mission. These measures are inherently organization-specific since each organization has a unique mission.

The following sources will contain information from which measures data will be generated:

· System Security Plans;

· Plan of Action and Milestones (POA&M) reports;

· Latest CCRI and IG findings;

· Tracking of information security-related activities, such as incident handling and reporting, testing, network management, audit logs, and network and information system billing;

· Risk assessments and penetration testing results;

· C&A documentation (e.g., security assessment reports);

· Continuous monitoring results;

· Contingency plans;

· Configuration management plans; and

· Training results and statistics.

5.3 Tracked Measures

{ACRONYM} utilizes measures of performance to determine the effectiveness or efficiency of the {ACRONYM} information security program and the security controls employed in support of {ACRONYM}. Enclosure 1 contains the reportable measures used by {ACRONYM}.

6.0 MISSION/BUSINESS PROCESS DEFINITION

Information protection needs determine the required security controls for {ACRONYM}. Inherent in defining the {ACRONYM} information protection needs is an understanding of the level of adverse impact that could result if a compromise of information occurs. The security categorization process is used to make such potential impact determinations. Mission/business process definitions and associated information protection requirements are documented by the organization in accordance with organizational policy and procedure. Step 1, “System Categorization” contains the information protection requirements and impacts for {ACRONYM}.

7.0 INSIDER THREAT PROGRAM

The {ACRONYM} Insider threat program leverages the existing of incident handling teams already have in place.

8.0 TESTING, TRAINING, AND MONITORING

The {ACRONYM} Continuous Monitoring Strategy implements the process for the required security testing, training, and monitoring activities.

9.0 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS

Ongoing contact with security groups and associations is of paramount importance in an environment of rapidly changing technologies and threats.

{ACRONYM} personnel collaborate with the {ACRONYM} Cyber Security team to:

1. facilitate ongoing security education and training

2. maintain currency with recommended security practices, techniques, and technologies

3. share current security-related information including threats, vulnerabilities, and incidents

10.0 THREAT AWARENESS PROGRAM

The constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it is becoming more likely. One of the best techniques to address this concern is for {ACRONYM} to share threat information.

{ACRONYM} personnel collaborate with the {ACRONYM} Cyber Security team to share threat information.

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to manage the security authorization process.

DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to manage the security authorization process.

DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to manage the security authorization process.

DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to designate roles and responsibilities for the risk management process.

DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to fully integrate the security authorization process.

DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to define mission/business processes.

DoD components are automatically complaint with this control as they are covered at the DoD level, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High DoD 8570.01-M meets the DoD requirement to establish an information security workforce development and improvement program.

DoD components are automatically complaint with this control as they are covered at the DoD level, DoDI 8570.01-M.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 and the Knowledge Service meet the DoD requirements to develop a process for plans of action and milestones for the security program.

DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 and the Knowledge Service meet the DoD requirements to maintain a process for plans of action and milestones for the security program.

DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 and the Knowledge Service meet the DoD requirements to maintain a process to document the remedial information security actions that mitigate risk to organizational operations and assets, individuals, other organizations, and the Nation.

DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDI 8510.01 and the Knowledge Service meet the DoD requirements to implement a process ensuring that the plans of action and milestones for the security program are reported in accordance with OMB FISMA reporting requirements.

DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High DITPR is the inventory for all DoD information systems.

The organization conducting the inspection/assessment obtains and examines the inventory of information systems via DITPR to ensure the organization being inspected/assessed registers their information systems in DITPR.

Section 4

Moderate High Low Moderate High Low Moderate High The Federal Information Systems Management Act (FISMA) meets the DoD requirements for information security performance measures of performance.

DoD organizations are automatically compliant with this control as they are covered at the DoD level by FISMA.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High The Federal Information Systems Management Act (FISMA) meets the DoD requirements for information security performance measures of performance.

DoD organizations are automatically compliant with this control as they are covered at the DoD level by FISMA.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High

Moderate High Low Moderate High Low Moderate High The GIG IA Architecture meets the DoD requirements for enterprise architecture.

DoD components are automatically compliant with this CCI as they covered at the DoD level.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDD 3020.40 meets the DoD requirement for the development of a critical infrastructure and key resource protection plan.

DoD components are automatically compliant with this control as they are covered by the DoD level, DoDD 3020.40.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoDD 3020.40 meets the DoD requirement for the development of a critical infrastructure and key resource protection plan.

DoD components are automatically compliant with this control as they are covered by the DoD level, DoDD 3020.40.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.

DoD components are automatically compliant with this CCI because they are covered by DoD Risk Management Framework (DoDI 8510.01).

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.

DoD components are automatically compliant with this CCI because they are covered by DoD Risk Management Framework (DoDI 8510.01).

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.

DoD components are automatically compliant with this CCI because they are covered by DoD Risk Management Framework (DoDI 8510.01).

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Low Moderate High Low Moderate High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance Automatically compliant with this CCI because they are covered at the DoD level

ENCLOSURE 1 – INFORMATION SECURITY MEASURES

*100

2. Number of high vulnerabilities mitigated.

Collection Frequency: Monthly Reporting Frequency: Monthly

VRAM

Reporting Frequency: Yearly

ISO

ISSO

Training and awareness tracking records

2. Are audit logs reviewed daily?

Collection Frequency: Daily Reporting Frequency: Monthly

Reporting Frequency: Monthly

Reporting Frequency: Quarterly

ISO

ISSO

Change Requests Scans

Reporting Frequency: Yearly

ISO

ISSO

CP Test Artifact Lessons Learned

Reporting Frequency: Quarterly

ISO

ISSO

Scans Interview

Reporting Frequency: Yearly

ISO

ISSO

After Actions Report Lessons Learned

2. What is the number of individuals who have completed personnel screening?

Collection Frequency: As Needed Reporting Frequency: Yearly

ISO

ISSO

SAAR Form image1.gif