Task 2 RMF_Security Planning.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Security Planning Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information Technology (IT)"

ii. DoD Instruction 8500.01, "Cybersecurity", as amended

iii. Committee on National Security Systems (CNSS) Instruction No. 1253, " Security Categorization and Control Selection for National Security Systems"

Table of Contents

Table 1 - SP-800-53v4 Compliance Matrix 1

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

SECURITY PLANNING

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The objective of security planning is to improve protection of information system resources. All federal systems have some level of sensitivity and require protection as part of good management practice. The protection of a system must be documented in a system security plan. The completion of system security plans is a requirement of the Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources,” Appendix III, “Security of Federal Automated Information Resources,” and” Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA).

The DoD has established an integrated enterprise-wide decision structure for cybersecurity risk management (the Risk Management Framework (RMF)) that includes cybersecurity requirements for DoD information technologies will be managed through the RMF consistent with the principals established in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37.

This plan ensures that {ACRONYM} follows the established guidelines and requirements for security planning. The formal System Security Plan is documented separately. The purpose of this document is to consolidate information and provide traceability to security control requirements.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

2.0 SECURITY PLANNING POLICY AND PROCEDURES

{ACRONYM} is automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT)”. DoDI 8510.01 meets the requirements for a security planning policy. DoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities.

The RMF has the following characteristics:

· Promotes the concept of near real-time risk management and ongoing information system authorization through the implementation of robust continuous monitoring processes;

· Encourages the use of automation to provide senior leaders the necessary information to make cost-effective, risk-based decisions with regard to the organizational information systems supporting their core missions and business functions;

· Integrates information security into the enterprise architecture and system development life cycle;

· Provides emphasis on the selection, implementation, assessment, and monitoring of security controls, and the authorization of information systems;

· Links risk management processes at the information system level to risk management processes at the organization level through a risk executive (function); and

· Establishes responsibility and accountability for security controls deployed within organizational information systems and inherited by those systems (i.e., common controls).

3.0 SYSTEM SECURITY PLAN (SSP)

The purpose of the SSP is to provide an overview of the security requirements of {ACRONYM} and describe the controls in place or planned for meeting those requirements. The SSP also delineates responsibilities and expected behavior of all individuals who access {ACRONYM}. The SSP should be viewed as documentation of the structured process of planning adequate, cost-effective security protection for {ACRONYM}. The formal SSP for {ACRONYM} is documented separately. {ACRONYM} coordinates security-related activities affecting the information system with the following groups:

Has an SSP been created for {ACRONYM}?

☐ No

☐ Yes

If Yes, does the SSP contain a list of the individuals or groups with whom security-related activities are planned and coordinated?

☐ No

☐ Yes

Within the {ACRONYM} SSP, is the following information defined:

Is the security plan protected from unauthorized disclosure?

☐ No

☐ Yes

If Yes, describe the controls in place.

Click or tap here to enter text.

Is the security plan protected from unauthorized modification?

☐ No

☐ Yes

If Yes, describe the controls in place.

Click or tap here to enter text.

4.0 RULES OF BEHAVIOR

{ACRONYM} utilizes DD Form 2875 (System Access Authorization Agreement (SAAR)) as the methodology to request and grant access to {ACRONYM}.

The SAAR contains the following information:

· Explicit restrictions on the use of social media/networking sites IAW DoDI 8550.01

· Explicit restrictions on posting organizational information on public websites IAW DoDI 8550.01 The SAAR has clearly defined and established rules describing {ACRONYM} user responsibilities and expected behavior with regard to information and information system usage.

SAARs are stored with the ISSM and {ACRONYM} documentation. The SAAR is shared with required parties via email. The SAARs are reviewed annually. In the event the SAAR is revised or updated, the end user must read and resign the form.

5.0 SECURITY CONCEPT OF OPERATIONS

The Security Concept of Operations for {ACRONYM} is contained within its System Security Plan (SSP). The {ACRONYM} SSP is reviewed annually as confirmed by the Change Record contained within the SSP.

6.0 INFORMATION SECURITY ARCHITECTURE

The information security architecture for {ACRONYM} is a unified security design that addresses the RMF requirements.

Has a system architecture been created for {ACRONYM}?

☐ No

☐ Yes

If Yes, within the Security Architecture contained in the SSP is the following information defined:

7.0 CENTRAL MANAGEMENT

{ACRONYM} is automatically compliant with this requirement because they are covered at the DoD level. DoDI 8500.01, DoDI 8510.01, and CNSSI 1253 meet the DoD requirements for centrally managing security controls and related processes.

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as Organizational personnel with planning responsibilities or information security responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as Organizational personnel with planning responsibilities or information security responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.

DoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDI 8510.01 meets the requirements for a security planning policy.

DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.

DoD has defined the frequency as every 5 years.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDI 8510.01 meets the requirements for a security planning policy.

DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.

DoD has defined the frequency as reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.

DoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Moderate High Moderate

Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines the documented individuals or groups to ensure the organization being inspected/assessed defines the individuals or groups with whom security-related activities are planned and coordinated.

DoD has determined the individuals or groups are not appropriate to define at the Enterprise level.

Section 3

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment examines the organization's information sharing portal to ensure at a minimum, the ISSO, ISSM and SCA have been provided changes to the security plan.

DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.

Section 3 eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan via the organization's information sharing portal to ensure the organization being inspected/assessed distributes copies of the security plan to at a minimum, the ISSO, ISSM and SCA via the organization's information sharing portal.

DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.

Section 3 eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit records of security plan reviews to verify the security plan has been reviewed annually.

DoD has defined the frequency as annually.

Section 3 eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit records of security plan updates to verify the security plan is current.

The purpose of the reviews is to validate the organization is updating the Information System (IS) security plan to address changes to the IS, its environment of operation, or problems identified during plan implementation or security control assessments.

Section 3 eMASS SSP

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate

Moderate

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the rules of behavior annually.

DoD has defined the frequency as annually.

Section 4

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

DoD has defined the frequency as annually.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be allocated to organization-defined locations.

DoD has determined the security safeguards are not appropriate to define at the Enterprise level.

Section 6 eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be allocated to organization-defined architectural layers.

DoD has determined the security safeguards are not appropriate to define at the Enterprise level.

Section 6 eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented locations to ensure the organization being inspected/assessed defines the locations to which it allocates organization-defined security safeguards in the security architecture.

DoD has determined the locations are not appropriate to define at the Enterprise level.

Section 6 eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented architectural layers to ensure the organization being inspected/assessed defines the architectural layers to which it allocates organization-defined security safeguards in the security architecture.

DoD has determined the architectural layers are not appropriate to define at the Enterprise level.

Section 6 eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information security architecture annually to reflect updates in the enterprise architecture.

DoD has defined the frequency as annually.

Section 6 eMASS SSP

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

Moderate Low High Moderate Low High Moderate Low

eMASS SSP

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and CNSSI 1253.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has defined the security controls and related processes to be centrally managed as CNSSI 1253, DoDI 8510.01, and DoDI 8500.01.

Automatically compliant with this CCI because they are covered at the DoD level

FOR OFFICIAL USE ONLY 12

image1.gif